DiabloHorn

/*
    DiabloHorn - https://diablohorn.com
    For learning purposes we build the groovy payload ourselves instead of using
    ysoserial. This helps us better understand the chain and the mechanisms
    involved in exploiting this bug.
    
    compile with:
        javac -cp <path to groovy lib> ManualPayloadGenerate.java
    Example:
        javac -cp DeserLab/DeserLab-v1.0/lib/groovy-all-2.3.9.jar ManualPayloadGenerate.java

DiabloHorn

❯ gcc -g minimal.c -o minimal

❯ sudo gdb minimal
Password:

(gdb) break main
Breakpoint 1 at 0x100000f90: file minimal.c, line 3.
(gdb) run
Starting program: /private/tmp/c-repl/minimal

DiabloHorn

#!/usr/bin/env python
#DiabloHorn - https://diablohorn.com
#Find whitelisted IP addresses on a network & application level
import sys
import logging
import threading
import argparse

from scapy.all import *

DiabloHorn

import java.util.*;
import java.io.*;
import java.security.*;

public class ChangePassword
{
  private final static JKS j = new JKS();

  public static void main(String[] args) throws Exception
  {

DiabloHorn

#!/usr/bin/env python
#DiabloHorn - https://diablohorn.com
import sys
import os
import csv
import argparse
import shutil

try:
    import magic

DiabloHorn

# -*- Mode: makefile -*-

BUILD_DIR?=$(CURDIR)/..

include ../config-host.mak
include config-target.mak
include config-devices.mak
include $(SRC_PATH)/rules.mak

$(call set-vpath, $(SRC_PATH):$(BUILD_DIR))

DiabloHorn

// ==UserScript==
// @name        xprotect-brute-js
// @namespace   ns-xprotect-brute-js
// @description Brute force Milestone XProtect Web Client
// @include     http://localhost:8081/index.html
// @version     1
// @grant       none
// ==/UserScript==
//DiabloHorn - https://diablohorn.com
var foundcreds = 0;

DiabloHorn

#!/usr/bin/env python
"""
    DiabloHorn - https://diablohorn.com
    POC client on 'infected' machines to receive injected packets
    intended to bypass IP whitelisting
"""
import sys
import time
import socket
from threading import Thread