MrThreat

Threats and pushups

wdormann / disable_ddeauto.reg

Last active October 1, 2024 17:10

Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016

	Windows Registry Editor Version 5.00

	[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Options]
	"DontUpdateLinks"=dword:00000001

	[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Options]
	"DontUpdateLinks"=dword:00000001

	[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options]
	"DontUpdateLinks"=dword:00000001

wdormann / enable_bottom-up_ASLR.reg

Created November 16, 2017 17:52

Enable both Mandatory ASLR *and* Bottom-up ASLR system-wide

	Windows Registry Editor Version 5.00

	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel]
	"MitigationOptions"=hex:00,01,01,00,00,00,00,00,00,00,00,00,00,00,00,00

haccer / scanio.sh

Last active February 18, 2025 14:06

PoC script to mass-locate vulnerable subdomains using results from Rapid7's Project Sonar

	#!/bin/bash
	# Usage : ./scanio.sh <save file>
	# Example: ./scanio.sh cname_list.txt

	# Premium
	function ech() {
	spinner=( "\|" "/" "-" "\\" )
	while true; do
	for i in ${spinner[@]}; do
	echo -ne "\r[$i] $1"

Evilcry / findautoelevate.ps1

Created July 8, 2018 07:40

Enumerate executables with auto-elevation enabled

	# Find Autoelevate executables
	Write-Host "System32 Autoelevate Executables" -ForegroundColor Green -BackgroundColor Black
	Select-String -Path C:\Windows\System32\*.exe -pattern "<AutoElevate>true"
	Write-Host "`nSysWOW64 Autoelevate Executables" -ForegroundColor Green -BackgroundColor Black
	Select-String -Path C:\Windows\SysWOW64\*.exe -pattern "<AutoElevate>true"