skelsec

"""
Yet again I have to test webapps in a restricted envrionment with no internet access.
This script will download all avilable BAPPs from the Burp BAPP store so you can install them offline.
It also creates a small info.txt file that matches the app names to the actual file names.
"""

import requests
import re
from tqdm import tqdm

skelsec

from Cryptodome.Cipher import AES
from Cryptodome.Random import get_random_bytes
from pypykatz.commons.common import hexdump

data = b"secret"*10
key = b'\xAA'*16
iv = b'\xAA'*16
cipher = AES.new(key, AES.MODE_CFB, iv=iv)
ct_bytes = cipher.encrypt(data)

skelsec

from Cryptodome.Cipher import AES
from Cryptodome.Random import get_random_bytes
from pypykatz.commons.common import hexdump

data = b"secret"
key = b'\xAA'*16
iv = b'\xAA'*16
cipher = AES.new(key, AES.MODE_CFB, iv=iv)
ct_bytes = cipher.encrypt(data)

skelsec

from Cryptodome.Cipher import AES
from Cryptodome.Random import get_random_bytes
from pypykatz.commons.common import hexdump

data = b"secret"
key = b'\xAA'*16
iv = b'\xAA'*16
cipher = AES.new(key, AES.MODE_CFB, iv=iv)
ct_bytes = cipher.encrypt(data)

skelsec

# this will onyl work with pyodide version 0.19 (and probably above)
#you'll need emscripten environment set up 
#get openssl-1.1.1m (this is the latest as of writing)
# run configure with these flags
emconfigure ./Configure -no-asm no-comp no-hw no-engine no-deprecated shared no-dso no-threads linux-generic64
# now remove the cross compil bin path from the makefile because it gets duplicated for some reason
sed -i 's|^CROSS_COMPILE.*$|CROSS_COMPILE=|g' Makefile
# make it, it will crash when compiling the tests
emmake make
# ignore errors, no test will be done, remove libcrypto and libssl files

skelsec

#!/bin/bash
# this file was created using data from multiple different sources including:
# https://github.com/ckuethe/usbarmory/wiki/USB-Gadgets
# https://github.com/RoganDawes/P4wnP1_aloa
# https://github.com/RoganDawes/P4wnP1
# https://git.gir.st/sendHID.git
# https://git.gir.st/hardpass.git/blob/HEAD:/init_usb.sh
# http://www.isticktoit.net/?p=1383
# 

skelsec

CmZ1bmN0aW9uIEludm9rZS1CbG9vZEhvdW5kewogICAgPCMKICAgIC5TWU5PUFNJUwoKICAgICAgICBSdW5zIHRoZSBCbG9vZEhvdW5kIEMjIEluZ2VzdG9yIHVzaW5nIHJlZmxlY3Rpb24uIFRoZSBhc3NlbWJseSBpcyBzdG9yZWQgaW4gdGhpcyBmaWxlLgoKICAgIC5ERVNDUklQVElPTgoKICAgICAgICBVc2luZyByZWZsZWN0aW9uIGFuZCBhc3NlbWJseS5sb2FkLCBsb2FkIHRoZSBjb21waWxlZCBCbG9vZEhvdW5kIEMjIGluZ2VzdG9yIGludG8gbWVtb3J5CiAgICAgICAgYW5kIHJ1biBpdCB3aXRob3V0IHRvdWNoaW5nIGRpc2suIFBhcmFtZXRlcnMgYXJlIGNvbnZlcnRlZCB0byB0aGUgZXF1aXZhbGVudCBDTEkgYXJndW1lbnRzCiAgICAgICAgZm9yIHRoZSBTaGFycEhvdW5kIGV4ZWN1dGFibGUgYW5kIHBhc3NlZCBpbiB2aWEgcmVmbGVjdGlvbi4gVGhlIGFwcHJvcHJpYXRlIGZ1bmN0aW9uCiAgICAgICAgY2FsbHMgYXJlIG1hZGUgaW4gb3JkZXIgdG8gZW5zdXJlIHRoYXQgYXNzZW1ibHkgZGVwZW5kZW5jaWVzIGFyZSBsb2FkZWQgcHJvcGVybHkuCgogICAgLlBBUkFNRVRFUiBDb2xsZWN0aW9uTWV0aG9kCgogICAgICAgIFNwZWNpZmllcyB0aGUgQ29sbGVjdGlvbk1ldGhvZCBiZWluZyB1c2VkLiBQb3NzaWJsZSB2YWx1ZSBhcmU6CiAgICAgICAgICAgIEdyb3VwIC0gQ29sbGVjdCBncm91cCBtZW1iZXJzaGlwIGluZm9ybWF0aW9uCiAgICAgICAgICAgIExvY2FsR3JvdXAgLSBDb2xsZWN0IGxvY2FsIGdyb3VwIGluZm9ybWF0aW9uIGZvciBj

skelsec

#
# Command-line interface to extract well-known secrets from registry hives 
# using MemProcFS's registry API
#
#
# IMPORTANT: use the !latest! AIOWinreg version (0.0.2) from pip or github
#
# Author: Tamas Jos @skelsec

skelsec

# -*- coding: UTF-8 -*-
# All credits go to: https://github.com/joren485/PyWinPrivEsc/blob/master/RunAsSystem.py
from ctypes.wintypes import *
from ctypes import *
from enum import IntEnum

# These libraries have the APIs we need
kernel32 = WinDLL('kernel32',  use_last_error=True)
advapi32 = WinDLL('advapi32',  use_last_error=True)
psapi    = WinDLL('psapi.dll', use_last_error=True)

skelsec

##Domain

We need some records on our domain (mydomain.com) DNS for connections. Add these records:

t1              IN      NS      t1ns.mydomain.com. ; note final the dot!
t1ns            IN      A       OUR_SERVER_IP

##Server