w0rk3r's Windows Hacking Library

P0wnedShell: PowerShell Runspace Post Exploitation Toolkit https://github.com/Cn33liz/p0wnedShell @WindowsHackingLibrary

PoC: https://youtu.be/NIPKMSV-KTw @BlueTeamLibrary

TBAL: an (accidental?) DPAPI Backdoor for local users https://vztekoverflow.com/2018/07/31/tbal-dpapi-backdoor @BlueTeamLibrary

Using WinRM Through Meterpreter https://www.trustedsec.com/2017/09/using-winrm-meterpreter @WindowsHackingLibrary

Copying Files via WMI and PowerShell https://www.fortynorthsecurity.com/copying-files-via-wmi-and-powershell @WindowsHackingLibrary

pOWershell obFUsCation https://n1cfury.com/ps-obfuscation @WindowsHackingLibrary

Capturing NetNTLM Hashes with Office [DOT] XML Documents https://bohops.com/2018/08/04/capturing-netntlm-hashes-with-office-dot-xml-documents @WindowsHackingLibrary

When "ASLR" Is Not Really ASLR - The Case of Incorrect Assumptions and Bad Defaults https://insights.sei.cmu.edu/cert/2018/08/when-aslr-is-not-really-aslr---the-case-of-incorrect-assumptions-and-bad-defaults.html @WindowsHackingLibrary

Exploiting XXE Vulnerabilities in IIS/.NET https://pen-testing.sans.org/blog/2017/12/08/entity-inception-exploiting-iis-net-with-xxe-vulnerabilities @WindowsHackingLibrary

ASP.NET resource files (.RESX) and deserialisation issues https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/august/aspnet-resource-files-resx-and-deserialisation-issues/ @WindowsHackingLibrary

PowerShell script which allows pausing\unpausing Win32/64 exes https://github.com/besimorhino/Pause-Process @WindowsHackingLibrary

LDAP Injection Cheat Sheet, Attack Examples & Protection https://www.checkmarx.com/knowledge/knowledgebase/LDAP @WindowsHackingLibrary

Ultimate AppLocker ByPass List: The goal of this repository is to document the most common techniques to bypass AppLocker. https://github.com/api0cradle/UltimateAppLockerByPassList/tree/Dev @WindowsHackingLibrary

Domain Penetration Testing: Using BloodHound, Crackmapexec, & Mimikatz to get Domain Admin https://hausec.com/2017/10/21/domain-penetration-testing-using-bloodhound-crackmapexec-mimikatz-to-get-domain-admin @WindowsHackingLibrary

Notes on Windows Privilege Escalation http://memorycorruption.org/windows/2018/07/29/Notes-On-Windows-Privilege-Escalation.html @WindowsHackingLibrary

Updated PoC Mimikatz Loader for 2018 PoC: https://gist.github.com/caseysmithrc/87f6572547f633f13a8482a0c91fb7b7 One-Liner: https://gist.github.com/xillwillx/96e2c5011577d8583635ad7bf6d4fb58 @WindowsHackingLibrary Via: @SubTee

Post Exploitation Using WMIC (System Command) http://www.hackingarticles.in/post-exploitation-using-wmic-system-command/ @WindowsHackingLibrary

Netsh DLL Helpers http://liberty-shell.com/sec/2018/07/28/netshlep/ @WindowsHackingLibrary

Security Fun: Bloodhound, MS16-072 and GPO Discoverability https://sdmsoftware.com/group-policy-blog/security-related/security-fun-bloodhound-ms16-072-gpo-discoverability @FromZer0toHero