gavz’s gists

gavz / demo.c

Created April 10, 2024 11:48 — forked from mistymntncop/demo.c

NtWaitForDebugEvent + WaitForMultipleObjects

	#include <stdint.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <stdbool.h>
	#include <windows.h>

	#include "nt_crap.h"

	#define ArrayCount(arr) (sizeof(arr)/sizeof(arr[0]))
	#define assert(expr) if(!(expr)) { (char)0 = 0; }

gavz / AtomicDLLSide-Loading.hta

Created April 5, 2024 22:35 — forked from MHaggis/AtomicDLLSide-Loading.hta

	<html>
	<head>
	<title>Atomic Red Team - DLL Side-Loading HTA</title>
	<HTA:APPLICATION ID="AtomicSideLoad" APPLICATIONNAME="AtomicSideLoad" BORDER="thin" BORDERSTYLE="normal" ICON="shell32.dll,4" >
	<script language="VBScript">
	Dim shell
	Set shell = CreateObject("Wscript.Shell")

	' Base64 encoded content of invite.zip - which is https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md#atomic-test-1---dll-side-loading-using-the-notepad-gupexe-binary">https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md#atomic-test-1---dll-side-loading-using-the-notepad-gupexe-binary
	Dim base64EncodedContent

gavz / code.cpp

Created April 1, 2024 19:47 — forked from MzHmO/code.cpp

image file name spoofing

	#include <windows.h>
	#include <stdio.h>
	#define RTL_MAX_DRIVE_LETTERS 32
	#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001
	#define STATUS_SUCCESS 0
	#define NT_SUCCESS(Status) ((NTSTATUS)(Status) == STATUS_SUCCESS)

	// https://github.com/RedTeamOperations/Advanced-Process-Injection-Workshop/blob/66a2d3ffe6540c981182a2fb38cc92b0909c4b7f/CWLProcessDoppelganging/CWLProcessDoppelganging/CWLImplant.cpp
	// https://github.com/huntandhackett/concealed_code_execution/blob/e688551bac50d8525b4ca7490da3981999cbff52/Injection/SampleDlls/3.NoDependencies/dllmain.c

gavz / hint_calls.py

Created March 18, 2024 20:38 — forked from Dump-GUY/hint_calls.py

Modified version of Willi Ballenthin IDA Plugin hint_calls.py ported to support Python2/3 and IDA>=7.4 (tested IDA 7.7, 8.4)

	'''
	IDA plugin to display the calls and strings referenced by a function as hints.

	Installation: put this file in your %IDADIR%/plugins/ directory.
	Author: Willi Ballenthin <william.ballenthin@fireeye.com>
	Licence: Apache 2.0
	'''
	import idc
	import idaapi
	import idautils

gavz / hint_calls.py

Created March 14, 2024 20:42 — forked from williballenthin/hint_calls.py

	'''
	IDA plugin to display the calls and strings referenced by a function as hints.

	Installation: put this file in your %IDADIR%/plugins/ directory.
	Author: Willi Ballenthin <william.ballenthin@fireeye.com>
	Licence: Apache 2.0
	'''
	import idc
	import idaapi
	import idautils

gavz / FuncAddrResolver.cpp

Created March 12, 2024 22:38 — forked from WKL-Sec/FuncAddrResolver.cpp

Dynamically retrieves the OpenProcess function address by parsing the kernel32.dll export table using Inline Assembly.

	// White Knight Labs - Offensive Development
	// Inline Assembly - Get Function Address

	#include <iostream>
	#include <windows.h>

	// Function definition
	void* GetFunctionAddress(const char* functionName) {
	void* getFunctionAddr = nullptr;

gavz / memMITM.cpp

Created March 6, 2024 17:36 — forked from anonymous/memMITM.cpp

SSL MITM PoC - Hook sspicli!EncryptMessage

	#define SECURITY_WIN32 //Define First Before Imports.

	#include <windows.h>
	#include <stdio.h>
	#include <Sspi.h> //Be sure to reference secur32.lib in Linker \| Input \| Additional Dependencies


	FARPROC fpEncryptMessage; //Pointer To The Original Location
	BYTE bSavedByte; //Saved Byte Overwritten by 0xCC -

gavz / memMITM.cpp

Created March 6, 2024 17:36 — forked from v3rlly/memMITM.cpp

SSL MITM PoC - Hook sspicli!EncryptMessage

	#define SECURITY_WIN32 //Define First Before Imports.

	#include <windows.h>
	#include <stdio.h>
	#include <Sspi.h> //Be sure to reference secur32.lib in Linker \| Input \| Additional Dependencies


	FARPROC fpEncryptMessage; //Pointer To The Original Location
	BYTE bSavedByte; //Saved Byte Overwritten by 0xCC -

gavz / SharePwn_public.py

Created January 10, 2024 18:03 — forked from testanull/SharePwn_public.py

SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC

	# -- coding: utf-8 --
	import hashlib
	import base64
	import requests, string, struct, uuid, random, re
	import sys
	from collections import OrderedDict
	from sys import version
	from urllib3.exceptions import InsecureRequestWarning
	requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
	# too lazy to deal with string <-> bytes confusion in python3 so forget it ¯\_(ツ)_/¯

gavz / Invoke-GhostTask.ps1

Created January 5, 2024 13:51 — forked from Workingdaturah/Invoke-GhostTask.ps1

A PS1 Script intended to edit Scheduled Tasks via Registry Keys