Skip to content

Instantly share code, notes, and snippets.

View modulexcite's full-sized avatar
🎯
Focusing

modulexcite

🎯
Focusing
View GitHub Profile
@modulexcite
modulexcite / DInjectQueuerAPC.cs
Created August 17, 2021 12:09 — forked from jfmaes/DInjectQueuerAPC.cs
.NET Process injection in a new process with QueueUserAPC using D/invoke - compatible with gadgettojscript
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;
namespace DinjectorWithQUserAPC
{
public class Program
From: http://redteams.net/bookshelf/
Techie
Unauthorised Access: Physical Penetration Testing For IT Security Teams by Wil Allsopp.
Social Engineering: The Art of Human Hacking by Christopher Hadnagy
Practical Lock Picking: A Physical Penetration Tester's Training Guide by Deviant Ollam
The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick
Hacking: The Art of Exploitation by Jon Erickson and Hacking Exposed by Stuart McClure and others.
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning by Fyodor
The Shellcoder's Handbook: Discovering and Exploiting Security Holes by several authors
@modulexcite
modulexcite / pip.md
Created August 12, 2021 14:43 — forked from saurabhshri/pip.md
Install and use pip in a local directory without root/sudo access.

Install and use pip in a local directory without root/sudo access.

Why?

Many users when are given server access, do not have root (or sudo) privileges and can not simply do sudo apt-get install python-pip . Here's an easy way you can install and use pip without root (or sudo) access in a local directory. Note : This works without easy_install too.

How?

@modulexcite
modulexcite / Workstation-Takeover.md
Created July 29, 2021 12:48 — forked from gladiatx0r/Workstation-Takeover.md
From RPC to RCE - Workstation Takeover via RBCD and MS-RPChoose-Your-Own-Adventure

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

  • Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
  • Relaying that machine authentication to LDAPS for configuring RBCD
  • RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

@modulexcite
modulexcite / FileLockInfo.cs
Created July 27, 2021 10:49 — forked from i-e-b/FileLockInfo.cs
Discover Win32 processes locking a file, and file locks by process. This is quite old now, and better methods are available. Additional research by Walkman100 at https://github.com/Walkman100/FileLocks (see comments section)
using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.Text;
using System.Threading;
namespace FileLockInfo
{
public class Win32Processes
@modulexcite
modulexcite / .htaccess
Created April 6, 2021 23:38 — forked from curi0usJack/.htaccess
FYI THIS IS NO LONGER AN .HTACCESS FILE. SEE COMMENTS BELOW. DON'T WORRY, IT'S STILL EASY.
#
# TO-DO: set |DESTINATIONURL| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
#
# Note this version requires Apache 2.4+
#
# Save this file into something like /etc/apache2/redirect.rules.
# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
#
# Include /etc/apache2/redirect.rules
#
@modulexcite
modulexcite / TLSSLed_v1.3.sh
Created February 10, 2021 15:53 — forked from thikade/TLSSLed_v1.3.sh
SSL/TLS Debugging tools & cheatsheet
#!/usr/bin/env bash
#
#### Source: http://www.taddong.com/tools/TLSSLed_v1.3.sh
#
#
# Tool:
# TLSSLed.sh
#
# Description:
# Script to extract the most relevant security details from a
@modulexcite
modulexcite / setup_bbty.sh
Created January 25, 2021 01:13 — forked from LuD1161/setup_bbty.sh
Setup Bug Bounty Tools on AWS instance / any VPS for that matter
#!/bin/bash
#
# Execute as wget -O - https://gist.github.com/LuD1161/66f30da6d8b6c1c05b9f6708525ea885/raw | bash
# # Thanks JeffreyShran for the gist url thing
#
#
# It's debian based, so for centos and likewise you have to change apt to yum and similarly
#
InstallationStartTime=$(date +%s)
@modulexcite
modulexcite / google-dorks
Created January 25, 2021 01:07 — forked from clarketm/google-dorks
Listing of a number of useful Google dorks.
" _ _ "
" _ /|| . . ||\ _ "
" ( } \||D ' ' ' C||/ { % "
" | /\__,=_[_] ' . . ' [_]_=,__/\ |"
" |_\_ |----| |----| _/_|"
" | |/ | | | | \| |"
" | /_ | | | | _\ |"
It is all fun and games until someone gets hacked!
@modulexcite
modulexcite / all.txt
Created January 25, 2021 01:07 — forked from jhaddix/all.txt
all wordlists from every dns enumeration tool... ever. Please excuse the lewd entries =/
This file has been truncated, but you can view the full file.
.
..
........
@
*
*.*
*.*.*
🐎