monoxgas

$Shell = New-Object -Com WScript.Shell
$S = $Shell.CreateShortcut("$($Env:AppData)\Microsoft\Windows\Start Menu\default.lnk")
$S.TargetPath = "calc.exe"
$S.Hotkey = "Ctrl+U"
$S.Save()
$Shell.SendKeys("^u")
Start-Sleep 10;rm "$($Env:AppData)\Microsoft\Windows\Start Menu\default.lnk"

monoxgas

Keybase proof

I hereby claim:

• I am monoxgas on github.
• I am monoxgas (https://keybase.io/monoxgas) on keybase.
• I have a public key ASCY7hWSUiJvdx6-976NCpVJx_ePWPOc6E3cuJz5PA8dygo

To claim this, I am signing this object:

monoxgas

function Invoke-EgressAssess
{
    
<#

.Synopsis
    Egress-assess powershell client. 

.Description
    This script will connect to an Egress-assess server and transfer faux Personally Identifiable Information or

monoxgas

use DynaLoader;
use Devel::Peek;
use Fcntl;
use 5.008001; # because 5.6 doesn't have B::PV::object_2svref
use Config;
use B (); # for B::PV

sub mmap {
  my ($addr, $size, $protect, $flags) = @_;
  syscall(197, $addr, $size, $protect, $flags, -1, 0);

monoxgas

// ref: https://opensource.apple.com/source/dyld/[VERSION]/launch-cache/dsc_extractor.cpp.auto.html

// > SDKROOT=`xcrun --sdk macosx --show-sdk-path`
// > clang++ -o extract extract.cpp
// > mkdir libraries
// > ./extract /System/Library/dyld/dyld_shared_cache_x86_64 `pwd`/libraries/

#include <stdio.h>
#include <stddef.h>
#include <dlfcn.h>

monoxgas

Keybase proof

I hereby claim:

• I am monoxgas on github.
• I am monoxgas (https://keybase.io/monoxgas) on keybase.
• I have a public key whose fingerprint is 8138 ABBC 8C08 62A4 1E16 A697 5856 495B 4691 8AB1

To claim this, I am signing this object:

monoxgas

#!/usr/bin/env python
# Rulz.py
# Author: Nick Landers (@monoxgas) - Silent Break Security

import os
import sys
import argparse
import re
import binascii
import codecs

monoxgas

'https://answers.microsoft.com/en-us/msoffice/forum/all/removing-text-box-from-word-document-without/a4d02b2f-d168-48dc-960b-4a45cbe79d86
Sub ReplaceTextBoxes()
  Dim RngDoc As Range, RngShp As Range, i As Long, boundary As String
  With ActiveDocument
    For i = .Shapes.Count To 1 Step -1
      With .Shapes(i)
        'If .Type = msoTextBox Then
        'https://eileenslounge.com/viewtopic.php?p=28255#p28255
        If .TextFrame.HasText = True Then
          

monoxgas

' Need to add project references to C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscoree.tlb and mscorlib.tlb

Private Declare PtrSafe Function DispCallFunc Lib "oleaut32.dll" (ByVal pv As LongPtr, ByVal ov As LongPtr, ByVal cc As Integer, ByVal vr As Integer, ByVal ca As Long, ByRef pr As Integer, ByRef pg As LongPtr, ByRef par As Variant) As Long
Private Declare PtrSafe Sub RtlMoveMemory Lib "kernel32" (Dst As Any, Src As Any, ByVal BLen As LongPtr)
Private Declare PtrSafe Function VarPtrArray Lib "VBE7" Alias "VarPtr" (ByRef Var() As Any) As LongPtr

#If Win64 Then
Const LS As LongPtr = 8&
#Else
Const LS As LongPtr = 4&

monoxgas

import sys
import struct
import binascii
from itertools import cycle, zip_longest
from operator import itemgetter, xor
from collections import Counter
import re

# Some root key constants from the binary