In terminal.app, install ffmpeg through homebrew
brew install ffmpeg
Validate the installation:
// A very rough x64 POC for spoofing environment variables similar to argument spoofing with a focus on | |
// setting the COMPlus_ETWEnabled=0 var for disabling ETW in .NET. | |
// | |
// Works by launching the target process suspended, reading PEB, updates the ptr used to store environment variables, | |
// and then resuming the process. | |
// | |
// (https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/) | |
#define INJECT_PARAM L"COMPlus_ETWEnabled=0\0\0\0" | |
#define INJECT_PARAM_LEN 43 |
package main | |
/* | |
Example Go program with multiple .NET Binaries embedded | |
This requires packr (https://github.com/gobuffalo/packr) and the utility. Install with: | |
$ go get -u github.com/gobuffalo/packr/packr | |
Place all your EXEs are in a "binaries" folder |
################################################## | |
## PyDefenderCheck - Python implementation of DefenderCheck | |
################################################## | |
## Author: daddycocoaman | |
## Based on: https://github.com/matterpreter/DefenderCheck | |
################################################## | |
import argparse | |
import enum |
In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;
The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.
using System; | |
using System.DirectoryServices; | |
namespace SharpApprover | |
{ | |
class Program | |
{ | |
public static void SetAdInfo(string objectFilter, | |
int objectValue, string LdapDomain) |
from cryptography.hazmat.backends import default_backend | |
from cryptography.hazmat.primitives import serialization | |
from cryptography.hazmat.primitives.asymmetric import rsa | |
from cryptography import x509 | |
from cryptography.x509.extensions import ExtensionType | |
from cryptography.x509.oid import NameOID | |
from cryptography.hazmat.primitives import hashes | |
from cryptography.x509.general_name import GeneralName, IPAddress, OtherName | |
import base64 | |
import pyasn1 |
#!/usr/bin/python3 | |
from __future__ import division | |
from __future__ import print_function | |
import re | |
import codecs | |
import logging | |
import time | |
import argparse | |
import sys | |
from impacket import version |
import csv | |
import requests | |
import argparse | |
from bs4 import BeautifulSoup | |
from colorama import Fore, Style, init | |
init(autoreset=True) | |
known_security_vendors = [ | |
'symantec', 'mcafee', 'trendmicro', 'kaspersky', 'bitdefender', |
package main | |
import ( | |
"fmt" | |
"syscall" | |
"golang.org/x/sys/windows" | |
"C" | |
"time" | |
) | |
const ( |