Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/api0cradle/redteamscripts
Just some random Red Team Scripts that can be useful
https://github.com/api0cradle/redteamscripts
Last synced: about 4 hours ago
JSON representation
Just some random Red Team Scripts that can be useful
- Host: GitHub
- URL: https://github.com/api0cradle/redteamscripts
- Owner: api0cradle
- Created: 2023-06-14T11:17:16.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2024-06-28T11:09:43.000Z (6 months ago)
- Last Synced: 2024-12-15T13:06:48.937Z (7 days ago)
- Language: Python
- Homepage:
- Size: 10.7 KB
- Stars: 136
- Watchers: 3
- Forks: 11
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# RedTeamScripts
This repo will contain some random Red Team Scripts that I made that can be useful for others.
## Scripts usage
### application_downloader.py
Thanks to the awesome research by Nick Powers (@zyn3rgy) and Steven Flores (@0xthirteen) over at Specterops I decided that I needed to create this script in order to quickly download .application files.
The script will download the .application file and parse it. Figure out the manifest and pull down the rest of the files.
Link to research: https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
Link to talk: https://www.youtube.com/watch?v=cyHxoKvD8Ck
They also released some tools:
- https://github.com/zyn3rgy/ClickonceHunter
- https://github.com/0xthirteen/AssemblyHunter
```
Usage: application_downloader.py [options]
Options:
-h, --help show this help message and exit
-u URL, --url=URL Required. Url of application file
-o OUTPUTFOLDER, --outputfolder=OUTPUTFOLDER
Output folder for the downloaded application. Default
is: currentdir\downloaded
--useragent=USERAGENT
Useragent you want to use for the requests. Default
is: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/112.0.0.0 Safari/537.36
-l URLLIST, --list=URLLIST
Path to file containing list of urls pointing to
.application files
```
The urllist needs to be a list seperated with newline with a url to each .application file url.
Example:
```
https://www.randomdomain.com/someapp/someapp.application
https://www.randomdomain2.com/someapp2/someapp2.application
```
### offline_address_book_extractor.py
A script I wrote based losely on the https://github.com/grnbeltwarrior/OAB_Cleaver/blob/main/OAB_Cleaver.py script.
You will need to get your hands on a udetails.oab file that by default resides in the folder `C:\Users\\AppData\Local\Microsoft\Outlook\Offline Address Books\\udetails.oab`.
The `udetails.oab` will be input to this script and it parses out SMTP,SIP,UPN and Phone numbers.
```
usage: offline_address_book_extractor.py [-h] -i UDETAILSFILE [-o OUTFILE]
Udetails.oab extractor
options:
-h, --help show this help message and exit
-i UDETAILSFILE, --udetailsfile UDETAILSFILE
Path to udetails.oab file you want to parse
-o OUTFILE, --outfile OUTFILE
Name of outfile from the export - Default is current directory\udetails_YYYMMDD_HHMMSS.csv
```
Example output:
```
UPN:[email protected],Phone:None,Smtp:{'SMTP:[email protected]', 'smtp:[email protected]'},Sip:None
UPN:[email protected],Phone:999-999-9999,Smtp:{'smtp:[email protected]', 'SMTP:mail,[email protected]'},Sip:{'SIP:mail,[email protected]'}
```
### generate-udl.ps1
A super simple PowerShellscript to generate UDL files. Takes a list of email addresses and outputs UDL files.
Remember to change the following variables inside the script:
$serveraddress
$path
$userfilepath
$prefixudl