get eth0 address
ip addr show | grep eth0 | grep inet | sed -e 's/ *inet *//g' -e 's/\/.*//g'

ip link add name X type bridge
ip link set X up
ip set eth0 master X
ip set eth1 master X

# Note: you can find TCP sockets in /proc/net/tcp !
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp -m multiport ! --dports 22,53,80,443 -j REDIRECT --to-port 80

curl -s https://api.github.com/repos/jgm/pandoc/releases/latest \
| grep "browser_download_url.*deb" \
| cut -d '"' -f 4 \
| wget -qi -

rundll32 c:\path\mimilib.dll,start d:\some_path\stuff.exe

rundll32 keymgr.dll,KRShowKeyMgr

::Ref: https://twitter.com/TekDefense/status/823204388982362118
wlrmdr.exe -s 60000 -f 1 -t "text" -m "more text" -a o

mmc devmgmt.msc

# Powershell v2+
$Computer = “.”
$Computer = [ADSI](“WinNT://” + "." + “,computer”)
$LocalAdminGroup = $Computer.psbase.children.find(“Administrators”)
$LocalAdminGroupMembers = $LocalAdminGroup.psbase.invoke(“Members”) | %{ $_.GetType().InvokeMember(“Name”, ‘GetProperty’, $null, $_, $null) }

# Using Powershell v5+
Get-LocalGroupMember "Administrators"

# Using WMI
Get-WmiObject win32_groupuser -Computer localhost

netsh wlan dump
netsh wlan show profiles key=clear name="BotConf2016"
netsh wlan show profiles name="BotConf2016" key=clear

:: Redirect traffic from port 9000 to port 80 on a different IP
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=9000 connectaddress=192.168.3.30 connectport=80
:: Delete portproxy entry
netsh interface portproxy delete v4tov4 listenaddress=127.0.0.1 listenport=9000

# Resolve Hostnames and FQDN
[System.Net.DNS]::GetHostAddresses("quasarops.com")
[System.Net.DNS]::GetHostName("8.8.8.8")
[System.Net.Dns]::GetHostByAddress("10.0.0.1")
[System.Net.Dns]::Resolve("quasarops.com")

[System.Net.NetworkInformation.NetworkInterface]::GetAllNetworkInterfaces()
[System.Net.NetworkInformation.NetworkInterface]::GetIsNetworkAvailable()

Get-ItemProperty "HKCU:\software\Microsoft\Windows\CurrentVersion\Internet Settings\"
Get-ItemProperty "HKCU:\software\Microsoft\Windows\CurrentVersion\Internet Settings\" "AutoConfigURL"
Get-ItemProperty "HKCU:\software\Microsoft\Windows\CurrentVersion\Internet Settings\" "ProxyServer"
Get-ChildItem -recurse 'HKCU:\software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\' | % { $_.GetValue("WpadDetectedURL") }  | sort -Unique

wmic nicconfig where ipenabled=true call /?
wmic nicconfig where ipenabled=true call RenewDHCPLease
wmic nicconfig where ipenabled=true call ReleaseDHCPLease
wmic nicconfig where ipenabled=true list brief
wmic nicconfig where ipenabled=true get ipaddress,macaddress,dnsserversearchorder,dnshostname,defaultipgateway,dhcpserver,description /format:list
wmic nicconfig where ipenabled=true list full

$ping = New-Object System.Net.Networkinformation.Ping
1..254 | % { $ping.send("192.168.100.$_") | select address, status }
for ( $i = 0; $i -le 256 ; $i++ ) { ping 192.168.0.$i }

# This will only return the names of the groups instead of the FQDN
(Get-ADUser SomeUserYeah -Properties MemberOf).MemberOf | % {$_.split("CN=")[1].split(",")[0]}

Get-ADDomain | Get-ADObject -Properties 'ms-DS-MachineAccountQuota'

# With RSAT Module
Get-ADTrust -Filter *

# Without RSAT Module
## First Enumerate Domain Trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
## Then Enumerate Forest Trusts
([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).GetAllTrustRelationships()

# List all Domain Controllers in the Forest
[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Sites | % { $_.Servers } | select Domain,Name,SiteName

Get-ADUser -Server 'some.domain.com' -Filter { SamAccountName -eq 'some_user' } -Properties *

([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).FindAllDomainControllers()

# Convert from Base64

[Convert]::FromBase64String($data)
[Convert]::FromBase64String([System.Text.Encoding]::ASCII.GetBytes($data))
[Convert]::FromBase64String([System.Text.Encoding]::ASCII.GetBytes($data+"="))
[Convert]::FromBase64String([System.Text.Encoding]::ASCII.GetBytes($data+"=="))

# Convert to Base64
[Convert]::ToBase64String($bytes)
[Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($data))

# Convert HEX to DEC
[System.Byte]::Parse("FA",[System.Globalization.NumberStyles]::HexNumber)

# Encode in HEX
[System.BitConverter]::ToString($(Get-Content .\data.bin -encoding Byte))

# Encode Hash in HEX
[System.BitConverter]::ToString(([System.Security.Cryptography.MD5]::Create()).ComputeHash([System.Text.Encoding]::UTF8.GetBytes("SOME-STRING")))
[System.BitConverter]::ToString(([System.Security.Cryptography.SHA1]::Create()).ComputeHash([System.Text.Encoding]::UTF8.GetBytes("SOME-STRING")))
[System.BitConverter]::ToString([System.Security.Cryptography.MD5CryptoServiceProvider]::new().ComputeHash([System.Text.UTF8Encoding]::new().GetBytes("")))
[System.Bitconverter]::ToString(([System.Security.Cryptography.SHA1]::Create()).ComputeHash([System.Text.Encoding]::UTF8.GetBytes("<[email protected]#$%^>")))

# Compute MD5 Hash
[System.Security.Cryptography.MD5CryptoServiceProvider]::new().ComputeHash([System.Text.UTF8Encoding]::new().GetBytes(""))

([System.Security.Cryptography.SHA1]::Create()).ComputeHash([System.Text.Encoding]::UTF8.GetBytes("<[email protected]#$%^>"))

Add-Type -A System.IO.Compression.FileSystem;[IO.Compression.ZipFile]::ExtractToDirectory(src,dst)