Skip to content

Instantly share code, notes, and snippets.

View darkr4y's full-sized avatar
🎯
Self-Introspection

D@rkR4y. darkr4y

🎯
Self-Introspection
  • Pand0ra
  • Origin
View GitHub Profile
@ThePirateWhoSmellsOfSunflowers
ThePirateWhoSmellsOfSunflowers / lsarlookupsids3.py
Created November 22, 2024 13:01
Perform a lsarlookupsids3 with a trust account, it uses netlogon as SSP (see [MS-NRPC] 3.3)
from impacket.dcerpc.v5 import epm, lsad, rpcrt, transport, lsat, ndr, nrpc
from impacket.uuid import bin_to_uuidtup
from binascii import unhexlify
from random import randbytes
import sys
# Perform a lsarlookupsids3 with a trust account, it uses netlogon as SSP (see [MS-NRPC] 3.3)
# Pure TCP RPC is used (ncacn_ip_tcp option)
# RC4 is used here because to use AES, impacket must be patched
# Tested with impacket 0.12.0 on GOAD
@7etsuo
7etsuo / socket_cheatsheet.txt
Created November 10, 2024 10:07
socket cheatsheet
. .
|\/\/|
|____|
.-----------. .-----------. .------. .-----.
/ \.-------./ \.-------*-. | | |----------.
@jborean93
jborean93 / New-ScheduledTaskSession.ps1
Last active September 4, 2025 08:50
Creates a PSSession that targets a scheduled task process
# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
Function New-ScheduledTaskSession {
<#
.SYNOPSIS
Creates a PSSession for a process running as a scheduled task.
.DESCRIPTION
Creates a PSSession that can be used to run code inside a scheduled task
@Dump-GUY
Dump-GUY / hint_calls.py
Created March 18, 2024 07:30
Modified version of Willi Ballenthin IDA Plugin hint_calls.py ported to support Python2/3 and IDA>=7.4 (tested IDA 7.7, 8.4)
'''
IDA plugin to display the calls and strings referenced by a function as hints.
Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <[email protected]>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils
@mr00k3
mr00k3 / nh
Created March 12, 2024 03:31
NetHunter Terminal Issues fixes
chroot /data/local/nhsystem/kalifs no such file or directory
type this in androidsu terminal "ln -s /data/local/nhsystem/kali-arm64 /data/local/nhsystem/kalifs"
Terminal says it doesnt have needed permissions
uninstall it with any root uninstaller and install again
@daniruiz
daniruiz / ld_library_path_exploit.sh
Last active November 3, 2024 15:38
Script that automatically generates malicious library and exploits binary through LD_LIBRARY_PATH Hijacking. The script generates the list of missing symbols, based on the specified library, and creates the version-script map file to avoid error messages when loading the new created malicious library.
#!/bin/sh
# ./ld_path_exploit.sh /usr/lib/libgpg-error.so.0 top
TARGET_LIB=$1
MISSING_SYMBOLS="$(readelf -s --wide ${TARGET_LIB} \
| grep 'FUNC\|OBJECT' \
| grep -v 'UND\|ABS' \
| awk '{print $8}' \
@WKL-Sec
WKL-Sec / DLL_Sideloading_Protection_Example.cpp
Created January 17, 2024 17:00
This C++ code example is part of the White Knight Labs Offensive Development Course materials. A straightforward C++ code snippet demonstrating how to prevent DLL sideloading by validating the calling executable. It uses a whitelist approach to ensure only specified executables can load the DLL.
#include <windows.h>
#include <string>
#include <vector>
#include <algorithm>
// White Knight Labs - Offensive Development Course
// DLL Guardrails Example
// This function extracts the file name from a given path
// It is used later to determine the executable name loading the DLL.
@odzhan
odzhan / rdp_pack.cpp
Last active December 4, 2024 03:15
Compression using RDP API
/**
Compression using undocumented API in rdpbase.dll
RDPCompressEx supports four algorithms : MPPC-8K, MPPC-64K, NCRUSH and XCRUSH.
This code supports all except NCRUSH.
The MPPC compression ratio is very similar to LZSS, so this could be quite useful for shellcode trying to evade detection.
NCRUSH compression appears to work but fails for decompression.
@laixintao
laixintao / decent_request.py
Last active January 18, 2025 08:12
Send HTTP requests using python-requests with timeout, tcp reuse(session) and retry.
from requests.adapters import HTTPAdapter, Retry
from requests import Session
retries = Retry(
total=5, backoff_factor=1, status_forcelist=[502, 503, 504]
)
session = Session() # reuse tcp connection
session.mount("http://", HTTPAdapter(max_retries=retries))
session.mount("https://", HTTPAdapter(max_retries=retries))
@testanull
testanull / SharePwn_public.py
Created December 15, 2023 07:31
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC
# -*- coding: utf-8 -*-
import hashlib
import base64
import requests, string, struct, uuid, random, re
import sys
from collections import OrderedDict
from sys import version
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
# too lazy to deal with string <-> bytes confusion in python3 so forget it ¯\_(ツ)_/¯