lokori’s gists

lokori / mandros.py

Created January 14, 2019 07:04 — forked from xassiz/mandros.py

Reverse MSSQL shell

	import sys
	import requests
	import threading
	import HTMLParser
	from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

	'''
	Description: Reverse MSSQL shell through xp_cmdshell + certutil for exfiltration
	Author: @xassiz
	'''

lokori / .bash_profile

Created October 17, 2018 18:26

The good prompt from the bash profile. Line wrapping issues. Needs git-complete. Nice prompt

	# start at home
	cd ~

	ln -sfv /usr/local/opt/redis/*.plist ~/Library/LaunchAgents


	ln -sfv /usr/local/opt/mysql56/*.plist ~/Library/LaunchAgents

	export PATH=./node_modules/.bin:$PATH

lokori / getdomains.sh

Last active September 17, 2018 11:00 — forked from woltage/getdomains.sh

Skripti joka hakee Y-tunnuksella kaikki firman omistamat .fi -verkkotunnukset. (alkuperäinen https://gist.github.com/woltage/5b7a744f9562b9348c90c6e0d038d92a)

	#!/bin/bash

	## Y-Tunnukseen perustuva domainejen haku (.fi)

	## Esimerkki: getdomains 1093944-1 # MTV Oy
	# Laita tämä .bashrc tai .zshrc

	# Käyttöesimerkkejä:

	# Looppaa Y-tunnuksetn kaikki domainit läpi ja tee kysely

lokori / curl_mass_uploader.sh

Created April 24, 2018 05:35

Mass file upload with curl. This is for a specific application, but can be adapted for others.

	#!/bin/bash

	upload_file () {
	SESSION=df831243-602e-4c27-8afe-09a6760be8ad
	XSRF=83872690-237b-c176-8830-ac11ba76d7b3
	URL="http://192.168.50.1:8080/api/UPLOOOD"
	echo "Handling file $1"
	curl -v -i -X POST -H "Content-Type: multipart/form-data" -H "Cookie: ring-session=$SESSION; XSRF-TOKEN=$XSRF" -F "file=@$1;type=application/vnd.openxmlformats-officedocument.s\
	preadsheetml.sheet" -F "x-xsrf-token=$XSRF" $URL >> logifile.txt 2>&1
	echo "-----------------------" >> logifile.txt

lokori / supergobuster.sh

Last active July 1, 2022 20:29

gobuster enumerator for hack-the-box machines. This generates huge amount of useless requests..

	#!/bin/bash
	set -eu

	URL=$1

	echo "super go bustering for super brute: $URL"

	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/tomcat.txt
	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/nginx.txt
	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/apache.txt

lokori / htb-enum.sh

Last active January 15, 2020 22:09

Boring Hack The Box enumerator. Generates many useless and boring requests.

	#!/bin/bash

	set -eu

	echo "Running super enum against $1"

	# quick scan TCP
	# nmap -v -sC -sV -oA initial_nmap $1

	# quick scan UDP

lokori / tirsk-spoofing.php

Created February 27, 2018 12:35

harmless example for dns spoofing

	<?php
	/*
	This file can be useful in conjunction with DNSSpoof
	*/
	?>

	<html>
	<body>

	<audio class="my_audio" preload="none" id = "saundi">

lokori / writeup-for-reaktor-CTF

Created January 14, 2018 12:06

Reaktor Java app challenge from Disobey 2018 CTF

	Reaktor's Java application CTF challenge from Disobey 2018

	It seems I was not the only one struggling with the Java application challenge. There was
	JAR file and that's how it began.

	After decompiling the JAR the main class contained code which didn't do anything. It looks like this:

	String encryptedResult = "[3, 63, -54, -8, -45, -89, -91, 40, -111, -77, -76, -49, 119, 8, -46, 9, -70, 99, -12, 3, 124, 65, -66, 104, -18, 4, 64, 87, 6, -72, 68, 121, -32, -52, -104, 25, -54, 71, -84, -128, -35, -115, -74, -26, -30, -127, -96, -42]";
	String result = (String) null;
	String url = (String) null;

lokori / website-terminal-copy-paste.html

Created December 17, 2017 16:14 — forked from rmetzler/website-terminal-copy-paste.html

DO NOT COPY FROM WEBSITES - http://thejh.net/misc/website-terminal-copy-paste

	<!DOCTYPE html>
	<html>
	<head>
	<title>Copy-Paste from Website to Terminal</title>
	</head>
	<style>
	.codeblock {
	background-color: lightyellow;
	border: 1px dotted blue;
	margin-left: 50px;

lokori / VeryInsecureHTTPSJava.java

Created December 13, 2017 19:36

	import javax.net.ssl.*;
	import java.security.GeneralSecurityException;

	/**
	* Vain kehityskäyttöön. Mahdollistaa https://localhost yhteydet ohittamalla Javan SSL turvamekanismit.
	* <p>
	* <ul>
	* <li>http://stackoverflow.com/questions/2893819/telling-java-to-accept-self-signed-ssl-certificate</li>
	* <li>http://stackoverflow.com/questions/859111/how-do-i-accept-a-self-signed-certificate-with-a-java-httpsurlconnection</li>
	* <li>http://stackoverflow.com/questions/2290570/pkix-path-building-failed-while-making-ssl-connection</li>

Antti Virtanen lokori