Skip to content

Instantly share code, notes, and snippets.

@truekonrads
truekonrads / webrce.py
Created February 13, 2014 21:58
Web RCE helper
#!/usr/bin/env python
import cmd,urllib2, argparse,urlparse,re,urllib,binascii
DEFAULT_SPLIT=256 # AIX max len is 4k, so we're just shy
def debug(text):
global args
if args.debug:
print "[DD] " + text
class WebRCE(object):
def __init__(self):
@truekonrads
truekonrads / brutetftp.py
Created June 27, 2014 21:23
udpchecksumbrute.py
#!/usr/bin/env python
# Solution to DRG Challenge at FIRSTCON 2014
# Two bytes from a UDP packet NUL'ed, need to find them so that checksum matches
import sys
from timeit import timeit
from scapy.all import *
pref="\x00\x03\x00\x01XtG8hI"
targetchecksum=0x808c
#targetchecksum=0x8549
#targetchecksum=0x8555
@truekonrads
truekonrads / whatobj.py
Last active August 29, 2015 14:03
whatobj.py
### THE AMAZING OBJECT IDENTIFIER #####
# By Konrads Smelkovs <[email protected]>
# Math.cos(1);
# x=document.createElement("div")
# Math.atan2(1,"Allocated div");
# x.className="foo";
# Math.sin(1);
# Math.atan(1);
#
#
@truekonrads
truekonrads / gnmap-to-http-urls.pl
Created August 5, 2014 12:31
Get http(s) from gnamp and spit out urls
#!/usr/bin/perl -w
# Copyright 2014 Konrads Smelkovs <[email protected]>
#$ cat shooturl.sh
# #!/bin/bash
# /usr/local/bin/CutyCapt --insecure --url=$1 --out=`echo $1|tr '/:' '__'`.png
# Usage: gnmap-to-http-urls.pl scan.gnmap | xargs -P 5 -n 1 --verbose ./shooturl.sh
while (<>) {
next unless m!\d+/open/!;
@truekonrads
truekonrads / getbulknessus.py
Last active December 6, 2023 23:16
Dump all nessus files as csv from a select folder
#!/usr/bin/env python
# by Konrads Smelkovs <[email protected]>
# Cool contributions by sash
# Licence - CC-BY, else do whatever you want with this
import urllib2
import json
import time
import sys
import argparse
@truekonrads
truekonrads / ssh-sftp-and-exec.py
Last active July 13, 2018 03:21
SSH and SFTP within same connection
#!/usr/bin/env python
# While doing IR, we found a log entry which suggested that sftp was open, file was uploaded, but we
# couldn't figure out how it was executed as there wasn't a second login attempt to start the script
# This script explains it.
# Feb 3 15:30:17 kali sshd[5222]: Accepted password for joe from 192.168.61.1 port 28568 ssh2
# Feb 3 15:30:17 kali sshd[5222]: pam_unix(sshd:session): session opened for user joe by (uid=0)
# Feb 3 15:30:17 kali sshd[5227]: subsystem request for sftp by user joe
# Feb 3 15:30:20 kali sshd[5222]: pam_unix(sshd:session): session closed for user joe

Keybase proof

I hereby claim:

  • I am truekonrads on github.
  • I am truekonrads (https://keybase.io/truekonrads) on keybase.
  • I have a public key whose fingerprint is 65EF 5B2A 1F2F 012D 9466 A688 1ED2 3A6F 1125 49FF

To claim this, I am signing this object:

@truekonrads
truekonrads / nettcpsprobe.py
Last active August 29, 2015 14:24
net.tcp prober
import socket,struct,sys
if len(sys.argv)<3:
print "Usage %s <host> <port> [Service]" % sys.argv[0]
exit(-1)
DEBUG=0
if len(sys.argv)==4:
svcname=sys.argv[3]
else:
svcname="service-probe:8080/nonexistant"
svcname="net.tcp://"+svcname

Keybase proof

I hereby claim:

  • I am truekonrads on github.
  • I am truekonrads (https://keybase.io/truekonrads) on keybase.
  • I have a public key whose fingerprint is 8573 98C7 B61D 7FB8 68CB 93B5 B834 2F98 CD32 71C9

To claim this, I am signing this object:

@truekonrads
truekonrads / fortinetips.py
Created August 4, 2015 18:54
Extract interface IPs from a directory full of fortinet configs
#!/usr/bin/python
# Extract known ranges from Fortinet configs and present them as CSV
import os,csv,sys,re,ipaddress
csvwriter=csv.DictWriter(sys.stdout,"filename name vdom ip mask cidr".split(" "))
if len(sys.argv)<2:
print "Usage %s <directory>" % sys.argv[0]
sys.exit(-1)
csvwriter.writeheader()
for root, dirs, files in os.walk(sys.argv[1]):