Skip to content

Commit a5ea90e

Browse files
freefirexfreefirex
authored
Merge pull request #52 from nickvourd/patch-4
Update command usage format in README
2 parents 8ee8c59 + d277c4b commit a5ea90e

File tree

1 file changed

+32
-32
lines changed

1 file changed

+32
-32
lines changed

‎README.md‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -16,41 +16,41 @@ You are welcome to use these, but issues opened related to these will be closed
1616

1717
|Command|Usage|Notes|
1818
|-------|-----|-----|
19-
|adcs_request| adcs_request CA [opt:TEMPLATE] [opt:SUBJECT] [opt: ALTNAME] [opt: INSTALL] [opt:MACHINE] | Request an enrollment certificate|
19+
|adcs_request| adcs_request [CA] [OPT:TEMPLATE] [OPT:SUBJECT] [OPT:ALTNAME] [OPT:INSTALL] [OPT:MACHINE] [OPT:ADD_APP_POLICY] [OPT:DNS] | Request an enrollment certificate|
2020
|adcs_request_on_behalf| adcs_request_on_behalf [TEMPLATE] [REQUESTER] [ENROLLMENT_AGENT.pfx] [Download_Name] | Request an enrollment certificate on behalf of another user|
21-
|adduser| adduser <USERNAME> <PASSWORD> <SERVER> | Add specified user to a machine|
22-
|addusertogroup| addusertogroup <USERNAME> <GROUPNAME> <SERVER> <DOMAIN> | Add specified user to a group|
21+
|adduser| adduser [USERNAME] [PASSWORD] [SERVER] | Add specified user to a machine|
22+
|addusertogroup| addusertogroup [USERNAME] [GROUPNAME] [SERVER] [DOMAIN] | Add specified user to a group|
2323
|chromeKey| chromeKey | Decrypt the provided base64 encoded Chrome key|
24-
|enableuser| enableuser <USERNAME> <DOMAIN> | Enable and unlock the specified user account|
25-
|get_azure_token| get_azure_token <client-id> <scope> <browser (see below)> [opt: hint] [opt: browser_path] | Attempts to complete an OAuth codeflow grant against azure using saved logins |
26-
|get_priv| get_priv <Privledge Name> | Activate the specified token privledge, more for non-cobalt strike users|
24+
|enableuser| enableuser [USERNAME] [DOMAIN] | Enable and unlock the specified user account|
25+
|get_azure_token| get_azure_token [CLIENT ID] [SCOPE] [BROWSER] [OPT:HINT] [OPT:BROWSER PATH] | Attempts to complete an OAuth codeflow grant against azure using saved logins |
26+
|get_priv| get_priv [Privledge Name] | Activate the specified token privledge, more for non-cobalt strike users|
2727
|global_unprotect| global_unprotect | Locates and Decrypts GlobalProtect config files converted from: [GlobalUnProtect](https://github.com/rotarydrone/GlobalUnProtect/tree/409d64b097e0a928a5545051e40e1566e9c26bd0)|
28-
|lastpass | lastpass <number of pids> <pid>,<pid>,<pid> ... | Search Chrome, brave memory for LastPass passwords and data|
29-
|make_token_cert| make_token_cert <path to .pfx> [opt: password] | Impersonates a user using the altname of a .pfx file |
30-
|office_tokens| office_tokens <pid> | Collect Office JWT Tokens from any Office process|
31-
|procdump| procdump <PID> <FILEOUT> | Dump the specified process to the specified output file|
32-
|ProcessDestroy| ProcessDestroy <PID> <OPT:HANDLEID> | Close handle(s) in a process|
33-
|ProcessListHandles| ProcessListHandles <PID> | List all open handles in a specified process|
34-
|reg_delete| reg_delete <OPT:HOSTNAME> <HIVE> <REGPATH> <OPT:REGVALUE> | Delete a registry key|
35-
|reg_save| reg_save <HIVE> <REGPATH> <FILEOUT> | Save a registry hive to disk|
36-
|reg_set| reg_set <OPT:HOSTNAME> <HIVE> <KEY> <VALUE> <TYPE> <DATA> | Set / create a registry key|
37-
|sc_config| sc_config <SVCNAME> <BINPATH> <ERRORMODE> <STARTMODE> <OPT:HOSTNAME> | Configure an existing service|
38-
|sc_create| sc_create <SVCNAME> <DISPLAYNAME> <BINPATH> <DESCRIPTION> <ERRORMODE> <STARTMODE> <OPT:TYPE> <OPT:HOSTNAME> | Create a new service|
39-
|sc_delete| sc_delete <SVCNAME> <OPT:HOSTNAME> | Delete an existing service|
40-
|sc_failure| sc_failure <SVCNAME> <RESETPERIOD> <REBOOTMESSAGE> <COMMAND> <NUMACTIONS> <ACTIONS> <OPT:HOSTNAME> | Configures the actions upon failure of an existing service|
41-
|sc_description| sc_description <SVCNAME> <DESCRIPTION> <OPT:HOSTNAME> | Modify an existing services description|
42-
|sc_start| sc_start <SVCNAME> <OPT:HOSTNAME> | Start an existing service|
43-
|sc_stop| sc_stop <SVCNAME> <OPT:HOSTNAME> | Stop an existing service|
