✍️
Red Teaming Experiments
search
⌘Ctrlk
✍️
Red Teaming Experiments
  • What is this iRed.team?
  • Pinned
    • Pentesting Cheatsheets
    • Active Directory & Kerberos Abuse
  • offensive security
    • Red Team Infrastructure
    • Initial Access
    • Code Execution
      • T1117: regsvr32
      • T1170: MSHTA
      • T1196: Control Panel Item
      • Executing Code as a Control Panel Item through an Exported Cplapplet Function
      • Code Execution through Control Panel Add-ins
      • T1191: CMSTP
      • T1118: InstallUtil
      • Using MSBuild to Execute Shellcode in C#
      • T1202: Forfiles Indirect Command Execution
      • Application Whitelisting Bypass with WMIC and XSL
      • Powershell Without Powershell.exe
      • Powershell Constrained Language Mode ByPass
      • Forcing Iexplore.exe to Load a Malicious DLL via COM Abuse
      • T1216: pubprn.vbs Signed Script Code Execution
    • Code & Process Injection
    • Defense Evasion
    • Enumeration and Discovery
    • Privilege Escalation
    • Credential Access & Dumping
    • Lateral Movement
    • Persistence
    • Exfiltration
  • reversing, forensics & misc
    • Windows Internals
    • Cloud
    • Neo4j
    • Dump Virtual Box Memory
    • AES Encryption Using Crypto++ .lib in Visual Studio C++
    • Reversing Password Checking Routine
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. offensive security

Code Execution

T1117: regsvr32chevron-rightT1170: MSHTAchevron-rightT1196: Control Panel Itemchevron-rightExecuting Code as a Control Panel Item through an Exported Cplapplet Functionchevron-rightCode Execution through Control Panel Add-inschevron-rightT1191: CMSTPchevron-rightT1118: InstallUtilchevron-rightUsing MSBuild to Execute Shellcode in C#chevron-rightT1202: Forfiles Indirect Command Executionchevron-rightApplication Whitelisting Bypass with WMIC and XSLchevron-rightPowershell Without Powershell.exechevron-rightPowershell Constrained Language Mode ByPasschevron-rightForcing Iexplore.exe to Load a Malicious DLL via COM Abusechevron-rightT1216: pubprn.vbs Signed Script Code Executionchevron-right
PreviousNetNTLMv2 hash stealing using Outlookchevron-leftNextT1117: regsvr32chevron-right

Last updated 4 years ago