Skip to content

Instantly share code, notes, and snippets.

View jymcheong's full-sized avatar

Jym Cheong jymcheong

View GitHub Profile
@jymcheong
jymcheong / secure-websockets
Created July 26, 2019 13:17 — forked from casecode/secure-websockets
Basic Config for SSL with Secure Websockets using Nginx 1.6.0 + Puma + Thin
=========================
# /etc/nginx/nginx.conf
=========================
user www-data;
worker_processes 4;
pid /var/run/nginx.pid;
events {
worker_connections 768;
@jymcheong
jymcheong / EnumWindows.cs
Created July 18, 2019 03:05
.Net EnumWindows
[DllImport("user32.dll", CharSet = CharSet.Unicode)]
private static extern int GetWindowText(IntPtr hWnd, StringBuilder strText, int maxCount);
[DllImport("user32.dll", CharSet = CharSet.Unicode)]
private static extern int GetWindowTextLength(IntPtr hWnd);
[DllImport("user32.dll")]
private static extern bool EnumWindows(EnumWindowsProc enumProc, IntPtr lParam);
// Delegate to filter which windows to include
@jymcheong
jymcheong / FindHostedProcess.cs
Created July 18, 2019 01:45
Get Real Process, related to ApplicationFrameHost
public class WinAPIFunctions
{
//Used to get Handle for Foreground Window
[DllImport("user32.dll", CharSet = CharSet.Auto)]
private static extern IntPtr GetForegroundWindow();
//Used to get ID of any Window
[DllImport("user32.dll", CharSet = CharSet.Auto)]
private static extern int GetWindowThreadProcessId(IntPtr hWnd, out int lpdwProcessId);
public delegate bool WindowEnumProc(IntPtr hwnd, IntPtr lparam);
@jymcheong
jymcheong / testBroadcast.html
Created June 10, 2019 03:24
broadcast test
<!DOCTYPE html>
<html>
<head>
<title>Simple Echo Example</title>
<script>
var ws = new WebSocket('ws://127.0.0.1:8808/');
ws.onmessage = function(event) {
document.getElementById('msgBox').innerHTML = event.data;
}
function send()
@jymcheong
jymcheong / LoadInMemoryModule.ps1
Created May 31, 2019 11:08 — forked from mattifestation/LoadInMemoryModule.ps1
A stealthier method of loading a .NET PE in memory - via the Assembly.LoadModule method
$Domain = [AppDomain]::CurrentDomain
$DynAssembly = New-Object System.Reflection.AssemblyName('TempAssembly')
$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('TempModule')
# Create a stub module that the in-memory module (i.e. this mimics the loading of a netmodule at runtime) will be loaded into.
$ModuleBuilder2 = $AssemblyBuilder.DefineDynamicModule('hello.dll')
$TypeBuilder = $ModuleBuilder.DefineType('TempClass', [Reflection.TypeAttributes]::Public)
$TypeBuilder.CreateType()
$HelloDllBytes = [Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAJNPvloAAAAAAAAAAOAAAiELAQsAAAQAAAAGAAAAAAAAPiMAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAOQiAABXAAAAAEAAAJgCAAAAAAAAAAAAAAAAAAA
@jymcheong
jymcheong / Program.cs
Created February 27, 2019 09:07
WebSocket4Net example
using System;
using WebSocket4Net;
namespace websocket
{
class Program
{
static void Main(string[] args)
{
using (var ws = new WebSocket("ws://1.2.3.4:8080/"))
@jymcheong
jymcheong / DevicePathMapper.cs
Created February 22, 2019 06:48
C# DevicePathMapper
public static class DevicePathMapper
{
[DllImport("Kernel32.dll", CharSet = CharSet.Unicode)]
private static extern uint QueryDosDevice([In] string lpDeviceName, [Out] StringBuilder lpTargetPath, [In] int ucchMax);
public static string FromDevicePath(string devicePath)
{
var drive = Array.Find(DriveInfo.GetDrives(), d => devicePath.StartsWith(d.GetDevicePath(), StringComparison.InvariantCultureIgnoreCase));
return drive != null ?
devicePath.ReplaceFirst(drive.GetDevicePath(), drive.GetDriveLetter()) :
filter Get-PEFeature {
<#
.SYNOPSIS
Retrieves key features from PE files that can be used to build detections.
.DESCRIPTION
Get-PEFeature extracts key features of PE files that are relevant to building detections.
@jymcheong
jymcheong / README.markdown
Created December 30, 2018 13:50 — forked from haku/README.markdown
autosshd

autosshd

Install

git clone https://gist.github.com/6322759.git autosshd
cd autosshd
sudo ./install