3gstudent

Pentest-and-Development-Tips. A collection of pentest and development tips

Homework-of-Python. Python codes of my blog.

Homework-of-C-Language. C/C++ code examples of my blog.

Worse-PDF. Turn a normal PDF file into malicious.Use to steal Net-NTLM Hashes from windows machines.

Eventlogedit-evtx--Evolution. Remove individual lines from Windows XML Event Log (EVTX) files

List-RDP-Connections-History. Use powershell to list the RDP Connections History of logged-in users or all users

Inject-dll-by-APC. Asynchronous Procedure Calls

Javascript-Backdoor. Learn from Casey Smith @subTee

Invoke-BuildAnonymousSMBServer. Use to build an anonymous SMB file server.

pyKerbrute. Use python to perform Kerberos pre-auth bruteforcing

Homework-of-C-Sharp. C Sharp codes of my blog.

msbuild-inline-task.

CLR-Injection. Use CLR to inject all the .NET apps

SharpRDPCheck. Use to check the valid account of the Remote Desktop Protocol(Support plaintext and ntlmhash)

Inject-dll-by-Process-Doppelganging. Process Doppelgänging

backup-3gstudent.github.io. old blog

Smbtouch-Scanner. Automatically scan the inner network to detect whether they are vulnerable.

ntfsDump. Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.

Homework-of-Powershell. powershell codes of my blog.

HiddenNtRegistry. Use NT Native Registry API to create a registry that normal user can not query.

Use-COM-objects-to-bypass-UAC. C++

Windows-EventLog-Bypass. Use subProcessTag Value From TEB to identify Event Log Threads

pyXSSPlatform. Used to build an XSS platform on the command line.

3gstudent.github.io. Blog

Office-Persistence. Use powershell to test Office-based persistence methods

Windows-User-Clone. Create a hidden account

APT34-Jason. Use to perform Microsoft exchange account brute-force.

CreateRemoteThread. From 32-bit process to 64-bit process

bitsadminexec. Use bitsadmin to maintain persistence and bypass Autoruns

CVE-2017-8464-EXP. Support x86 and x64

Hook-PasswordChangeNotify. Stealing passwords every time they change

Code-Execution-and-Process-Injection. Powershell to CodeExecution and ProcessInjection

test. just test

Shellcode-Generater. No inline asm,support x86/x64

PasswordFilter. 2 ways of Password Filter DLL to record the plaintext password

Dump-Clear-Password-after-KB2871997-installed. PowerShell

COM-Object-hijacking. use COM Object hijacking to maintain persistence.(Hijack CAccPropServicesClass and MMDeviceEnumerator)

NinjaCopy. Powershell to copy ntds.dit

signtools. From Windows SDK

ewsManage. My exercise of using Exchange Web Service(EWS)

From-System-authority-to-Medium-authority. Penetration test

Bypass-Windows-AppLocker. C

Waitfor-Persistence. Use Waitfor.exe to maintain persistence

Winpcap_Install. Auto install WinPcap on Windows(command line)

Homework-of-Go. Go code examples of my blog.

PNG-Steganography. Steganography Payload

easBrowseSharefile. Use to browse the share file by eas(Exchange Server ActiveSync)

Eventlogedit-evt--General. Remove individual lines from Windows Event Viewer Log (EVT) files

GadgetToJScript. (Small change to make it easier to test the payload and combine it with SILENTTRINITY.)A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS based scripts.

Bypass-McAfee-Application-Control--Code-Execution. source&exe

Smallp0wnedShell. Small modification version of p0wnedShell

ListInstalledPrograms. List the programs that the current Windows system has installed

GetExpiredDomains. Search for available domain from expireddomains.net

AutoIt-Keylogger. AutoIt

fuzzbunch. NSA finest tool

Use-msxsl-to-bypass-AppLocker. Learn from Casey Smith@subTee

p0wnedShell-DarkVersion. Add my own POC to test Visual Studio trick to run code when building

Writeup. interesting analysis

LaZagne. Credentials recovery project