https://github.com/cube0x0/SharpSystemTriggers

Collection of remote authentication triggers in C#
https://github.com/cube0x0/SharpSystemTriggers

Last synced: 21 days ago
JSON representation

Collection of remote authentication triggers in C#

• Host: GitHub
• URL: https://github.com/cube0x0/SharpSystemTriggers
• Owner: cube0x0
• Created: 2021-09-12T18:18:15.000Z (about 3 years ago)
• Default Branch: main
• Last Pushed: 2024-05-15T21:24:56.000Z (7 months ago)
• Last Synced: 2024-08-05T17:25:01.757Z (4 months ago)
• Language: C
• Size: 807 KB
• Stars: 440
• Watchers: 8
• Forks: 54
• Open Issues: 2
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - cube0x0/SharpSystemTriggers - Collection of remote authentication triggers in C# (C)

README

        
# SharpSystemTriggers

Collection of remote authentication triggers coded in C# using MIDL compiler for avoiding 3rd party dependencies.

## Midl2Bytes

For easy converting MIDL output to C# byte array.

![](Images/midl2bytes.png)

One liner to get function call and call ID `(cat ms-rprn_c.c | sls '/* Procedure .* ' -Context 0,10) | foreach-object {$_.matches.value.replace(' Procedure ','') + " " + ($_.Context.PostContext | sls '^\/\*')[0].Line.Split()[1]}`

## SharpEfsTrigger

C# Implementation of MS-EFS RPC

![](Images/efs.png)

## SharpSpoolTrigger

C# Implementation of MS-RPRN RPC

![](Images/spool.png)

## SharpDcomTrigger

C# Implementation of DCOM Potato triggers

![](Images/dcom.png)

## Acknowledgements

* [PetitPotam](https://github.com/topotam/PetitPotam) by [topotam](https://twitter.com/topotam77)

* [SpoolSample](https://github.com/leechristensen/SpoolSample) by [Lee Christensen](http://twitter.com/tifkin_)

* [EfsPotato](https://github.com/zcgonvh/EfsPotato) by zcgonvh

* [pingcastle](https://github.com/vletoux/pingcastle) by [vletoux](https://twitter.com/mysmartlogon)

* All the potato devs

* [tiraniddo](https://twitter.com/tiraniddo)