| #!/usr/bin/env bash | |
| set -e -x -o pipefail | |
| DIRNAME="$(dirname $0)" | |
| DISK="$1" | |
| : "${DEBIAN_RELEASE:=stretch}" | |
| : "${DEBIAN_VERSION:=9.2.1}" | |
| : "${DEBIAN_MIRROR:=http://ftp.debian.org}" |
| import ipaddress | |
| import math | |
| import sys | |
| def pack_address(addr): | |
| """Pack an IPv4 Address into colon-delimited format.""" | |
| return ':'.join('{:02x}'.format(c) for c in addr.packed) | |
| import sys | |
| from lxml import html | |
| import os | |
| import os.path | |
| import re | |
| run = True | |
| buf = open(sys.argv[1]).read() | |
| doc = html.fromstring(buf[:]) |
| ## AWS | |
| # Amazon Web Services (No Header Required) | |
| # from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories | |
| http://169.254.169.254/latest/user-data | |
| http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME] | |
| http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME] | |
| http://169.254.169.254/latest/meta-data/ami-id | |
| http://169.254.169.254/latest/meta-data/reservation-id | |
| http://169.254.169.254/latest/meta-data/hostname | |
| http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key |
| /* One-off background bind shell with chroot for initramfs. */ | |
| #include <unistd.h> | |
| #include <sys/types.h> | |
| #include <sys/socket.h> | |
| #include <netinet/in.h> | |
| #include <stdlib.h> | |
| #include <stdio.h> | |
| #define PORT 2323 |
| jq '.profile.info_cache[]|.user_name' "${PROFILEDIR}/Local State" |
| # Copyright 2017 Google Inc. | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # https://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, |
Attach to a running process with
gdb -x trace-dyn-mem -p $PID
After every malloc the returned value (the allocated address) will be read from the RAX (64 bits) register.
After every free the last item in the backtrace (the free itself) will be shown. With the libc6-dbg package installed you can see the address passed as the first argument of free.
I hereby claim:
To claim this, I am signing this object:
| import json | |
| import os | |
| import sys | |
| import re | |
| _ACCESS_ALL = '**Access your data on all websites**' | |
| PERMISSIONS = { | |
| 'plugins': 'Access all data on your computer and the websites you visit', |