gtworek / psbits

Simple (relatively) things allowing you to dig a bit deeper than usual.

Hi there 👋

Good luck digging through my stuff... ;)

I have lost here years ago, but in most cases it's the original work based on my own research and never published anywhere else.

If you want to be up to date, I think https://twitter.com/0gtweet is the best option.

Newsletter may be useful as well: https://gtworek.ck.page/

Github Stats

psbits's Issues

Powershell issue, Can you help?

After i run Openvpn Ps1 i get this issue:

Add-Type -AssemblyName System.Security is needed

Hi,

Seems like Add-Type -AssemblyName System.Security is needed for using the "System.Security.Cryptography.ProtectedData".

Thanks for the tools - looks great!

StopAndDisableDefaultSpoolers.ps1 - another default printers

Hi
i have few another default printers:

Printer found: Send to Microsoft OneNote 16 Driver
Printer found: Microsoft Shared Fax Driver

may be add this to script?

GetSysmonTree.ps1 gives error and stuck

Hello This is the error I get, and it will never go through...

Error running NPPSPy.c

Hi,

I get the following message when I run NPPSPy.c

C:\Win-builds\bin>gcc c:\temp\NPPSPy.c
C:\temp\NPPSPy.c: In function 'SavePassword':
C\temp\NPPSPy.c:53:3: warning: passing argument 1 of 'CreateFileA' from incompatible pointer type [enabled by default]
NULL);
^
In file included from c:\win-builds\i686-w64-mingw32\include\winbase.h:18:0,
from c:\win-builds\i686-w64-mingw32\include\windows.h:70,
from c:\temp\NPPSPy.c:1:
C:\win-builds\i686-w64-mingw32\include\fileapi.h:45:28: note: expected 'LPCSTR' but argument is of type 'short unsigned int *'
WINBASEAPI HANDLE WINAPI CreateFileA (LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
^
C:/win-builds/bin/../lib/gcc/i686-w64-mingw32/4.8.3/../../../../i686-w64-mingw32/lib/../lib/libmingw32.a(lib32_libmingw32_a-crt0_c.o):crt0_c.c:(.text.startup+0x39): undefined reference to `WinMain@16'
collect2.exe: error: ld returned 1 exit status

Hidden Shadow can't be unhidden.

Hi! I'm currently having an issue with this scenario:
I have just one Shadowcopy (number 1). I hide this Shadowcopy.
I create a new one Shadowcopy (number 2).
Since I want to have the most recent one hidden. I try to unhide the number 1 and hide the number 2.
The result is:
Number 1 is not unhide. An error message is shown.
Number 2 is hidden.
I can't recover anymore the number 1.

OfflineSAM/OfflineAddAdmin2 compile

Hi,

Trying to compile the OfflineAddAdmin2 but I'm having issues. Managed to compile using VS Studio with the following command:
cl OfflineAddAdmin.c legacy_stdio_definitions.lib advapi32.lib, however the resulting exe is not working. When I reproduce the exploit, I get the following error: LSAOfflineOpenPolicy... error 0xc000000d.

Using your exe works however.

My code is exactly the same as yours, I only changed the username and password. However my resulting exe is 139KB while yours is 141KB.

Would you have an idea what could be the issue ? Could you share the exact command used for compilation ?

.ps1 file does not work because it is not digitally signed.

. ps1 file does not work because it is not digitally signed.