This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Converts OpenAI compatible function calling JSON schema to a prompt that instructs the LLM to return | |
# a JSON object that is a choice of a function call conforming to one of the functions or a message reply | |
def convert_schema_to_typescript(schema): | |
if not schema: | |
return 'any' | |
if '$ref' in schema: | |
return schema['$ref'].replace('#/definitions/', '') |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import csv | |
import requests | |
import argparse | |
from bs4 import BeautifulSoup | |
from colorama import Fore, Style, init | |
init(autoreset=True) | |
known_security_vendors = [ | |
'symantec', 'mcafee', 'trendmicro', 'kaspersky', 'bitdefender', |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/*! | |
* | |
* RPROXICMP | |
* | |
* GuidePoint Security LLC | |
* | |
* Threat and Attack Simulation Team | |
* | |
!*/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from hashlib import md5, sha1 | |
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes | |
from cryptography.hazmat.backends import default_backend | |
from base64 import b64encode, b64decode | |
import sys, time | |
import requests | |
DEFAULT_MASTERKEY=b'p1a2l3o4a5l6t7o8' | |
class PanCrypt(): |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import re, sys | |
def rule_startswith(ioc_string): | |
def __match(pipename): | |
if pipename.startswith(ioc_string): | |
print("\tMATCH startswith({})".format(ioc_string)) | |
return True | |
return False | |
return __match |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
#@atucom | |
# PoC of getting a remote shell using a meshtastic radio. | |
# this works by using the meshtastic python package and the device connected over USB serial | |
# The long/slow transmit speed gives about 10 bytes/sec bandwidth which is crazy slow. It took 5.5mins to run 'ls -la' on my home dir | |
# This could be further improved by the following: | |
# - trying the short/fast mode | |
# - creating a dedicated channel | |
# - setting a non-default psk for encryption |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdint.h> | |
#include <inttypes.h> | |
#include <winsock2.h> | |
#include <windns.h> | |
#include <windows.h> | |
#include <stdio.h> | |
#include <tlhelp32.h> | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
${ctx:loginId} | |
${map:type} | |
${filename} | |
${date:MM-dd-yyyy} | |
${docker:containerId} | |
${docker:containerName} | |
${docker:imageName} | |
${env:USER} | |
${event:Marker} | |
${mdc:UserId} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
typedef struct _ioctl_t | |
{ | |
const char* ioctl_name; | |
uint64_t ctl_code; | |
} ioctl_t; | |
// This would likely be better used in some unordered map. This is just a temporary data structure for testing resolution. | |
// | |
// Results from NtDeviceIoControlFile hook: | |
// utweb.exe (14916) :: NtDeviceIoControlFile( 0x65c (\Device\Afd), 0x694, 0x0000000000000000, 0x0000000000000000, 0x00000000044DEE90, 0x12024 (IOCTL_AFD_SELECT), 0x0000000004A3FC18, 0x34, 0x0000000004A3FC18, 0x34 ) |
NewerOlder