This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <Windows.h> | |
#include <Psapi.h> | |
#include <metahost.h> | |
#include <comutil.h> | |
#include <mscoree.h> | |
#include "patch_info.h" | |
#include "base\helpers.h" | |
/** | |
* For the debug build we want: |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from ctypes import wintypes | |
import argparse | |
import ctypes | |
import yara | |
import hexdump | |
""" | |
.text:0000000180010840 ; char __fastcall BeaconDataStoreUnprotectItem(unsigned __int64) | |
.text:0000000180010840 BeaconDataStoreUnprotectItem proc near ; CODE XREF: sub_1800100F8+9E↑p | |
.text:0000000180010840 ; sub_1800102E8+AD↑p |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import io | |
import sys | |
import string | |
KEY_STR = 'ModifiedFwPropertySheetWithOKTheSheetIDS_LDAP_AU_PROPERTIESNULL0FW_WP_OBJECTS' | |
def get_byte(x): | |
c = ord(chr(x).lower()) | |
if ((c - 0x30) & 255) < 10: | |
retval = c - 0x30 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.IO; | |
using System.Text; | |
using System.Diagnostics; | |
using System.Runtime.InteropServices; | |
using static GetSxsPath.NativeMethods; | |
namespace GetSxsPath | |
{ | |
internal class NativeMethods |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import re | |
import sys | |
versions = { | |
0x00: 'Excel 97', | |
0x01: 'Excel 2000', | |
0x02: 'Excel 2002', | |
0x03: 'Office Excel 2003', | |
0x04: 'Office Excel 2007', | |
0x06: 'Excel 2010', |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from Crypto.Cipher import AES | |
from Crypto.Protocol.KDF import PBKDF2 | |
import sqlite3 | |
import os | |
import shutil | |
def clean(x): | |
return x[:-ord(x[-1])] | |
# Make a copy of the cookie file |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<machineKey validationKey="CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF" decryptionKey="E9D2490BD0075B51D1BA5288514514AF" validation="SHA1" decryption="3DES" /> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import requests | |
import sys | |
import re | |
HEADERS = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0"} | |
if len(sys.argv) != 2: | |
print " Usage: python pulseversion.py <target ip/domain>" | |
sys.exit(1) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
var sh = new ActiveXObject('WScript.Shell'); | |
var key = "HKCU\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable"; | |
try{ | |
var AmsiEnable = sh.RegRead(key); | |
if(AmsiEnable!=0){ | |
throw new Error(1, ''); | |
} | |
}catch(e){ | |
sh.RegWrite(key, 0, "REG_DWORD"); // neuter AMSI |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<# | |
.SYNOPSIS | |
Author: Rich Warren | |
Based on original c# code by Jon Galloway: | |
https://weblogs.asp.net/jongalloway/creating-zip-archives-in-net-without-an-external-library-like-sharpziplib | |
.DESCRIPTION | |
Tool for creating a Zip file in native Powershell with .NET 3.0 only. |
NewerOlder