Skip to content

Instantly share code, notes, and snippets.

View N3mes1s's full-sized avatar

Giuseppe Massaro N3mes1s

148 followers · 25 following
View GitHub Profile
@rspeer
rspeer / deadbeef_character.py
Last active June 12, 2023 12:24
"""
This file contains code that, when run on Python 2.7.5 or earlier, creates
a string that should not exist: u'\Udeadbeef'. That's a single "character"
that's illegal in Python because it's outside the valid Unicode range.
It then uses it to crash various things in the Python standard library and
corrupt a database.
On Python 3... well, this file is full of syntax errors on Python 3. But
if you were to change the print statements and byte literals and stuff:
@hugsy
hugsy / QuickTip1.md
Last active June 18, 2020 22:29
Using new syscalls to bypass ptrace-protected process and read/write arbitrary memory.

Even though well known methods exist to bypass ptrace deactivation on a process when spawning (fake ptrace() preloading, breakpoint on ptrace(), etc... ), it is trickier when process is already protected.

Thankfully Linux 3.2+ was generous enough to provide read/write capabilities to another process with 2 new system calls: sys_process_vm_readv and sys_process_vm_writev. (see https://github.com/torvalds/linux/blob/master/arch/x86/syscalls/syscall_64.tbl#L319)

Manual says:

These system calls transfer data between the address space of the calling

@ocornut
ocornut / (Archived) imgui_memory_editor.h
Last active March 5, 2026 13:43
Mini memory editor for dear imgui (to embed in your game/tools)
// Mini memory editor for Dear ImGui (to embed in your game/tools)
// Animated GIF: https://twitter.com/ocornut/status/894242704317530112
// THE MEMORY EDITOR CODE HAS MOVED TO GIT:
// https://github.com/ocornut/imgui_club/tree/master/imgui_memory_editor
// Click "Revisions" on the Gist to see old version.
@Tobba
Tobba / gist:5720dc8ee4d32606062c
Last active September 24, 2024 16:04 — forked from Geal/gist:22dd55c84a583b18ec30
Baremetal Rust
# What you need to write low level Rust code
* Avoid cargo, it it may seem tempting, but you'll just keep running into untested code paths and design flaws; it's not meant to do it.
* Using a target specification to describe your platform is recommended, and you'll likely need one for one reason or another anyways (example: https://github.com/hackndev/zinc/blob/master/thumbv6-none-eabi.json ). Pass it to rustc via --target=target.json
* You wan work without the standard library, by following those instructions: https://doc.rust-lang.org/book/no-stdlib.html
* Inline assembly (asm!) blocks are fed directly into LLVM and have horrible error checking, tread lightly and verify the output.
* LLVM can end up generating dodgy versions of certain instructions on certain versions, it may for example turn "lgdt" into the utterly useless 16-bit version (which truncates the upper 8 bits of the address). Specify operand sizes.
* An "intel" option is supported, but it seems to be somewhat dodgy (for example, it seemed to d
@mattifestation
mattifestation / WMI_attack_detection.ps1
Last active March 16, 2021 23:02
BlueHat 2016 - WMI attack detection demo
#region Scriptblocks that will execute upon alert trigger
$LateralMovementDetected = {
$Event = $EventArgs.NewEvent
$EventTime = [DateTime]::FromFileTime($Event.TIME_CREATED)
$MethodName = $Event.MethodName
$Namespace = $Event.Namespace
$Object = $Event.ObjectPath
$User = $Event.User
@mattifestation
mattifestation / WMI_recon_and_attacks.ps1
Last active May 4, 2026 09:04
BlueHat 2016 - WMI recon and attack demo
#############
### SETUP ###
#############
# Set up remote session
$Credential = Get-Credential TestUser
$AdminCred = Get-Credential Administrator
$SessionOption = New-CimSessionOption -Protocol Dcom
$CimSession = New-CimSession -Credential $Credential -ComputerName TestPC -SessionOption $SessionOption
$AdminCimSession = New-CimSession -Credential $AdminCred -ComputerName TestPC -SessionOption $SessionOption
@jaredcatkinson
jaredcatkinson / Get-InjectedThread.ps1
Last active March 13, 2026 04:24
Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone
function Get-InjectedThread
{
<#
.SYNOPSIS
Looks for threads that were created as a result of code injection.
.DESCRIPTION
@worawit
worawit / eternalblue_merge_shellcode.py
Last active August 15, 2026 19:03
Windows x64 and x86 kernel shellcode for eternalblue exploit
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
import sys
from struct import pack
if len(sys.argv) < 4:
print('Usage: {} sc_x86 sc_x64 sc_out'.format(sys.argv[0]))
sys.exit()
sc_x86 = open(sys.argv[1], 'rb').read()
sc_x64 = open(sys.argv[2], 'rb').read()
@hfiref0x
hfiref0x / main.c
Last active May 21, 2026 06:27
NtLoadEnclaveData Windows 10 RS3 DSE bypass
// Original source link https://twitter.com/hFireF0X/status/887930221466443776
// If you are here from any other link - do know that they just steal original info without giving any credit to source
// This bug has been fixed in 16273 public build.
#include "global.h"
HINSTANCE g_hInstance;
HANDLE g_ConOut = NULL;
BOOL g_ConsoleOutput = FALSE;
WCHAR g_BE = 0xFEFF;
@ropnop
ropnop / kinit_brute.sh
Last active June 6, 2021 18:23
A quick tool to bruteforce an AD user's password by requesting TGTs from the Domain Controller with 'kinit'
#!/bin/bash
# Title: kinit_brute.sh
# Author: @ropnop
# Description: This is a PoC for bruteforcing passwords using 'kinit' to try to check out a TGT from a Domain Controller
# The script configures the realm and KDC for you based on the domain provided and the domain controller
# Since this configuration is only temporary though, if you want to actually *use* the TGT you should actually edit /etc/krb5.conf
# Only tested with Heimdal kerberos (error messages might be different for MIT clients)
# Note: this *will* lock out accounts if a domain lockout policy is set. Be careful