Skip to content

Instantly share code, notes, and snippets.

@sh4dowb
sh4dowb / catch_all.txt
Created January 15, 2022 19:32
catch-all mail server installation on ubuntu
# redirect MX record to your server ip
apt install postfix
adduser myuser # necessary - you cannot login as root on dovecot imap
# add user
nano /etc/postfix/virtual
# @example.com myuser
# [email protected] info # optional
@sh4dowb
sh4dowb / ethereum-rpc-proxy.py
Last active March 1, 2025 15:38
ethereum rpc proxy, to be used as "cheap light node"
import http.server
import requests
import json
class Proxy(http.server.BaseHTTPRequestHandler):
def do_POST(self):
data = self.rfile.read(int(self.headers['Content-Length'])).decode('utf-8')
decodedData = json.loads(data)
newheaders = {}
for k, v in self.headers.items():
@sh4dowb
sh4dowb / phpkoru-deobfuscate-2.php
Last active October 12, 2024 17:14
PHPkoru.com v1.0.6 (new) deobfuscator. Make sure to run it isolated, to prevent any attacks from eval'd code
<?php
// V1.0.7 DEOBFUSCATOR: https://gist.github.com/sh4dowb/68c9e090a3006b1d19ce49a22529c0a5
// put encrypted code in encrypted.php, or use it like:
// $ php phpkoru-deobfuscate-2.php encryptedfilename.php
// for decrypting advanced version contact me on telegram
function decrypt($fn, $try=0){
$onfr64_qrpbqr = 'base64_decode';
@sh4dowb
sh4dowb / unmarshal-ruby-date.py
Created May 15, 2023 18:09
decode/unmarshal Ruby Date in python
from datetime import date, timedelta
from rubymarshal.classes import UsrMarshal
from rubymarshal.reader import loads
data = b'\x04\x08U:\tDate[\x0bi\x00i\x03\xe5R%i\x00i\x00i\x00f\x0c2299161'
# 1984-12-18
data = loads(data)
if isinstance(data, UsrMarshal):
# data._private_data[1] is days since Julian Day (November 24, 4714 BC)
data = (date(1900, 1, 1) + timedelta(days=data._private_data[1] - 2415021)).strftime('%Y-%m-%d')
@sh4dowb
sh4dowb / phpkoru-deobfuscate-3.php
Last active February 19, 2024 21:14
PHPkoru.com v1.0.7 deobfuscator. Make sure to run it isolated, to prevent any attacks from eval'd code
<?php
// put encrypted code in encrypted.php, or use it like:
// $ php phpkoru-deobfuscate-3.php encryptedfilename.php
// UPDATED v1.0.7 , if you are getting error "IV passed is only 15 bytes long", try this
// for decrypting advanced (.dll/.so) version contact me on telegram
function trydecrypt($fn, $b64='fge_ebg13‎‎‎‎', $rot13='bcraffy_qrpelcg‎'){
eval('$'.$b64.'="base64_decode";');
eval('$'.$rot13.'="str_rot13";');
@sh4dowb
sh4dowb / solana_subscribe.py
Created January 29, 2025 17:53
solana websocket subscribe to transactions & all token transfers of address
from websockets.sync.client import connect
import json
addresses = [] # base58 address/account/pubkey list
with connect('wss://solana-rpc.publicnode.com') as ws:
i = 0
for address in addresses:
i += 1
msg = json.dumps({"jsonrpc": "2.0", "id": i, "method": "logsSubscribe", "params": [{"mentions": [address]}, {"commitment": "finalized"}]})
# subscribes to solana transactions. token transfers will mention the associated token addresses instead of owner address, so it's not picked up by this filter
@sh4dowb
sh4dowb / verify_crx_contents.py
Created April 11, 2025 02:06
verify chrome extension files with verified_contents.json in python
import json
import base64
import hashlib
import zipfile
import sys
BRANCH_FACTOR = 128
BLOCK_SIZE = 4096
DIGEST_SIZE = 32