w0rk3r's Windows Hacking Library

Extracting SSH Private Keys from Windows 10 ssh-agent https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent @WindowsHackingLibrary

Leaking Environment Variables in Windows Explorer via .URL or desktop.ini files https://insert-script.blogspot.com/2018/08/leaking-environment-variables-in_20.html @WindowsHackingLibrary

Making The Perfect Injector: Abusing Windows Address Sanitization And CoW https://blog.can.ac/2018/05/02/making-the-perfect-injector-abusing-windows-address-sanitization-and-cow @WindowsHackingLibrary

Remotely Modify Anti-Virus Configurations https://www.fortynorthsecurity.com/remotely-modify-anti-virus-configurations @WindowsHackingLibrary

Python tool to inject fake updates into unencrypted WSUS traffic https://github.com/pdjstone/wsuspect-proxy @WindowsHackingLibrary

Broadcast Name Resolution Poisoning / WPAD Attack Vector https://p16.praetorian.com/blog/broadcast-name-resolution-poisoning-wpad-attack-vector @WindowsHackingLibrary

.NET Deserialization To NTLM Hashes https://www.digitalinterruption.com/single-post/2018/04/22/NET-Deserialization-to-NTLM-hashes @WindowsHackingLibrary

A Universal Windows Bootkit An analysis of the MBR bootkit referred to as “HDRoot" http://williamshowalter.com/a-universal-windows-bootkit @FromZer0toHero

List-RDP-Connections-History Use powershell to list the RDP Connections History of logged-in users or all users https://github.com/3gstudent/List-RDP-Connections-History @WindowsHackingLibrary

Microsoft.Workflow.Compiler.exe Mimikatz Runner. https://gist.github.com/caseysmithrc/b1190e023cd29c1910c01a164675a22e @WindowsHackingLibrary

SANS Webcast: PowerShell for PenTesting https://www.youtube.com/watch?v=a8_DqEVFwO8 @SecTalks

Arbitrary, Unsigned Code Execution Vector in Microsoft.Workflow.Compiler.exe https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb @WindowsHackingLibrary

Skeleton Key Attack https://pentestlab.blog/2018/04/10/skeleton-key @WindowsHackingLibrary

DCShadow - Minimal permissions, Active Directory Deception, Shadowception and more http://www.labofapenetrationtester.com/2018/04/dcshadow.html @WindowsHackingLibrary

Reconerator: C# Targeted Attack Reconnissance Tools https://github.com/stufus/reconerator @WindowsHackingLibrary

Bypass in Microsoft AD FS Multi-Factor Authentication protocol (CVE-2018-8340): Multi-Factor Mixup: Who Were You Again? https://www.okta.com/security-blog/2018/08/multi-factor-authentication-microsoft-adfs-vulnerability @WindowsHackingLibrary

Windows Exploitation Tricks: Exploiting Arbitrary Object Directory Creation for Local Elevation of Privilege https://googleprojectzero.blogspot.com/2018/08/windows-exploitation-tricks-exploiting.html @WindowsHackingLibrary

Phishing – Ask and ye shall receive https://blog.fox-it.com/2018/08/14/phishing-ask-and-ye-shall-receive @WindowsHackingLibrary

Koadic C3 COM Command & Control - JScript RAT https://github.com/zerosum0x0/koadic @WindowsHackingLibrary

Hacking around HTA files http://blog.sevagas.com/?Hacking-around-HTA-files @WindowsHackingLibrary