44-
|schtaskscreate| schtaskscreate <OPT:HOSTNAME> <USERNAME> <PASSWORD> <TASKPATH> <USERMODE> <FORCEMODE> | Create a new scheduled task (via xml definition)|
45-
|schtasksdelete| schtasksdelete <OPT:HOSTNAME> <TASKNAME> <TYPE> | Delete an existing scheduled task|
46-
|schtasksrun| schtasksrun <OPT:HOSTNAME> <TASKNAME> | Start a scheduled task|
47-
|schtasksstop| schtasksstop <OPT:HOSTNAME> <TASKNAME> | Stop a running scheduled task|
48-
|setuserpass| setuserpass <USERNAME> <PASSWORD> <DOMAIN> | Set a user's password|
49-
|shspawnas| shspawnas <domain> <username> <password> <opt: shellcodefile> | A misguided attempt at injecting code into a newly spawned process|
50-
|shutdown| shutdown <hostname> "<message>" <time> <closeapps> <reboot> | Shutdown or reboot a local or remote computer, with or without a warning/message
51-
|slack_cookie| slack_cookie <pid> | Collect the Slack authentication cookie from a Slack process|
52-
|unexpireuser| unexpireuser <USERNAME> <DOMAIN> | Set a user account to never expire|
53-
|ghost_task| ghost_task <hostname/localhost> <operation> <taskname> <program> <argument> <username> <scheduletype> <time/second> <day> | Add/Delete a ghost task. |
28+
|lastpass | lastpass [NUMBER OF PIDs] [PID],[PID],[PID],[PID] ... | Search Chrome, brave memory for LastPass passwords and data|
29+
|make_token_cert| make_token_cert [.PFX LOCAL PATH] [OPT:PFX PASSWORD]| Impersonates a user using the altname of a .pfx file |
30+
|office_tokens| office_tokens [PID] | Collect Office JWT Tokens from any Office process|
31+
|procdump| procdump [PID] [FILEOUT] | Dump the specified process to the specified output file|
32+
|ProcessDestroy| ProcessDestroy [PID] [OPT:HANDLEID] | Close handle(s) in a process|
33+
|ProcessListHandles| ProcessListHandles [PID] | List all open handles in a specified process|
34+
|reg_delete| reg_delete [OPT:HOSTNAME] [HIVE] [REGPATH] [OPT:REGVALUE] | Delete a registry key|
35+
|reg_save| reg_save [HIVE] [REGPATH] [FILEOUT] | Save a registry hive to disk|
36+
|reg_set| reg_set [OPT:HOSTNAME] [HIVE] [KEY] [VALUE] [TYPE] [DATA] | Set / create a registry key|
37+
|sc_config| sc_config [SVCNAME] [BINPATH] [ERRORMODE] [STARTMODE] [OPT:HOSTNAME] | Configure an existing service|
38+
|sc_create| sc_create [SVCNAME] [DISPLAYNAME] [BINPATH] [DESCRIPTION] [ERRORMODE] [STARTMODE] [OPT:TYPE] [OPT:HOSTNAME] | Create a new service|
39+
|sc_delete| sc_delete [SVCNAME] [OPT:HOSTNAME] | Delete an existing service|
40+
|sc_failure| sc_failure [SVCNAME] [RESETPERIOD] [REBOOTMESSAGE] [COMMAND] [NUMACTIONS] [ACTIONS] [OPT:HOSTNAME] | Configures the actions upon failure of an existing service|
41+
|sc_description| sc_description [SVCNAME] [DESCRIPTION] [OPT:HOSTNAME] | Modify an existing services description|
42+
|sc_start| sc_start [SVCNAME] [OPT:HOSTNAME] | Start an existing service|
43+
|sc_stop| sc_stop [SVCNAME] [OPT:HOSTNAME] | Stop an existing service|
44+
|schtaskscreate| schtaskscreate [OPT:HOSTNAME] [USERNAME] [PASSWORD] [TASKPATH] [USERMODE] [FORCEMODE] | Create a new scheduled task (via xml definition)|
45+
|schtasksdelete| schtasksdelete [OPT:HOSTNAME] [TASKNAME] [TYPE] | Delete an existing scheduled task|
46+
|schtasksrun| schtasksrun [OPT:HOSTNAME] [TASKNAME] | Start a scheduled task|
47+
|schtasksstop| schtasksstop [OPT:HOSTNAME] [TASKNAME] | Stop a running scheduled task|
48+
|setuserpass| setuserpass [USERNAME] [PASSWORD] [DOMAIN] | Set a user's password|
49+
|shspawnas| shspawnas [DOMAIN] [USERNAME] [PASSWORD] [OPT:SHELLCODEFILE] | A misguided attempt at injecting code into a newly spawned process|
50+
|shutdown| shutdown [HOSTNAME] \"[MESSAGE]\" [TIME] [CLOSEAPPS] [REBOOT] | Shutdown or reboot a local or remote computer, with or without a warning/message
51+
|slack_cookie| slack_cookie [PID] | Collect the Slack authentication cookie from a Slack process|
52+
|unexpireuser| unexpireuser [USERNAME] [DOMAIN] | Set a user account to never expire|
53+
|ghost_task| ghost_task [HOSTNAME/LOCALHOST] [OPERATION] [TASKANME] [PROGRAM] [ARGUMENT] [USERNAME] [SCHEDULETYPE] [TIME/SECOND] [DAY] | Add/Delete a ghost task. |
5454

5555
## Contributing
5656

0 commit comments

Comments
 (0)