Skip to content

Instantly share code, notes, and snippets.

View DiabloHorn's full-sized avatar

DiabloHorn DiabloHorn

168 followers · 0 following
View GitHub Profile
@DiabloHorn
DiabloHorn / poc_client.py
Created April 9, 2017 21:09
Client part of IP whitelist bypass POC
#!/usr/bin/env python
"""
DiabloHorn - https://diablohorn.com
POC client on 'infected' machines to receive injected packets
intended to bypass IP whitelisting
"""
import sys
import time
import socket
from threading import Thread
@DiabloHorn
DiabloHorn / xprotect-brute-js.user.js
Created August 14, 2017 23:37
// ==UserScript==
// @name xprotect-brute-js
// @namespace ns-xprotect-brute-js
// @description Brute force Milestone XProtect Web Client
// @include http://localhost:8081/index.html
// @version 1
// @grant none
// ==/UserScript==
//DiabloHorn - https://diablohorn.com
var foundcreds = 0;
@DiabloHorn
DiabloHorn / Makefile.target
Created December 12, 2017 19:12
Reference files to expose a QEMU guest memory
# -*- Mode: makefile -*-
BUILD_DIR?=$(CURDIR)/..
include ../config-host.mak
include config-target.mak
include config-devices.mak
include $(SRC_PATH)/rules.mak
$(call set-vpath, $(SRC_PATH):$(BUILD_DIR))
@DiabloHorn
DiabloHorn / file_processor.py
Created January 16, 2018 01:09
#!/usr/bin/env python
#DiabloHorn - https://diablohorn.com
import sys
import os
import csv
import argparse
import shutil
try:
import magic
@DiabloHorn
DiabloHorn / ChangePassword.java
Created January 23, 2018 00:18 — forked from zach-klippenstein/ChangePassword.java
The keystore password on Java keystore files is utterly pointless. You can reset it without knowing it, as shown by this code. Note that private keys are still secure, as far as I know. The JKS implementation is copyright Casey Marshall (rsdio@metastatic.org), and the original source is available at http://metastatic.org/source/JKS.java. I've in…
import java.util.*;
import java.io.*;
import java.security.*;
public class ChangePassword
{
private final static JKS j = new JKS();
public static void main(String[] args) throws Exception
{
@DiabloHorn
DiabloHorn / whitelist_finder.py
Created February 18, 2018 15:26
Identify whitelisted IP addresses using spoofing techniques in conjunction with arp poisoning
#!/usr/bin/env python
#DiabloHorn - https://diablohorn.com
#Find whitelisted IP addresses on a network & application level
import sys
import logging
import threading
import argparse
from scapy.all import *
@DiabloHorn
DiabloHorn / gdb-session.fish
Created April 23, 2019 23:22 — forked from logc/gdb-session.fish
How to add a new structure to a GDB session
❯ gcc -g minimal.c -o minimal
❯ sudo gdb minimal
Password:
(gdb) break main
Breakpoint 1 at 0x100000f90: file minimal.c, line 3.
(gdb) run
Starting program: /private/tmp/c-repl/minimal
@DiabloHorn
DiabloHorn / ManualPayloadGenerate.java
Created September 9, 2017 18:46
Java class to generate a Groovy serialized payload
/*
DiabloHorn - https://diablohorn.com
For learning purposes we build the groovy payload ourselves instead of using
ysoserial. This helps us better understand the chain and the mechanisms
involved in exploiting this bug.
compile with:
javac -cp <path to groovy lib> ManualPayloadGenerate.java
Example:
javac -cp DeserLab/DeserLab-v1.0/lib/groovy-all-2.3.9.jar ManualPayloadGenerate.java
@DiabloHorn
DiabloHorn / deserlab_exploit.py
Created September 9, 2017 18:37
Exploit for the DeserLab vulnerable implementation
#!/usr/bin/env python
"""
DiabloHorn - https://diablohorn.com
References
https://nickbloor.co.uk/2017/08/13/attacking-java-deserialization/
https://deadcode.me/blog/2016/09/02/Blind-Java-Deserialization-Commons-Gadgets.html
https://deadcode.me/blog/2016/09/18/Blind-Java-Deserialization-Part-II.html
http://gursevkalra.blogspot.nl/2016/01/ysoserial-commonscollections1-exploit.html
https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
https://www.slideshare.net/codewhitesec/exploiting-deserialization-vulnerabilities-in-java-54707478
@DiabloHorn
DiabloHorn / pe-aware-split.py
Created November 12, 2017 17:47
Split file while preserving PE format
#!/usr/bin/env python
# DiabloHorn https://diablohorn.com
# blank out bytes taking into account the PE file format
# input file: base64 malware.exe | rev > enc.txt
import sys
import os
#pip install pefile
import pefile
import argparse
import logging