Skip to content

Instantly share code, notes, and snippets.

View SolomonSklash's full-sized avatar

Solomon Sklash SolomonSklash

411 followers · 55 following
View GitHub Profile
@SolomonSklash
SolomonSklash / kerberos_attacks_cheatsheet.md
Created July 19, 2020 20:15 — forked from TarlogicSecurity/kerberos_attacks_cheatsheet.md
A cheatsheet with commands that can be used to perform kerberos attacks

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

@SolomonSklash
SolomonSklash / dummy_bof.cpp
Created August 20, 2020 18:43
#include <windows.h>
#include <stdio.h>
#include <dsgetdc.h>
#include <psapi.h>
extern "C" {
#include "beacon.h"
};
// Compile as C++ (/TP) for decltype
@SolomonSklash
SolomonSklash / clr_via_native.c
Created December 20, 2020 22:21 — forked from xpn/clr_via_native.c
A quick example showing loading CLR via native code
#include "stdafx.h"
int main()
{
ICLRMetaHost *metaHost = NULL;
IEnumUnknown *runtime = NULL;
ICLRRuntimeInfo *runtimeInfo = NULL;
ICLRRuntimeHost *runtimeHost = NULL;
IUnknown *enumRuntime = NULL;
LPWSTR frameworkName = NULL;
@SolomonSklash
SolomonSklash / EnumCLR.c
Created January 3, 2021 05:18 — forked from G0ldenGunSec/EnumCLR.c
Cobalt Strike BOF to identify processes with the CLR loaded with a goal of identifying SpawnTo / injection candidates.
#include <string.h>
#include <stdio.h>
#include <windows.h>
#include <psapi.h>
#include "beacon.h"
DECLSPEC_IMPORT BOOL WINAPI KERNEL32$K32EnumProcesses(DWORD *, DWORD, LPDWORD);
DECLSPEC_IMPORT WINBASEAPI HANDLE WINAPI KERNEL32$OpenProcess(DWORD, BOOL, DWORD);
DECLSPEC_IMPORT BOOL WINAPI KERNEL32$K32EnumProcessModulesEx(HANDLE, HMODULE*, DWORD, LPDWORD, DWORD);
@SolomonSklash
SolomonSklash / divide_and_conquer.c
Created January 19, 2021 07:10 — forked from theevilbit/divide_and_conquer.c
Divide and Conquer NextGen AV bypass
/*
This is a POC for a generic technique I called internally on our red team assessment "Divide and Conquer", which can be used to bypass behavioral based NextGen AV detection. It works by splitting malicious actions and API calls into distinct processes.
*/
#include <stdio.h>
#include <tchar.h>
#include <windows.h>
#include "Commctrl.h"
#include <string>
@SolomonSklash
SolomonSklash / Resource.rc
Created July 23, 2021 22:43
#define APSTUDIO_READONLY_SYMBOLS
#include "winres.h"
VS_VERSION_INFO VERSIONINFO
FILEVERSION 1,3,3,4
PRODUCTVERSION 1,3,3,1
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
#else
@SolomonSklash
SolomonSklash / create-resource.bat
Last active July 23, 2021 22:49
Creating a COFF object file from a resource script file on WIndows.
@echo off
:: This batch script should be run from a VS developer prompt.
:: rc will create a binary .res file
rc Resource.rc
:: cvtres will convert the .res file to a COFF object file
cvtres /MACHINE:x64 /OUT:Resource.o Resource.res
@SolomonSklash
SolomonSklash / create-resource.sh
Created July 23, 2021 22:51
Creating a COFF object file from a resource script file on Linux.
#!/bin/bash
# This script needs mingw installed
# Convert a .rc resource script input file to a .res binary resource output file
x86_64-w64-mingw32-windres -J rc -i Resource.rc -O res -o Resource.res
# Convert a .res binary resource input file to a COFF object output file
x86_64-w64-mingw32-windres -J res -i Resource.res -O coff -o Resource.o
@SolomonSklash
SolomonSklash / TestAssembly.cs
Created August 16, 2021 22:36 — forked from Arno0x/TestAssembly.cs
This code shows how to load a CLR in an unmanaged process, then load an assembly from memory (not from a file) and execute a method
/*
================================ Compile as a .Net DLL ==============================
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library /out:TestAssembly.dll TestAssembly.cs
*/
using System.Windows.Forms;
namespace TestNamespace
@SolomonSklash
SolomonSklash / apisetlookup.c
Created September 1, 2021 17:35 — forked from lucasg/apisetlookup.c
Api set library lookup resolver
#include <windows.h>
#include <stdint.h>
#include <stdbool.h>
#include <stdio.h>
#include <sal.h>
#include <assert.h>
#ifdef _X86_
#error "This snippet only build in 64-bit due to heavy use of uintptr arithmetics."
#endif