midnite_runr secretsquirrel

💭

👨‍💻 New updates to BDF-ng

I laugh in the general direction of security products.

secretsquirrel / vm_base_processes_after_boot_10.10.txt

Created February 5, 2015 16:45

ist of processes after boot on OS X Yosemite VM

	UID PID TTY TIME CMD
	0 1 ?? 0:01.72 /sbin/launchd
	0 19 ?? 0:00.30 /usr/sbin/syslogd
	0 20 ?? 0:00.37 /usr/libexec/UserEventAgent (System)
	0 22 ?? 0:00.38 /usr/libexec/kextd
	0 23 ?? 0:00.97 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/Support/fseventsd
	0 25 ?? 0:00.03 /usr/libexec/thermald
	0 28 ?? 0:00.30 /usr/libexec/configd
	0 29 ?? 0:00.09 /System/Library/CoreServices/powerd.bundle/powerd
	0 32 ?? 0:00.04 /usr/libexec/airportd

secretsquirrel / vm_base_processes_after_boot_10.9.txt

Created February 5, 2015 16:41

List of processes after boot on OS X Mavericks VM

	UID PID TTY TIME CMD
	0 1 ?? 0:00.56 /sbin/launchd
	0 11 ?? 0:00.35 /usr/libexec/UserEventAgent (System)
	0 12 ?? 0:00.76 /usr/libexec/kextd
	0 13 ?? 0:00.46 /usr/libexec/taskgated -s
	0 14 ?? 0:00.31 /usr/sbin/notifyd
	0 15 ?? 0:00.29 /usr/sbin/securityd -i
	0 16 ?? 0:00.09 /usr/libexec/diskarbitrationd
	0 17 ?? 0:00.47 /usr/libexec/configd
	0 18 ?? 0:00.13 /System/Library/CoreServices/powerd.bundle/powerd

secretsquirrel / automate_vmfusion_binary_patching.py

Created February 5, 2015 14:31

Script to automate the patching of binaries on OS X using vmfusion, python, vmrun, and BDF. Tail the log for additional output.

	#!/user/bin/python
	import os
	import socket
	import logging
	import time

	#edit the paths below with your username. this script was not build for public useage.
	#given a list of paths
	#path each of these then launch a port to listen for a connection

secretsquirrel / automate_patch_testing.py

Created February 5, 2015 14:09

Script to automate the patching of binaries on OS X for testing purposes (Normal reverse tcp payload)

	!/usr/bin/env python

	import sys
	import os
	import shutil
	import time

	if os.uname()[1] == 'MyHostName': # Change This to YOUR MASTER HOSTNAME
	print 'NOPE NOPE NOPE'
	sys.exit()

secretsquirrel / beaconing_automate_testing.py

Created February 5, 2015 14:08

Script to automate the patching of binaries on OS X for testing purposes (beaconing reverse tcp payload)

	#!/usr/bin/env python

	import sys
	import os
	import shutil
	import time

	if os.uname()[1] == 'HostName': # Change This TO YOUR MASTER HOST
	print 'NOPE NOPE NOPE'
	sys.exit()

secretsquirrel / osx_infector.py

Last active March 31, 2021 19:33

From Shmoocon infection demo

	import os
	import struct
	import shutil
	import subprocess


	class macho_intel32_shellcode():
	"""
	Mach-O Intel x32 shellcode class
	"""

secretsquirrel / gist:9416182

Created March 7, 2014 17:40

keybase id

	### Keybase proof

	I hereby claim:

	* I am secretsquirrel on github.
	* I am jp (https://keybase.io/jp) on keybase.
	* I have a public key whose fingerprint is 5039 053E F583 0C25 08E3 F343 BBA7 0B6A 10B5 F675

	To claim this, I am signing this object:

secretsquirrel / injecty.py

Last active August 29, 2015 13:56

Injecty | Speed Reading