Zander Work captainGeech42

👽

happy pwning my dudes

sec // mal // cti

captainGeech42 / sshd.conf

Created July 12, 2020 00:37

SSH fail2ban jail config

captainGeech42 / config

Created July 12, 2020 00:48

SSH config for ProxyJump example

captainGeech42 / config

Last active July 12, 2020 01:13

Example SSH config with port forward

captainGeech42 / default

Last active July 12, 2020 15:41

NGINX config for onion mirror

	server {
	listen 127.0.0.1:8080;

	# Update this for your actual webroot
	root /var/www/html;

	index index.html

	server_name _;

captainGeech42 / phase2.py

Last active October 13, 2020 19:32

DamCTF 2020 - Malware Phase 2 Solution Script

	from Crypto.Cipher import ARC4
	import sys

	# read in malware
	with open(sys.argv[1], "rb") as f:
	data = f.read()

	# get data
	config_block = data[0x51a0:0x5394]
	key_len = 32

captainGeech42 / dump.py

Last active January 18, 2021 08:24

Dump a binary file as a C-style array

	#!/usr/bin/env python

	import sys

	def main(argv):
	if len(argv) == 1:
	print(f"usage: {argv[0]} [path to bin file]")
	return 1

	with open(argv[1], "rb") as f:

captainGeech42 / powershell_parser.kql

Last active October 27, 2021 08:21

PowerShell Event Log Parser for Azure Sentinel (EID 4103/4104)

	let EventData = Event
	\| where Source == "Microsoft-Windows-PowerShell"
	\| extend RenderedDescription = tostring(split(RenderedDescription, ":")[0])
	\| project TimeGenerated,
	Source,
	EventID,
	Computer,
	UserName,
	EventData,
	RenderedDescription

captainGeech42 / export_ctftime.py

Created November 9, 2021 01:31

Export ctftime compatible scoreboard from rCTF

	#!/usr/bin/env python3

	import requests
	import sys

	# use an account with bit 1<<2 set (put 7 for ultimate laziness)

	BASE_URL = "https://damctf.xyz"
	TEAM_TOKEN = "redacted" # the thing from the url on the team profile page

captainGeech42 / gen_qtypes.py

Created December 19, 2021 04:15

Take all of the lines, remove leading/trailing whitespace and comments, and stick them in "in"

	# https://github.com/miekg/dns/blob/master/types.go#L27

	with open("in", "r") as f:
	lines = [x.strip() for x in f.readlines()]

	for l in lines:
	parts = l.split("uint16 = ")
	type = parts[0].strip()[4:]
	val = parts[1]

captainGeech42 / scriptobf_replaceempty.yara

Last active January 11, 2022 02:19

Yara rule that detects string.replace() being used for possible script obfuscation

	rule Methodology_ScriptObf_ReplaceEmpty {
	meta:
	author = "Zander Work (@captainGeech42)"
	descr = "Detects the use of string.Replace() or similar, where the replacement string is an empty string. This is a common technique for basic script obfuscation."
	strings:
	// doesn't hit on the search string being passed in as a variable FYSA
	$re1 = /replace$["'].*["'], ["']["']$/ nocase // catches basic usage in at least python and powershell
	$re2 = /replace$["'].*["'], ["']["'], \d+$/ // python str.replace has an optional third argument, a number. this only catches a decimal number fysa
	$re3 = /replace$\/.\/\w, ["']["']$/ // javascript String.prototype.replace can take a regex pattern for the first argument
	$re4 = /replace\(\w+, ["'].*["'], ["']["']/ nocase // vbscript replace takes at least 3 arguments: var to replace in, search string, replacement string. there are three more optional args