thinkst-cs

def modular_sqrt(a, p):

    def legendre_symbol(a, p):
        """ Compute the Legendre symbol a|p using
            Euler's criterion. p is a prime, a is
            relatively prime to p (if p divides
            a, then a|p = 0)

            Returns 1 if a has a square root modulo
            p, -1 otherwise.

thinkst-cs

primes = [ 2, 3, 5, 7, 11, 13, 17, 19, 23, 29,
31, 37, 41, 43, 47, 53, 59, 61, 67, 71,
73, 79, 83, 89, 97, 101, 103, 107, 109, 113,
127, 131, 137, 139, 149, 151, 157, 163, 167, 173,
179, 181, 191, 193, 197, 199, 211, 223, 227, 229,
233, 239, 241, 251, 257, 263, 269, 271, 277, 281,
283, 293, 307, 311, 313, 317, 331, 337, 347, 349,
353, 359, 367, 373, 379, 383, 389, 397, 401, 409,
419, 421, 431, 433, 439, 443, 449, 457, 461, 463,
467, 479, 487, 491, 499, 503, 509, 521, 523, 541,

thinkst-cs

# We'll just store the cloned certificates in current user "Personal" store for now.
$CertStoreLocation = @{ CertStoreLocation = 'Cert:\CurrentUser\My' }

$MS_Root_Cert = Get-PfxCertificate -FilePath C:\Test\MSKernel32Root.cer
$Cloned_MS_Root_Cert = New-SelfSignedCertificate -CloneCert $MS_Root_Cert @CertStoreLocation

$MS_PCA_Cert = Get-PfxCertificate -FilePath C:\Test\MSKernel32PCA.cer
$Cloned_MS_PCA_Cert = New-SelfSignedCertificate -CloneCert $MS_PCA_Cert -Signer $Cloned_MS_Root_Cert @CertStoreLocation

$MS_Leaf_Cert = Get-PfxCertificate -FilePath C:\Test\MSKernel32Leaf.cer

thinkst-cs

#!/usr/bin/python3
from __future__ import division
from __future__ import print_function
import re
import codecs
import logging
import time
import argparse
import sys
from impacket import version

thinkst-cs

using System;
using System.EnterpriseServices;
using System.Runtime.InteropServices;

using System.Reflection;
using System.Reflection.Emit;

using System.Collections;
using System.Collections.Generic;

thinkst-cs

Let's turn Any .NET Application into an LOL Bin

We can do this by experimenting with .config files.

Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name

In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.

We do this by directing the application to read a config file we provide.

thinkst-cs

Public: Github Project.
https://github.com/skyhoshi/VHDXToFolders

## Story
Project Story: (Use Case/ User Story/ My Experience)
History of the Project: 
This project was one of necessity. After 20+ years of collecting, developing and loosing/misplacing projects and source files, When Windows 7 ( + Windows Server 2008)  presented the ability to create Virtual Machines. Virtual Hard drives became a standard in storing a lot of “Shared” data. I had virtual hard drives that I would attach and detach from virtual machines to do maintenance and installations. 
A few years ago with the introduction of Windows 10, Hyper-V and Hyper-V PowerShell Module I was able to script out the creation of Virtual Hard Drives and took the concept of sharing one step further by attaching these drives to folders (Folder Mounting). 
Theories and Practice:
With this I could in theory, install games onto to my SSD drive but when I wasn’t playing the game but needed additional space on the then limited space of my SSD I could dismount a

thinkst-cs

#!/bin/bash
set -e

GO_VERSION="1.20.6"
GO_URL="https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
EXPECTED_CHECKSUM="b945ae2bb5db01a0fb4786afde64e6fbab50b67f6fa0eb6cfa4924f16a7ff1eb"

# Log output of script
exec > >(tee -i /home/ubuntu/install.log)
exec 2>&1

thinkst-cs

$rpc = ls C:\Windows\System32\*.exe, C:\Windows\System32\*.dll |Get-RpcServer -DbgHelpPath "C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll"

 foreach ($rpc1 in $rpc)
{
    $ourObject = New-Object -TypeName psobject 
    $ourObject | Add-Member -MemberType NoteProperty -Name InterfaceID -Value $rpc1.InterfaceID
    $ourObject | Add-Member -MemberType NoteProperty -Name FileName -Value $rpc1.Name
    $ourObject | Add-Member -MemberType NoteProperty -Name IsRunning -Value $rpc1.IsServiceRunning
    $ourObject | Add-Member -MemberType NoteProperty -Name EndpointCount -Value $rpc1.EndpointCount
    $procs = $rpc1.Procedures.Name  | Out-String

thinkst-cs

INCIDENT_NAME = "NCCGROUPHTTPS"
VERSION = "0.1"
MODULE_DESCRIPTION = "NCCGROUPHTTPS"
AUTHOR = "Ollie Whitehouse"
AUTHOR_EMAIL = "[email protected]"

CERT_FILE = "/tmp/selfsigned.crt"
KEY_FILE = "/tmp/private.key"

from opencanary.modules import CanaryService