3gstudent/ntfsDump

Turn a normal PDF file into malicious.Use to steal Net-NTLM Hashes from windows machines.

334

3

Worse-PDF

331

4

Homework-of-Python

Python codes of my blog.

Use powershell to list the RDP Connections History of logged-in users or all users

321

5

List-RDP-Connections-History

Remove individual lines from Windows XML Event Log (EVTX) files

253

6

Eventlogedit-evtx--Evolution

Learn from Casey Smith @subTee

246

7

Javascript-Backdoor

Use to build an anonymous SMB file server.

242

8

Invoke-BuildAnonymousSMBServer

msbuild-inline-task

CLR-Injection

Use CLR to inject all the .NET apps

Batchfile

170

11

Homework-of-C-Sharp

C Sharp codes of my blog.

Use python to perform Kerberos pre-auth bruteforcing

169

12

pyKerbrute

Asynchronous Procedure Calls

168

13

Inject-dll-by-APC

Use to check the valid account of the Remote Desktop Protocol(Support plaintext and ntlmhash)

163

14

SharpRDPCheck

Automatically scan the inner network to detect whether they are vulnerable.

154

15

Inject-dll-by-Process-Doppelganging

Process Doppelgänging

C

151

16

backup-3gstudent.github.io

Smbtouch-Scanner

powershell codes of my blog.

140

18

Homework-of-Powershell

93

19

Use-COM-objects-to-bypass-UAC

Use powershell to test Office-based persistence methods

86

20

Office-Persistence

77

21

Windows-User-Clone

Create a hidden account

Use subProcessTag Value From TEB to identify Event Log Threads

76

22

Windows-EventLog-Bypass

Use to perform Microsoft exchange account brute-force.

74

23

APT34-Jason

Used to build an XSS platform on the command line.

74

24

pyXSSPlatform

CVE-2017-8464-EXP

bitsadminexec

Use bitsadmin to maintain persistence and bypass Autoruns

67

27

Code-Execution-and-Process-Injection

Powershell to CodeExecution and ProcessInjection

No inline asm,support x86/x64

64

28

Shellcode-Generater

test

CreateRemoteThread

From 32-bit process to 64-bit process

2 ways of Password Filter DLL to record the plaintext password

62

31

PasswordFilter

61

32

Dump-Clear-Password-after-KB2871997-installed

Use Waitfor.exe to maintain persistence

59

33

From-System-authority-to-Medium-authority

Waitfor-Persistence

35

Bypass-Windows-AppLocker

C

Powershell to copy ntds.dit

36

NinjaCopy

use COM Object hijacking to maintain persistence.(Hijack CAccPropServicesClass and MMDeviceEnumerator)

37

COM-Object-hijacking

3gstudent.github.io

Winpcap_Install

Auto install WinPcap on Windows(command line)

Batchfile

52

40

ewsManage

My exercise of using Exchange Web Service(EWS)

Use NT Native Registry API to create a registry that normal user can not query.

51

41

HiddenNtRegistry

Go code examples of my blog.

49

42

Homework-of-Go

signtools

Eventlogedit-evt--General

Remove individual lines from Windows Event Viewer Log (EVT) files

44

45

PNG-Steganography

Steganography Payload

Use to browse the share file by eas(Exchange Server ActiveSync)

44

46

easBrowseSharefile

Small modification version of p0wnedShell

43

47

Bypass-McAfee-Application-Control--Code-Execution

Smallp0wnedShell

List the programs that the current Windows system has installed

37

49

ListInstalledPrograms

AutoIt-Keylogger

Hide-Process-by-kd.exe

powershell to hide process by kd.exe

An example of a downloader written in NodeJS.

33

52

NodeJS-Downloader

JavaScript

26

53

Use-msxsl-to-bypass-AppLocker

Learn from Casey Smith@subTee

XSLT

26

Search for available domain from expireddomains.net

GetExpiredDomains

Execute DLL via the Excel.Application object's RegisterXLL() method

24

55

ExcelDllLoader

JavaScript

22

56

Add-Dll-Exports

Use to generate DLL through Visual Studio

C

19

57

Execute-CSharp-From-XSLT-TEST

Writeup

PNG_stego-test

SendMail-with-Attachments

Use powershell to send mail

Enumerate all processes and get specified file's handle,then close it.

11

61

Catch-specified-file-s-handle

pdf

IE-BHO-POSTdata-Logger

A sample IE BHO for logging Internet Explorer's POST data.

Record my reverse analysis of WanaCrypt0r

9

64

WanaCrypt0r-Reverse-Analysis

8

65

bgi-creater

Use BGInfo to bypass Application Whitelisting

Powershell to get wlan keys

7

66

Get-Wlan-Keys