Evan syndrowm

This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector. Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.

All of the below examples had been generated for using as a remote address: 192.168.56.101.

List:

Page substiution macro for luring user to click Enable Content
The Unicorn Powershell based payload

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

How to setup a practically free CDN using Backblaze B2 and Cloudflare

⚠️ Note 2023-01-21
Some things have changed since I originally wrote this in 2016. I have updated a few minor details, and the advice is still broadly the same, but there are some new Cloudflare features you can (and should) take advantage of. In particular, pay attention to Trevor Stevens' comment here from 22 January 2022, and Matt Stenson's useful caching advice. In addition, Backblaze, with whom Cloudflare are a Bandwidth Alliance partner, have published their own guide detailing how to use Cloudflare's Web Workers to cache content from B2 private buckets. That is worth reading,

Obfuscating Lua

I've had some fun ruining Python recently, but Python is what I use at work. I prefer to use other languages when I'm doing stuff for fun.

And obfuscation only really makes sense in fun and competition - given a suffeciently determined actor, your code will be reverse engineered. Unless you write it in Malboge.

For this particular experiment, I'll be using Lua 5.3. As I'll probably need to dive into some of the less portable functions to commit our atrocities, I can't guarantee it will run on other popular versions like Luajit or 5.1.

Persistent Volumes with k3d/k3s

With k3d we can mount the host to container path, and with persistent volumes we can set a hostPath for our persistent volumes. With k3d, all the nodes will be using the same volume mapping which maps back to the host.

Create the cluster:

> mkdir -p /tmp/k3dvol
> k3d create --name "k3d-cluster" --volume /tmp/k3dvol:/tmp/k3dvol --publish "80:80" --workers 2
> export KUBECONFIG="$(k3d get-kubeconfig --name='k3d-cluster')"


	#====================================#
	# Extract Wi-Fi Credentials #
	# greg . foss @ owasp . org #
	# v0.1 -- July, 2017 #
	#====================================#

	# Licensed under the MIT License

	<#

	#
	# TO-DO: set \|DESTINATIONURL\| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
	#
	# Note this version requires Apache 2.4+
	#
	# Save this file into something like /etc/apache2/redirect.rules.
	# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
	#
	# Include /etc/apache2/redirect.rules
	#

	:: Windows 10 Hardening Script
	:: This is based mostly on my own personal research and testing. My objective is to secure/harden Windows 10 as much as possible while not impacting usability at all. (Think being able to run on this computer's of family members so secure them but not increase the chances of them having to call you to troubleshoot something related to it later on). References for virtually all settings can be found at the bottom. Just before the references section, you will always find several security settings commented out as they could lead to compatibility issues in common consumer setups but they're worth considering.
	:: Obligatory 'views are my own'. :)
	:: Thank you @jaredhaight for the Win Firewall config recommendations!
	:: Thank you @ricardojba for the DLL Safe Order Search reg key!
	:: Thank you @jessicaknotts for the help on testing Exploit Guard configs and checking privacy settings!
	:: Best script I've found for Debloating Windows 10: https://github.com/Sycnex/Windows10Debloater
	:

	# source:http://geocities.com/SiliconValley/heights/7052/opcode.txt
	From: mark@omnifest.uwm.edu (Mark Hopkins)
	Newsgroups: alt.lang.asm
	Subject: A Summary of the 80486 Opcodes and Instructions

	(1) The 80x86 is an Octal Machine
	This is a follow-up and revision of an article posted in alt.lang.asm on
	7-5-92 concerning the 80x86 instruction encoding.

	The only proper way to understand 80x86 coding is to realize that ALL 80x86

	function dockershell() {
	docker run --rm -i -t --entrypoint=/bin/bash "$@"
	}

	function dockershellsh() {
	docker run --rm -i -t --entrypoint=/bin/sh "$@"
	}

	function dockershellhere() {
	dirname=${PWD##*/}