Skip to content

Instantly share code, notes, and snippets.

View 2010phenix's full-sized avatar

2010phenix

31 followers · 43 following
View GitHub Profile
@2010phenix
2010phenix / load_xml.cpp
Created August 24, 2019 14:55 — forked from odzhan/load_xml.cpp
/**
BSD 3-Clause License
Copyright (c) 2019, TheWover, Odzhan. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
@2010phenix
2010phenix / runscript.c
Created August 24, 2019 14:53 — forked from AV1080p/runscript.c
In-memory execution of VBScript, JavaScript or JScript
/**
BSD 3-Clause License
Copyright (c) 2019, Odzhan. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
@2010phenix
2010phenix / tasks.cs
Created August 16, 2019 10:47
Adapted -
This file has been truncated, but you can view the full file.
using System;
using System.IO;
using System.Text;
using System.IO.Compression;
using System.EnterpriseServices;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
/*
@2010phenix
2010phenix / Invoke-Psexec.ps1
Created June 30, 2019 16:16 — forked from HarmJ0y/Invoke-Psexec.ps1
Invoke-Psexec
function Invoke-PsExec {
<#
.SYNOPSIS
This function is a rough port of Metasploit's psexec functionality.
It utilizes Windows API calls to open up the service manager on
a remote machine, creates/run a service with an associated binary
path or command, and then cleans everything up.
Either a -Command or a custom -ServiceEXE can be specified.
For -Commands, a -ResultsFile can also be specified to retrieve the
@2010phenix
2010phenix / service.cs
Created June 18, 2019 13:08 — forked from PaulSec/service.cs
A basic Windows service written in .Net/c#
/*
Creates a basic Windows Service using .Net framework.
Compile:
c:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe service.cs
Create the service with name "Service":
sc create Service type=own binpath= c:\Path\To\service.exe
Start the service:
@2010phenix
2010phenix / malicious.cs
Created June 18, 2019 13:02 — forked from Arno0x/malicious.cs
Hide malicious assembly in another one with RunTime code compiling
/*
Author: Arno0x0x, Twitter: @Arno0x0x
DO NOT COMPILE THIS SOURCE FILE !
Encode this source in base64:
base64 -w0 malicious.cs > malicious.b64
Then paste it in the code in "not_detected.cs" source file
@2010phenix
2010phenix / regasm.cs
Created June 9, 2019 13:00 — forked from 0xa-saline/regasm.cs
A DLL that can be called from regasm.exe/regsvc.exe to execute arbitrary code
/*
============== Compile ============
Create Your Strong Name Key -> key.snk
$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
$Content = [System.Convert]::FromBase64String($key)
Set-Content key.snk -Value $Content -Encoding Byte
C:\Windows\Microsoft.NET\Framewor
@2010phenix
2010phenix / spawn-interactive-process.c
Created December 4, 2018 18:51 — forked from ondrasek/spawn-interactive-process.c
spawn-interactive-process: How to launch a process from a Windows Service running in interactive user session(s)
// spawn-interactive-process.cpp : Defines the entry point for the console application.
// Do not forget to link against wtsapi32.lib
// How to test this: use psexec from SysInternals, such as ```psexec -s c:\windows\system32\cmd.exe```
// to run CMD under NT AUTHORITY\SYSTEM account (you can confirm this by running whoami) and then
// run spawn-interactive-process (feel free to disable waiting for debugger). The result is a notepad process
// running under interactive user credentials and on the interactive desktop launched from a service running under
// system account.
#include <stdio.h>
#include <tchar.h>
@2010phenix
2010phenix / SystemCMD.cpp
Created December 4, 2018 18:20 — forked from masthoon/SystemCMD.cpp
Launch SYSTEM CMD in user current session (from a service)
#include "stdafx.h"
#include <windows.h>
#include <Winbase.h>
#include <Wtsapi32.h>
#include <Userenv.h>
#include <malloc.h>
#pragma comment(lib, "Wtsapi32.lib")
#pragma comment(lib, "Userenv.lib")
@2010phenix
2010phenix / getsystem_parent.cpp
Created November 11, 2018 14:32
A POC to grab SYSTEM token privileges via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
#include "stdafx.h"
BOOL SetPrivilege(HANDLE hToken, LPCTSTR Privilege, BOOL bEnablePrivilege) {
TOKEN_PRIVILEGES tp;
LUID luid;
TOKEN_PRIVILEGES tpPrevious;
DWORD cbPrevious = sizeof(TOKEN_PRIVILEGES);
if (!LookupPrivilegeValue(NULL, Privilege, &luid)) return FALSE;