I know I am late to the party,but love this new little thing I learned for Android APK files. Just rename the extension of the APK to ZIP, and then you can extract the files within. So simple, love it.
bulk extractor is worth while running against the decompressed APK file.
https://github.com/simsong/bulk_extractor
2000,XP, 2003,Vista, 2008, Win 7, etc.
Get-ADComputer -Filter * -Properties OperatingSystem,LastLogonDate | where {$_.OperatingSystem -like "*2000*"} | select Name, OperatingSystem, Created, whenCreated, LastLogonDate, ipv4address | sort LastLogonDate -unique | Export-CSV
I switch around "{$_.OperatingSystem -like "*2000*"}" for the various flavors of Windows I might be looking for. "*Vista*", "*2003*", etc.
Get-ADComputer -Filter {TrustedForDelegation -eq $true -and primarygroupid -eq 515} -Properties trustedfordelegation,serviceprincipalname,description
Get-ADComputer -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=524288)"
sudo apt install powershell-empire
as stated above:
in one terminal run `powershell-empire server`, then open a new terminal and run `powershell-empire client`.
I had to open 2 terminal windows. (Ctrl + Shift + T to do it within same terminal window.)
In the first I ran the server command, and in the 2nd the client portion of the script.
When the client loads it attempts to connect to the server on the localhost.
That being said, I am finding many of the commands in the book to be slightly different in this version of Empire.
Some VERY quick notes:::
Start the server first -- sudo powershell-empire server
Then start the client -- sudo powershell-empire client
uselistener http ← the newer version (4.x) will show the options after you complete typing uselistener
info
options ← this has switched to just ‘options’
Set ‘<XXXX>’ seems to work as normal.
A gotcha for me was I had to set the port. Just doing the book and it "failed to validate listener http options"
set Port 80
---->> I did not notice this until later, but in the server window, it was throwing an error saying: "Set the port dammit" (not in so many words ofc.) Next time I will check.
Same as before with the listener, once you set the stager, 'info' will display a few things, but you need 'options' to see all of the things.
It seems 'sysinfo' has been replaced with just 'info'. I like how PS gives you the memory usage and architecture of the process (x86)
A quick Addition:
I made a mistake on my listener, and the only way I could edit it was to disable it first. (Google was not my friend on this.)
listeners --> then "disable http" finally stopped the listener