Skip to content

Instantly share code, notes, and snippets.

View EvanMcBroom's full-sized avatar
☕

Evan McBroom EvanMcBroom

☕
193 followers · 206 following
View GitHub Profile
@olamotte
olamotte / Binary SD to human readable DACL
Created January 12, 2020 16:45
Windows Registry conversion from binary Security Descriptor to SDDL DACL
#Example: Which users can access the SMB Session information on a Windows 10 computer (NetCease status)
#Retrieve the binary value
$acl=Get-ItemProperty -Path Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity -Name SrvsvcSessionInfo
#Use WMI helper to obtain a converter
$converter = new-object system.management.ManagementClass Win32_SecurityDescriptorHelper
#Do the conversion to SDDL
$outsddl = $converter.BinarySDToSDDL($acl.SrvsvcSessionInfo)
@masthoon
masthoon / rpc_dump_rs5.txt
Created January 15, 2019 06:49
RPC interfaces RS5
--------------------------------------------------------------------------------
<WinProcess "smss.exe" pid 368 at 0x5306908L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 472 at 0x5306e48L>
64
Interfaces :
Endpoints :
@mattifestation
mattifestation / TLGMetadataParser.psm1
Last active April 17, 2025 14:01
Retrieves TraceLogging metadata from a file.
#requires -version 5
<#
The things you find on Google searching for specific GUIDs...
Known Keyword friendly names:
"UTC:::CATEGORYDEFINITION.MS.CRITICALDATA":"140737488355328"
"UTC:::CATEGORYDEFINITION.MS.MEASURES":"70368744177664"
"UTC:::CATEGORYDEFINITION.MS.TELEMETRY":"35184372088832"
"UTC:::CATEGORYDEFINITION.MSWLAN.CRITICALDATA":"2147483648"
@arkadiyt
arkadiyt / cryptopals_set_8.md
Last active April 11, 2025 22:48
Cryptopals Set 8

Cryptopals is a set of cryptographic challenges, originally published here: https://cryptopals.com

Set 8 of the challenges was never published publicly, until late March 2018. However the cryptopals website was not updated to include the challenges. This gist compiles the 8th set of the Cryptopals challenges.

title link
57. Diffie-Hellman Revisited: Small Subgroup Confinement https://toadstyle.org/cryptopals/513b590b41d19eff3a0aa028023349fd.txt
58. Pollard's Method for Catching Kangaroos https://toadstyle.org/cryptopals/3e17c7b35fcf491d08c989081ed18c9a.txt
59. Elliptic Curve Diffie-Hellman and Invalid-Curve Attacks https://toadstyle.org/cryptopals/a0833e607878a80fdc0808f889c721b1.txt
@mattifestation
mattifestation / WmiEventConsumerClassDerivation.ps1
Last active November 15, 2023 18:21
function New-ActiveScriptEventConsumerClass {
<#
.SYNOPSIS
Creates an ActiveScriptEventConsumer WMI class in the namespace of your choosing.
.DESCRIPTION
New-ActiveScriptEventConsumerClass creates a clone of the ActiveScriptEventConsumer WMI event consumer class using the class name and namespace name of your choosing.
@lucasg
lucasg / download_pdb_database.py
Created January 16, 2018 10:21
Download pdb and PE files from microsoft symbol store
import os
import re
import sys
import logging
import argparse
import subprocess
import requests
@esoterix
esoterix / callback.c
Last active July 5, 2025 04:55
void InstrumentationCallback(CONTEXT *context)
{
TEB *teb = NtCurrentTeb();
context->Rip = teb->InstrumentationCallbackPreviousPc;
context->Rsp = teb->InstrumentationCallbackPreviousSp;
context->Rcx = context->R10;
// Prevent recursion
if (!teb->InstrumentationCallbackDisabled) {
@danzek
danzek / WindowsNTFS.md
Last active September 7, 2024 13:52
Some important articles on Windows/NTFS

Important articles about Windows/NTFS

This also contains quotes from the articles in case they are moved/deleted/etc.

A file time is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 A.M. January 1, 1601 Coordinated Universal Time (UTC). The system records file times when applications create, access, and write to files.

The NTFS file system stores time values in UTC format, so they are not affected by changes in time zone or daylight saving time. The FAT file system stores time values based on the local time of the computer. For example, a file that is saved at 3:00pm PST in Washington is seen as 6:00pm EST in New York on an NTFS volume, but it is seen as 3:00pm EST in New York on a FAT volume.

@HarmJ0y
HarmJ0y / PowerView-3.0-tricks.ps1
Last active August 21, 2025 16:06
PowerView-3.0 tips and tricks
# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c
# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1
# New function naming schema:
# Verbs:
# Get : retrieve full raw data sets
# Find : ‘find’ specific data entries in a data set
@tknerr
tknerr / README.md
Last active August 2, 2025 19:12
Vagrant with Ansible Provisioner on Windows

Vagrant with Ansible Provisioner on Windows

Long story short, ansible does not work on a Windows control machine, so you basically have to:

  • either run ansible --connection=local ... in the target vm
  • set up a separate control vm where ansible is installed via shell provisioner

Below are Vagrantfile examples for both approaches

Within the Target VM