Skip to content

Instantly share code, notes, and snippets.

View FrankSpierings's full-sized avatar

Frank Spierings FrankSpierings

47 followers · 1 following
View GitHub Profile
@FrankSpierings
FrankSpierings / brute.ps1
Last active April 29, 2024 14:28
Powershell - Brute force procedure
$charset = @()
$charset += ([char]'0'..[char]'9') |% {[char]$_}
$charset += ([char]'a'..[char]'z') |% {[char]$_}
$charset += ([char]'A'..[char]'Z') |% {[char]$_}
$charset = $charset | Select-Object -uniq
function Get-NextPassword() {
param(
$Password
)
@FrankSpierings
FrankSpierings / Readme.md
Last active March 18, 2024 19:31
Angr on a static stripped binary

Project

  • This is to demonstrate how to work with angr on a static/stripped binary

Source

  • Source angrtest.c
#include <stdio.h>
@FrankSpierings
FrankSpierings / pretty_print_ntlm_impacket.py
Created February 12, 2024 06:54
Impacket - Print NTLM packets in JSON format for further analysis
import datetime
import json
from impacket.structure import Structure
from enum import Flag, Enum
class NegotiateFlags(Flag):
NTLMSSP_NEGOTIATE_56 = 0x80000000
NTLMSSP_NEGOTIATE_KEY_EXCH = 0x40000000
NTLMSSP_NEGOTIATE_128 = 0x20000000
@FrankSpierings
FrankSpierings / http-ntlm.py
Created February 4, 2024 06:36
Request website using NTLM (can do pass-the-hash if you change getNTLMSSPType3)
from impacket.ntlm import getNTLMSSPType1, getNTLMSSPType3
import requests
import base64
# Replace these values with your IIS server details
target_url = "http://localhost"
username = "username"
password = "password"
domain = ''
@FrankSpierings
FrankSpierings / mitmproxy-http-ntlm.py
Created February 4, 2024 08:28
Mitmproxy script to authenticate NTLM
from mitmproxy import http, ctx
from impacket.ntlm import getNTLMSSPType1, getNTLMSSPType3
import requests
import logging
import base64
username = "username"
password = "password"
domain = ''
@FrankSpierings
FrankSpierings / README.MD
Last active February 5, 2024 15:25
Apple Device Enrollment Program (DEP) - ByPass MDM Policy using Checkra1n exploit

Pre-requirements

  • Install a socket daemon to multiplex connections from and to iOS devices, run: brew install usbmuxd
  • Start the socket daemon iproxy 2222 44
  • Install checkra1n exploit locally, run: brew install checkra1n
  • When SSH password authentication is requested, use: alpline.

Wipe iPad and restore Firmware

@FrankSpierings
FrankSpierings / frida-hook-generator.py
Last active January 20, 2024 21:54
Generate Frida hooks based on c header files using pyclibrary
from pyclibrary import CParser
import re
hook_template = '''
(function() {
var name = '__NAME__';
var address = Module.findExportByName(null, name);
if (address != null) {
console.log('[!] Hooking: ' + name + ' @ 0x' + address.toString(16));
@FrankSpierings
FrankSpierings / README.md
Last active January 20, 2024 20:45
Linux Container Escapes and Hardening
@FrankSpierings
FrankSpierings / openssl-frida.js
Last active December 7, 2023 10:58
Some OpenSSL hooks in Frida - Work in progress....
const utils = {
colors: {
red: function(string) {
return '\x1b[31m' + string + '\x1b[0m';
},
green: function(string) {
return '\x1b[32m' + string + '\x1b[0m';
},
@FrankSpierings
FrankSpierings / deploy-applocker.ps1
Last active November 9, 2023 13:05
AppLocker On Windows 10 Pro
# Requires system privileges!
# Thank you: https://github.com/sandytsang/MSIntune/blob/master/Intune-PowerShell/AppLocker/Delete-AppLockerEXE.ps1
$path = "<PATH TO APPLOCKER XML'S>"
$xmls = (ls -filter '*.xml' $path |% {$_.FullName})
$Appx, $Dll, $Exe, $Msi, $Script = $null
$xmls |% {