worawit

#!/usr/bin/python
"""
Exploit for Samba vulnerabilty (CVE-2015-0240) by sleepya

The exploit only targets vulnerable x86 smbd <3.6.24 which 'creds' is controlled by 
ReferentID field of PrimaryName (ServerName). That means '_talloc_zero()'
in libtalloc does not write a value on 'creds' address.

Reference:
- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/

b1tninja

{
  "masscan": {
    "order": 0,
    "template": "masscan-*",
    "settings": {
      "index": {
        "number_of_shards": "3",
        "number_of_replicas": "1"
      }
    },

joepie91

Promises reading list

This is a list of examples and articles, in roughly the order you should follow them, to show and explain how promises work and why you should use them. I'll probably add more things to this list over time.

This list primarily focuses on Bluebird, but the basic functionality should also work in ES6 Promises, and some examples are included on how to replicate Bluebird functionality with ES6 promises. You should still use Bluebird where possible, though - they are faster, less error-prone, and have more utilities.

I'm available for tutoring and code review :)

You may reuse all gists for any purpose under the WTFPL / CC0 (whichever you prefer).

joepie91

"How do I get started with Node?" is a commonly heard question in #Node.js. This gist is an attempt to compile some of the answers to that question. It's a perpetual work-in-progress.

And if this list didn't quite answer your questions, I'm available for tutoring and code review! A donation is also welcome :)

Setting expectations

Before you get started learning about JavaScript and Node.js, there's one very important article you need to read: Teach Yourself Programming in Ten Years.

Understand that it's going to take time to learn Node.js, just like it would take time to learn any other specialized topic - and that you're not going to learn effectively just by reading things, or following tutorials or courses. _Get out there and build things!

itay-grudev

# /etc/ssh-backdoor/ssh-backdoor.conf
REMOTE_BINDPORT=12345
[email protected]
REMOTE_PORT=22
LOCAL_HOST=localhost
LOCAL_PORT=22
SSH_KEY=/etc/ssh-backdoor/ssh-backdoor.key

Wack0

<?php
/*
	Updated version, 2016-12-02: fixed shellcode so it *actually* works on QEMU
	usermode emulation (seems I pushed an old version), and removed debug output.
	
	-------------------------
	
	NB: THIS PoC ONLY WORKS IN QEMU USERMODE EMULATION!
	If anyone wants to fix this, go ahead (no pun intended).
	However, I don't have a vulnerable product and am unwilling to acquire one.

Viss

first, create a bash script, put this in it. 

#!/bin/bash
while IFS='' read -r line || [[ -n "$line" ]]; do
    curl --user-agent "$line" <the url you want to troll>
done < "$1"

Name it something dumb. logshove.sh

Next create a file with no url-encodable chars. Make sure every line is the same length. don't use spaces. I used periods. 

thomhastings

Notes on Shadow Brokers EQGRP-LiT

credit: @GossiTheDog: "If you want to setup FUZZBUNCH (the Equation exploit framework) you need Win7 VM + Python 2.6 + Pywin 2.6, then python fb.py for shell"
h/t @x0rz @DEYCrypt @hackerfantastic

HOW 2 SETUP + INSTALL FUZZBUNCH & DANDERSPRITZ

context: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
writeup: https://www.trustedsec.com/blog/equation-group-dump-analysis-full-rce-win7-fully-patched-cobalt-strike/
decrypted files: https://github.com/x0rz/EQGRP_Lost_in_Translation

exorcyst

#!/usr/bin/perl -w


# iterate over each file 

foreach $y (@ARGV)
{
open FH, $y;

while ($x = <FH>)

th3gundy

"""
    Tomcat bruteforce
    Author: @itsecurityco
"""

import os
import sys
import getopt
import base64
import requests