I hereby claim:
- I am unprovable on github.
 - I am largecardinal (https://keybase.io/largecardinal) on keybase.
 - I have a public key whose fingerprint is E19C CB0A E523 2B95 8CC2 8342 0318 8088 56BE 9950
 
To claim this, I am signing this object:
I hereby claim:
To claim this, I am signing this object:
| function Invoke-UACBypass { | |
| <# | |
| .SYNOPSIS | |
| Bypasses UAC on Windows 10 by abusing the SilentCleanup task to win a race condition, allowing for a DLL hijack without a privileged file copy. | |
| Author: Matthew Graeber (@mattifestation), Matt Nelson (@enigma0x3) | |
| License: BSD 3-Clause | |
| Required Dependencies: None | |
| Optional Dependencies: None | 
| #!/bin/bash | |
| # nmap scanning for speed and accuracy! | |
| # nmap discovery and nmap scanning don't always play well together. As such, | |
| # you should separate them out into distinct phases. | |
| # first we do discovery... | |
| # a ping sweep on an internal network will find what you need. | |
| # FIXME make the script take command line args (I've always meant to do this...) | |
| #first, a quick ping sweep, dumping live IP's into a file: | 
| 16807 | 16807 | MATCH | |
|---|---|---|---|
| 282475249 | 282475249 | MATCH | |
| 1622650073 | 1622650073 | MATCH | |
| 984943658 | 984943658 | MATCH | |
| 1144108930 | 1144108930 | MATCH | |
| 470211272 | 470211272 | MATCH | |
| 101027544 | 101027544 | MATCH | |
| 1457850878 | 1457850878 | MATCH | |
| 1458777923 | 1458777923 | MATCH | |
| 2007237709 | 2007237709 | MATCH | 
| Random number test... | |
| 16807 | |
| 282475249 | |
| 1622650073 | |
| 984943658 | |
| 1144108930 | |
| 470211272 | |
| 101027544 | |
| 1457850878 | |
| 1458777923 | 
| // RC Entropy source... | |
| // experimental code - NOT FOR USE IN PRODUCTION!! | |
| // --- not proven to be anywhere close to CSPRNG nor TruRNG --- | |
| // by Mark C (@LargeCardinal) | |
| // | |
| // So, a 1.2 to 1nF ceramic cap and 100Ohm resistor are placed in | |
| // parallel across the A6 and GND pins. A fly wire from Digital | |
| // pin 2 then goes to the A6 rail, powering the cap of 1nF and 100Ohm res | |
| // | |
| // In practice, it seems we really don't need the capacitor... maybe | 
| long rand_i, rand_j, rand_k; | |
| unsigned long i = 0, j = 0, k = 0; | |
| void setup() { | |
| // put your setup code here, to run once: | |
| rand_i = random(); | |
| rand_j = random(); | |
| rand_k = random(); | |
| Serial.begin(9600); | |
| while (!Serial) {} | 
| #include <stdlib.h> | |
| #include <stdio.h> | |
| static int do_rand(unsigned long *ctx) | |
| { | |
| /* | |
| * Compute x = (7^5 * x) mod (2^31 - 1) | |
| * wihout overflowing 31 bits: | |
| * (2^31 - 1) = 127773 * (7^5) + 2836 | |
| * From "Random number generators: good ones are hard to find", | 
| // This is shockingly bad code... but I threw it together in ~4mins... | |
| // because I couldn't find one anywhere and needed it for some ESP32 experimentation... | |
| // See the MBED reference for this: | |
| // https://tls.mbed.org/api/gcm_8h.html | |
| #include "mbedtls/gcm.h" | |
| void setup() { | |
| Serial.begin(115200); | |
| mbedtls_gcm_context aes; | 
| \begin{center} | |
| \begin{tikzpicture}[scale=2.5] | |
| % reducing to | |
| \node (1) at (0,1) {$\omega^\omega$}; | |
| \node (2) at (1.5,1) {$\textbf{U}$}; | |
| \node (3) at (0,0) {$\omega^\omega \rangle$}; | |
| \node (4) at (1.5,0) {$\textbf{V}$}; | |
| % reducing from | |
| \node (A) at (-1.5,1) {$\omega^\omega$}; | |
| \node (B) at (-3,1) {$\textbf{X}$}; |