WBGlIl

WBGlIl / gist:b255645eb8e6cf1a71ccc1105aa1c0ff

Created July 21, 2019 10:45

C++ load_exe_run

	#include "stdafx.h"


	typedef IMAGE_SECTION_HEADER (*PIMAGE_SECTION_HEADERS)[1];

	// 计算对齐后的大小
	unsigned long GetAlignedSize(unsigned long Origin, unsigned long Alignment)
	{
	return (Origin + Alignment - 1) / Alignment * Alignment;
	}

WBGlIl / gist:0b6c21dab15c3bb8eb099f241e48c63e

Created July 21, 2019 10:40

load_run_exe

	using System.Runtime.InteropServices;
	using System.Text;
	using System;

	using Microsoft.VisualBasic;

	namespace dependency
	{
	class AB
	{

WBGlIl / blog.txt

Created May 21, 2019 10:02

Gist Blog - Inside Out, Simple backdoors

	From the inside out, a minimalist backdoor.

	I'm a pretty big fan of simple, and elegant. In this gist blog, I'll show you a very simple way to maintain access to a remote system that is behind a FireWall, NAT and VPN.

	We will use in this example 3 tools.
	1. Node
	2. PowerShell
	3. LocalTunnel

	While I have a full compact, custom version, I will not release this.

WBGlIl / Invoke-DCSync.ps1

Created March 1, 2019 07:17 — forked from monoxgas/Invoke-DCSync.ps1

What more could you want?

This file has been truncated, but you can view the full file.

	function Invoke-DCSync
	{
	<#
	.SYNOPSIS

	Uses dcsync from mimikatz to collect NTLM hashes from the domain.

	Author: @monoxgas
	Improved by: @harmj0y