{"id":21454619,"url":"https://github.com/api0cradle/redteamscripts","last_synced_at":"2025-09-02T05:32:01.909Z","repository":{"id":175255512,"uuid":"653603175","full_name":"api0cradle/RedTeamScripts","owner":"api0cradle","description":"Just some random Red Team Scripts that can be useful","archived":false,"fork":false,"pushed_at":"2024-06-28T11:09:43.000Z","size":11,"stargazers_count":136,"open_issues_count":0,"forks_count":11,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-12-22T14:11:28.246Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/api0cradle.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-14T11:17:16.000Z","updated_at":"2024-12-05T02:08:53.000Z","dependencies_parsed_at":null,"dependency_job_id":"e3d0accf-c00a-4b42-94da-a49593164e7b","html_url":"https://github.com/api0cradle/RedTeamScripts","commit_stats":null,"previous_names":["api0cradle/redteamscripts"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/api0cradle%2FRedTeamScripts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/api0cradle%2FRedTeamScripts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/api0cradle%2FRedTeamScripts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/api0cradle%2FRedTeamScripts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/api0cradle","download_url":"https://codeload.github.com/api0cradle/RedTeamScripts/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":231749535,"owners_count":18420827,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-23T05:08:25.580Z","updated_at":"2024-12-29T15:09:30.254Z","avatar_url":"https://github.com/api0cradle.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RedTeamScripts\nThis repo will contain some random Red Team Scripts that I made that can be useful for others.\n\n\n## Scripts usage\n\n### application_downloader.py\nThanks to the awesome research by Nick Powers (@zyn3rgy) and Steven Flores (@0xthirteen) over at Specterops I decided that I needed to create this script in order to quickly download .application files.\nThe script will download the .application file and parse it. Figure out the manifest and pull down the rest of the files. \n\nLink to research: https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5\n\nLink to talk: https://www.youtube.com/watch?v=cyHxoKvD8Ck\n\nThey also released some tools: \n- https://github.com/zyn3rgy/ClickonceHunter\n- https://github.com/0xthirteen/AssemblyHunter\n```\nUsage: application_downloader.py [options]\n\nOptions:\n  -h, --help            show this help message and exit\n  -u URL, --url=URL     Required. Url of application file\n  -o OUTPUTFOLDER, --outputfolder=OUTPUTFOLDER\n                        Output folder for the downloaded application. Default\n                        is: currentdir\\downloaded\n  --useragent=USERAGENT\n                        Useragent you want to use for the requests. Default\n                        is: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\n                        AppleWebKit/537.36 (KHTML, like Gecko)\n                        Chrome/112.0.0.0 Safari/537.36\n  -l URLLIST, --list=URLLIST\n                        Path to file containing list of urls pointing to\n                        .application files\n```\n\nThe urllist needs to be a list seperated with newline with a url to each .application file url. \nExample:\n```\nhttps://www.randomdomain.com/someapp/someapp.application\nhttps://www.randomdomain2.com/someapp2/someapp2.application\n```\n\n### offline_address_book_extractor.py\nA script I wrote based losely on the https://github.com/grnbeltwarrior/OAB_Cleaver/blob/main/OAB_Cleaver.py script.\nYou will need to get your hands on a udetails.oab file that by default resides in the folder `C:\\Users\\\u003cUSERNAME\u003e\\AppData\\Local\\Microsoft\\Outlook\\Offline Address Books\\\u003cGUID\u003e\\udetails.oab`.\nThe `udetails.oab` will be input to this script and it parses out SMTP,SIP,UPN and Phone numbers.\n\n```\nusage: offline_address_book_extractor.py [-h] -i UDETAILSFILE [-o OUTFILE]\n\nUdetails.oab extractor\n\noptions:\n  -h, --help            show this help message and exit\n  -i UDETAILSFILE, --udetailsfile UDETAILSFILE\n                        Path to udetails.oab file you want to parse\n  -o OUTFILE, --outfile OUTFILE\n                        Name of outfile from the export - Default is current directory\\udetails_YYYMMDD_HHMMSS.csv\n```\n\nExample output:\n```\nUPN:mail.user1@company.com,Phone:None,Smtp:{'SMTP:mail.user1@company.com', 'smtp:user1_alias@company.com'},Sip:None\nUPN:mail.user2@company.com,Phone:999-999-9999,Smtp:{'smtp:mail.user2@company.onmicrosoft.com', 'SMTP:mail,user2@company.com'},Sip:{'SIP:mail,user2@company.com'}\n```\n\n### generate-udl.ps1\nA super simple PowerShellscript to generate UDL files. Takes a list of email addresses and outputs UDL files.\nRemember to change the following variables inside the script:\n$serveraddress\n$path\n$userfilepath\n$prefixudl\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapi0cradle%2Fredteamscripts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fapi0cradle%2Fredteamscripts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapi0cradle%2Fredteamscripts/lists"}