Skip to content

Instantly share code, notes, and snippets.

View rvrsh3ll's full-sized avatar

Steve Borosh rvrsh3ll

1.4k followers · 13 following
View GitHub Profile
@rvrsh3ll
rvrsh3ll / urbandoor.cs
Created April 11, 2023 00:16 — forked from monoxgas/urbandoor.cs
Minimal PoC code for Kerberos Unlock LPE (CVE-2023-21817)
using NtApiDotNet;
using NtApiDotNet.Ndr.Marshal;
using NtApiDotNet.Win32;
using NtApiDotNet.Win32.Rpc.Transport;
using NtApiDotNet.Win32.Security.Authentication;
using NtApiDotNet.Win32.Security.Authentication.Kerberos;
using NtApiDotNet.Win32.Security.Authentication.Kerberos.Client;
using NtApiDotNet.Win32.Security.Authentication.Kerberos.Server;
using NtApiDotNet.Win32.Security.Authentication.Logon;
using System;
@rvrsh3ll
rvrsh3ll / HInvoke.cs
Created May 24, 2023 12:22 — forked from dr4k0nia/HInvoke.cs
A very minimalistic approach of calling .net runtime functions or accessing properties using only hashes as identifiers. It does not leave any strings or import references since we dynamically resolve the required member from the mscorlib assembly on runtime. Read the blog post: https://dr4k0nia.github.io/dotnet/coding/2022/08/10/HInvoke-and-avo…
using System.Linq;
using System.Reflection;
namespace HashInvoke;
public class HInvoke
{
public static T InvokeMethod<T>(uint classID, uint methodID, object[]? args = null)
{
// Get the System assembly and go trough all its types hash their name
@rvrsh3ll
rvrsh3ll / brute_mysqlx.py
Last active July 25, 2023 16:05
import mysqlx
import argparse
# pip3 install mysql-connector-python
def main(target,targetport,user,passwordfile,verbose):
with open(passwordfile, "r") as f:
passwords = f.readlines()
for password in passwords:
@rvrsh3ll
rvrsh3ll / RC4.cs
Created July 21, 2020 19:11 — forked from hoiogi/RC4.cs
C# RC4 Sample
public class RC4 {
public static byte[] Encrypt(byte[] pwd, byte[] data) {
int a, i, j, k, tmp;
int[] key, box;
byte[] cipher;
key = new int[256];
box = new int[256];
cipher = new byte[data.Length];
@rvrsh3ll
rvrsh3ll / gadget2jscriptQueueAPCInject.cs
Last active July 21, 2023 13:07
using System;
using System.IO;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Net;
using System.IO.Compression;
public class Payload
{
@rvrsh3ll
rvrsh3ll / shazam.py
Created July 28, 2019 14:49
#!/usr/bin/env python2.7
import argparse
import binascii
import sys
import base64
import hashlib
from Crypto.Cipher import AES
from pkcs7 import PKCS7Encoder
import random
from random import randint
@rvrsh3ll
rvrsh3ll / gist:78739132045f7a58a6428830f44cdec4
Created May 26, 2023 00:36 — forked from gwalkey/gist:b168d532b472333e96663cf607bf84eb
Create a NuGet Package to Install a Powershell Module
Download the CLI Version of NuGet
https://dist.nuget.org/win-x86-commandline/latest/nuget.exe
--Create Work Paths
md c:\nuget
md c:\nuget\source
md c:\nuget\publish
-- One-Time - Create local NuGet Repo/feed using a local drive path
cd c:\nuget
@rvrsh3ll
rvrsh3ll / EtwStartWebClient.cs
Created January 13, 2023 15:18 — forked from klezVirus/EtwStartWebClient.cs
A PoC in C# to enable WebClient Programmatically
using System.Runtime.InteropServices;
using System;
/*
* Simple C# PoC to enable WebClient Service Programmatically
* Based on the C++ version from @tirannido (James Forshaw)
* Twitter: https://twitter.com/tiraniddo
* URL: https://www.tiraniddo.dev/2015/03/starting-webclient-service.html
*
* Compile with:
@rvrsh3ll
rvrsh3ll / krack_zine.txt
Created October 31, 2022 12:07
KK KK RRRRRRR AAA CCCCCCCCCC KK KK
KK KK RR R AA AA CC KK KK
KKKKKKK RRRRRRR AA AA CC KKKKKKK
KK KK RR RR AAAAAAAAA CC KK KK
KK KK RR RR AA AA CC KK KK
KK KK OO RR RR OO AA AA OO CCCCCCCCCCC OO KK KK OO

||==--Killer Ride And Chilling Kraftwork--==||
--------------------------------------------------------------------------
@rvrsh3ll
rvrsh3ll / Export_All_Yammer_Users.ps1
Created October 24, 2022 20:23 — forked from Benoit-Gaumard/Export_All_Yammer_Users.ps1
Export all Yammer users through the Yammer REST API with PowerShell
##############################################################################
# Export all Yammer users through the Yammer REST API with PowerShell
###############################################################################
# Variables
$baererToken = "YourBaererToken"
$yammerBaseUrl = "https://www.yammer.com/api/v1"
# Function Get-BaererToken
Function Get-BaererToken()