curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER| #!/usr/bin/env python3 | |
| """ | |
| dll_gen.py - Windows Shellcode Launcher DLL Generator | |
| Generates C++ source and compiles a Windows DLL with mingw-w64 that | |
| executes embedded shellcode. | |
| Modes: | |
| -f Export one or more named functions that each launch the shellcode. | |
| -dll Proxy an existing DLL: analyse its exports, run shellcode in |
| limits.beacons_max=50000 | |
| limits.beacon_rate_period=100 | |
| limits.beacon_rate_maxperperiod=10000 | |
| limits.beacon_rate_disableduration=1 |
| Go to `Computer\HKEY_CLASSES_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}` and change `System.IsPinnedToNameSpaceTree` to `0` to remove OneDrive from File Explorer. |
| # Remembering Chisel flags in the middle of competition is hard | |
| ## Server | |
| ``` | |
| chisel server -p 80 --socks5 --reverse | |
| ``` | |
| ## Client | |
| ``` |
| Quickly generate a range of IPs | |
| `nmap -sL -n 10.0.0.0/24 | awk '/Nmap scan report/{print $NF}' | |
| -sL List Scan | |
| $NF is a special awk variable that reprents the total number of columbs read (5 in this case) |
| // Base64 representation of the GIF file | |
| var gifBase64 = 'data:image/gif;base64,R0lGODlhcABwAPcAAOzZureojspnRsp1VXVnTVJHK9KFVtS8qG81KLGITpJYR+vcx9qHZNh4V4w4I7pmRevJqa1ZRMtWL7FlNk8zJ7lWNq55Z8qHZQ4EA6lVNm9XR7CaictkN414aLp3V/nautq5mduYd3NnM856YalnRZSJS9amd9vGqmgVBTIkEPrs2Prny9qpiOymeOq6mJlEJkYTAc2ah+/HmZhVN+uqh6l2VrqHZalGJeqZdsqph8uYd5hnRlYUA9zNtenNtJeJMsq3mvndyIcyFohVN4hFJpdIMv3JpnZyZ/u6mJc1FXcmFLlpVIhHNDItJLqYejYRAu7ny1JGFOu7qMt0R5l3WKmGZWtHFIhmRqlpVdhpRLKpdmcmEnhWN9l1R3dFJXg0GVRPReiJZ1YlFeqWaP337Mqrl5loVphmN3YkBtuWaclqU2VFJKmWeal2RXdHNfmqhqhJM+mIV69DF5l2RpmGZtmrl0YlFLlIJpiJdmghBeu1imZWNZiThrl1RzUFAJVEF9yLcciKciUEAIhnNVY1F2VHNvu2iYh2VrlUJ2Y0GEUjBVYjBdzUx4coE7qJdohoVuabhag3E+h3TqiKdfDnvO/o18uWaGRVI0UGASMRBEM0Ftu2iOzWrN7Wu4Z2Rn2CT4cmBndVJZh2NrmWZb2yoYdVJ4R3NsRaP6lUJ0YXDNrHm4qGd1cHAJhUJ5qWd/3WsPnOs4mGZlUWEqqXZDYXDYRlJyIWDuqrlbKjVbdJM5qXYjtAJfmceP33287Gq585JMm3iJczB+iMdYkyB/iYaUMzBtLGt4V4JddrUppmJ21jGchNHtTU6FtgLbiYq/2tkO/ez6qyzXcyBl9gUFU0B5YoB5YpFIxuGaGlbWczBtzWq+JpOunOx415gvvb1U0bJJl0KL6/op2dSuF7YR0hD4uWesuwxn0Y |
| #!/usr/bin/env python | |
| #Credit: https://stackoverflow.com/questions/15603628/how-to-calculate-ntlm-hash-in-python | |
| import binascii, hashlib, sys | |
| def generate(input_str): | |
| ntlm_hash = binascii.hexlify(hashlib.new('md4', input_str.encode('utf-16le')).digest()) | |
| return ntlm_hash | |
| num_of_args = len(sys.argv) | |
| if num_of_args == 1: |
Windows uses the client's scale settings to adjust when what scaling factor an RDP session should utilize. This handy in most cases when your client PC doesn't use scaled icons and text settings. But if you're like me and use 2k monitors then you always have your scaling set to 125% and that settings isn't replicated when I RDP into Windows 10.
After doing some experimentation (and reading a lot of outdated Reddit posts about Windows 8 that didn't work) I was able to discover the registry value to set to ignore your client scaling. This won't allow you to set the scaling through RDP but if you have console access and get set it that way then it will be respected when you RDP in.
reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations" /f /v IgnoreClientDesktopScaleFactor /t REG_DWORD /d 0
If you're unable to get console access, I BELIEVE these values will allow you to set the scaling factor that will go into effect once you run the