Skip to content

Instantly share code, notes, and snippets.

rkornmeyer / ShellcodeTest.cs
Created Oct 13, 2021 — forked from TheWover/ShellcodeTest.cs
Dirty but working C# remote shell code injector. Injects into explorer using the architecture of the platform. Modified from several random sources and cleaned up a bit.
View ShellcodeTest.cs
/* Author: TheWover
Description: Injects embedded base64-encoded shellcode into an arbitrary hardcoded process using native Windows 32 API calls.
Last Modified: 11/1/2018
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
namespace ShellcodeTest
rkornmeyer / clr_via_native.c
Created Apr 13, 2018 — forked from xpn/clr_via_native.c
A quick example showing loading CLR via native code
View clr_via_native.c
#include "stdafx.h"
int main()
ICLRMetaHost *metaHost = NULL;
IEnumUnknown *runtime = NULL;
ICLRRuntimeInfo *runtimeInfo = NULL;
ICLRRuntimeHost *runtimeHost = NULL;
IUnknown *enumRuntime = NULL;
LPWSTR frameworkName = NULL;
rkornmeyer /
Created Mar 22, 2018 — forked from ryhanson/
Execute a DLL via .xll files and the Excel.Application object's RegisterXLL() method

DLL Execution via Excel.Application RegisterXLL() method

A DLL can be loaded and executed via Excel by initializing the Excel.Application COM object and passing a DLL to the RegisterXLL method. The DLL path does not need to be local, it can also be a UNC path that points to a remote WebDAV server.

When delivering via WebDAV, it should be noted that the DLL is still written to disk but the dropped file is not the one loaded in to the process. This is the case for any file downloaded via WebDAV, and they are stored at: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\.

The RegisterXLL function expects an XLL add-in which is essentially a specially crafted DLL with specific exports. More info on XLL's can be found on MSDN

The XLL can also be executed by double-clicking the .xll file, however there is a security warning. @rxwx has more notes on this here inc


Shell cheat sheet

Setting up iTerm

  • Use option as meta key:

Go to Preferences->Profiles tab. Select your profile on the left, and then open the Keyboard tab. At the bottom is a set of buttons that lets you select the behavior of the Option key. For most users, Esc+ will be the best choice.

  • Setting up word-by-word movement with Option+:
rkornmeyer / google-dorks
Last active Jan 16, 2018 — forked from stevenswafford/google-dorks
Listing of a number of useful Google dorks.
View google-dorks
" _ _ "
" _ /|| . . ||\ _ "
" ( } \||D ' ' ' C||/ { % "
" | /\__,=_[_] ' . . ' [_]_=,__/\ |"
" |_\_ |----| |----| _/_|"
" | |/ | | | | \| |"
" | /_ | | | | _\ |"
It is all fun and games until someone gets hacked!
rkornmeyer /
Created Jan 12, 2018 — forked from stormpython/
Angular D3 Directives with Elasticsearch

Keybase proof

I hereby claim:

  • I am rkornmeyer on github.
  • I am r0bchain ( on keybase.
  • I have a public key ASCymwg5NS5KC-s99SG-umzYpHKY5lE_WCCZ72XQFv3W0go

To claim this, I am signing this object:

View gist:ca980cfb23d57e3f9f6e50ee74aa98cf
DWORD Error, bytesIO;
HANDLE hProcessToken = NULL, hNewToken = NULL, hTest;
PSID pIntegritySid = NULL;
rkornmeyer / FileReadPrimitive.ps1
Created Aug 21, 2017 — forked from mattifestation/FileReadPrimitive.ps1
A WMI file content read primitive - ROOT/Microsoft/Windows/Powershellv3/PS_ModuleFile
View FileReadPrimitive.ps1
$CimSession = New-CimSession -ComputerName
$FilePath = 'C:\Windows\System32\notepad.exe'
# PS_ModuleFile only implements GetInstance (versus EnumerateInstance) so this trick below will force a "Get" operation versus the default "Enumerate" operation.
$PSModuleFileClass = Get-CimClass -Namespace ROOT/Microsoft/Windows/Powershellv3 -ClassName PS_ModuleFile -CimSession $CimSession
$InMemoryModuleFileInstance = New-CimInstance -CimClass $PSModuleFileClass -Property @{ InstanceID= $FilePath } -ClientOnly
$FileContents = Get-CimInstance -InputObject $InMemoryModuleFileInstance -CimSession $CimSession
$FileLengthBytes = $FileContents.FileData[0..3]
rkornmeyer / customers.xml
Created Aug 18, 2017
msxsl.exe Proof Of Concept
View customers.xml
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="script.xsl" ?>
<name>John Smith</name>
<address>123 Elm St.</address>
<phone>(123) 456-7890</phone>
<name>Mary Jones</name>