Gist

	# Simple script to check drivers in C:\windows\system32\drivers against the loldrivers list
	# Author: Oddvar Moe - @oddvar.moe

	$drivers = get-childitem -Path c:\windows\system32\drivers
	$web_client = new-object system.net.webclient
	$jsonString = $web_client.DownloadString("https://www.loldrivers.io/api/drivers.json")
	$jsonString = $jsonString -replace '"INIT"','"init"'
	$loldrivers = $jsonString \| ConvertFrom-Json

	Write-output("Checking {0} drivers in C:\windows\system32\drivers against loldrivers.io json file" -f $drivers.Count)

	olevba 0.55.1 on Python 3.8.3 - http://decalage.info/python/oletools
	===============================================================================
	FILE: 38bd9e647609d121621fc817ab2fdb5b58e9a2ac6c2f6640c36bc2164e7d54f1
	Type: OpenXML
	-------------------------------------------------------------------------------
	VBA MACRO ThisDocument.cls
	in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument'
	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	Private Declare PtrSafe Function ExpandString Lib "kernel32" Alias "ExpandEnvironmentStringsA" (ByVal lpSrc As String, ByVal lpDst As String, ByVal nSize As Long) As Long

	# import the necessary toolsets
	Import-Module .\powermad.ps1
	Import-Module .\powerview.ps1

	# we are TESTLAB\attacker, who has GenericWrite rights over the primary$ computer account
	whoami

	# the target computer object we're taking over
	$TargetComputer = "primary.testlab.local"

	::
	::#######################################################################
	::
	:: Change file associations to protect against common ransomware attacks
	:: Note that if you legitimately use these extensions, like .bat, you will now need to execute them manually from cmd or powershell
	:: Alternatively, you can right-click on them and hit 'Run as Administrator' but ensure it's a script you want to run :)
	:: ---------------------
	ftype htafile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
	ftype WSHFile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
	ftype batfile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"

	function Copy-AuthenticodeSignedFile {
	<#
	.SYNOPSIS

	Creates a copy of an Authenticode-signed PowerShell file that has a unique file hash but retains its valid signature.

	.DESCRIPTION

	Copy-AuthenticodeSignedFile creates a copy of an Authenticode-signed PowerShell file that has a unique file hash but retains its valid signature. This is used to bypass application whitelisting hash-based blacklist rules.

	Windows version:
	reg query x64 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

	Users who have authed to the system:
	ls C:\Users\

	System env variables:
	reg query x64 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

	Saved outbound RDP connections:

	<#
	Simply Invoke the Script and send the target a link to http://192.168.1.1/app.hta
	To change your server, simply find and replace 192.168.1.1 with your server in the code.

	#>

	<#
	Moving Credtis for CACTUSTORCH HERE
	I was in escape sequcence hell ;-)
	' ( ) ( )

	From the inside out, a minimalist backdoor.

	I'm a pretty big fan of simple, and elegant. In this gist blog, I'll show you a very simple way to maintain access to a remote system that is behind a FireWall, NAT and VPN.

	We will use in this example 3 tools.
	1. Node
	2. PowerShell
	3. LocalTunnel

	While I have a full compact, custom version, I will not release this.

	#
	# Demonstrate how to queue tasks to execute with each checkin...
	#

	#
	# yield tells a function to pause and return a value. The next time the same instance of the
	# function is called, it will resume after where it last yielded.
	#
	sub stuffToDo {
	# Tasks for first checkin

c:\Windows\ccm\inventory\noidmifs
c:\Windows\ccm\logs
c:\Windows\ccm\systemtemp\appvtempdata\appvcommandoutput

Read the original on gist.github.com ↗