Report - gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1

Report Overview

Submitted URL
gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1
IP
172.65.251.78
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-26 03:32:41
Access
public
Website Title
gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1
Final URL
gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
gitlab.com	17719	2004-01-15	2014-06-06	2024-04-25	1.8 kB	264 kB	172.65.251.78

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size

gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1

172.65.251.78

256 kB

URL
gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1
IP
172.65.251.78:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (8787)
Size
256 kB (256511 bytes)
Hash
e5c61e4a5e49484f1194537a5173e672
4019f111a1579583a9303cf6bac74093e6a7b87d
0e18fe371f5aaaf5e8d38f4d781199873dbef917b1ea4da95ef7ae5536aad9b5

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

HTTP Headers

GET /JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1 HTTP/1.1
Host: gitlab.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 03:32:16 GMT
content-type: text/plain; charset=utf-8
content-length: 256511
cache-control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60
content-disposition: inline
content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com snowplow.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-rN7AiuAeK7rP5AGX8+mkXA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data:
etag: "ced04b2d0aea6d3d8963bae6496ff46f"
permissions-policy: interest-cohort=()
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-gitlab-meta: {"correlation_id":"01HVYNGAC2AR481KX83GVSME5X","version":"1"}
x-permitted-cross-domain-policies: none
x-request-id: 01HVYNGAC2AR481KX83GVSME5X
x-runtime: 0.080949
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
gitlab-lb: haproxy-main-03-lb-gprd
gitlab-sv: web-gke-us-east1-b
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NpaRPBV1nkU3kiicrJcZ8%2FcsoH%2FogOTeKDLOHiitJJz57KCDEarI8DFL7IIphWMEgV5dk%2B794Bp%2BUt%2BBL4RDe7MMIev7zLgBGW2rcGGyMdXdfiMz0YFnu7nPmMw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=31536000
set-cookie: _cfuvid=O6VmTnkhnANY8_JZ604YztP0Zz1iqar8nqsX_Te4dLc-1714102336298-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 87a3812feee55699-OSL
X-Firefox-Spdy: h2

gitlab.com/favicon.ico

172.65.251.78

168 B

URL
gitlab.com/favicon.ico
IP
172.65.251.78:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with no line terminators
Size
168 B (168 bytes)
Hash
6f275076fd9f61de8a091370de8e8e09
26951ea9fb91ad8fe90393e7d9abf0beca070c78
8a2dd93bbe2a756ae680d87021c938211233f6b21303c2ca3b40cb84b0649980

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: gitlab.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1
DNT: 1
Connection: keep-alive
Cookie: _cfuvid=O6VmTnkhnANY8_JZ604YztP0Zz1iqar8nqsX_Te4dLc-1714102336298-0.0.1.1-604800000
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 301 Moved Permanently
date: Fri, 26 Apr 2024 03:32:16 GMT
content-type: text/html
content-length: 168
location: https://gitlab.com/assets/favicon-72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef.png
cache-control: no-cache
content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-uwCHig3xvMmKclxRNAF4uw=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data:
x-gitlab-meta: {"correlation_id":"01HWC7BZ62GJS328E9G48T29XR","version":"1"}
x-request-id: 01HWC7BZ62GJS328E9G48T29XR
x-runtime: 0.012828
gitlab-lb: haproxy-main-15-lb-gprd
gitlab-sv: web-gke-us-east1-b
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SToGsxUJbmGahYdRkIP6xxfrQMGYfwdUHth5mMAbTxg0Y%2B7wO5BOrWXjWJma2StKiE3SfPRYx4NDs4PLXRFe30QmBgwlisfUyrsAMoaia%2BEeIcKNNgpBOZB%2FMBY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: cloudflare
cf-ray: 87a38133c8315699-OSL
X-Firefox-Spdy: h2

gitlab.com/assets/favicon-72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef.png

172.65.251.78

591 B

URL
gitlab.com/assets/favicon-72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef.png
IP
172.65.251.78:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
591 B (591 bytes)
Hash
66f9a1c3f2cfd0df1b570990e86d3095
1b9ed5c9db3047a561e2ca4cbcbc8a1623700ed9
72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef

HTTP Headers

GET /assets/favicon-72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef.png HTTP/1.1
Host: gitlab.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gitlab.com/JoelGMSec/AutoRDPwn/-/raw/main/Resources/Scripts/Invoke-PrivescCheck.ps1
DNT: 1
Connection: keep-alive
Cookie: _cfuvid=O6VmTnkhnANY8_JZ604YztP0Zz1iqar8nqsX_Te4dLc-1714102336298-0.0.1.1-604800000
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 03:32:16 GMT
content-type: image/png
content-length: 591
x-guploader-uploadid: ABPtcPr5zD6YtiS8gTGp68Px7bclbEG89AkNgko_tuRKLQMSdYaAieLELpxIL_oTc-8w3BJuXUfsMUhmgA
cache-control: public,max-age=31536000
expires: Tue, 04 Mar 2025 20:15:36 GMT
last-modified: Mon, 04 Mar 2024 16:35:13 GMT
etag: "66f9a1c3f2cfd0df1b570990e86d3095"
x-goog-generation: 1709570113713532
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 591
x-goog-hash: crc32c=6pSU8g==, md5=Zvmhw/LP0N8bVwmQ6G0wlQ==
x-goog-storage-class: STANDARD
vary: Origin, Accept-Encoding
cf-cache-status: HIT
age: 2031422
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B%2BB1Rc3f%2FrTDZh5OW5KImnQpSDdViojVD7N4mlMIcBzGGHHAmJLfSI753OSDIWhL2rY%2FtqCZOn5BA0mBF1u573Wz%2B8CamZCJZLV9XSdXeDBrYsMzgxddzdmEw5g%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: cloudflare
cf-ray: 87a38134f9265699-OSL
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (3)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers