ajxchapman

CVE-2019-5418 Demo

Build Docker container: Dockerfile

FROM ruby:2.5
RUN apt-get update -qq && apt-get install -y nodejs postgresql-client
RUN mkdir /myapp
WORKDIR /myapp
COPY Gemfile /myapp/Gemfile

ajxchapman

Scripts developed for solving HackerOne H1-702 2019 CTF

• image_extract.py performs character extraction on targetted against the HackerOne H1-702 CTF announcement image
• decrypt_sqli.py performs blind sqli data extraction with encrypted payloads targetting against the FliteThermostat API
• timing_attack.py performs an HTTP piplining based timing against the FliteThermostat Backend
• wordlist_generator.py generates wordlists from a give corpus or set of corpuses
• httplib.py performs efficient asynchronous HTTP requests against the FliteThermostat Backend

ajxchapman

import re
import requests

import inflect

seed_urls = [
    "http://www.example.com",
]
cookies = {"session" : "2eyhsb2dnZxWRJ9biI6dHJ1ZXr0"}
prefixes = ["get", "set", "get_", "set_"]

ajxchapman

Linux Gateway with WPAD and PAC

Simple setup to create a Linux gateway on Ubuntu 18.04 that provides WPAD settings via DHCP option 252.

systemctl disable systemd-resolved.service
systemctl stop systemd-resolved
apt update
apt install dnsmasq
unlink /etc/resolv.conf
echo "nameserver 8.8.8.8" > /etc/resolv.conf

ajxchapman

import base64
import os
import sys

search = " ".join(sys.argv[2:]) or None

path = None
with open(sys.argv[1]) as f:
    for line in f:
        if '<path>' in line:

ajxchapman

import argparse
import pickle
import sys


if sys.version_info < (3, 0, 0):
    _exec = None
    buff = sys.stdout  # Buffer to write binary strings to
else:
    import builtins

ajxchapman

// npm install chrome-remote-interface minimist
const CDP = require('chrome-remote-interface');
const argv = require('minimist')(process.argv.slice(2));
const file = require('fs');
const spawn = require('child_process').spawn;
const net = require('net');
const crypto = require('crypto');

const url = argv.url || 'https://www.google.com';
const id = argv.id || crypto.createHash('sha256').update(url).digest("hex");