Skip to content

Instantly share code, notes, and snippets.

@HashtagMarkus
HashtagMarkus / msfvenom-reverse-tcp-WaitForSingleObject.md
Created November 30, 2020 00:10 — forked from mgeeky/msfvenom-reverse-tcp-WaitForSingleObject.md
(OSCE/CTP, Module #3: Backdooring PE Files) Document explaining how to locate WaitForSingleObject(..., INFINITE) within msfvenom's (4.12.23-dev) generated payload and how to fix the payload's glitches.

Looking for WaitForSingleObject call within modern msfvenom generated payload.


Abstract

This is a document explaining how to locate WaitForSingleObject(..., INFINITE) within msfvenom's (4.12.23-dev) generated payload and how to fix the payload's glitches. It goes through the analysis of a windows/shell_reverse_tcp payload, touching issues like stack alignment, WaitForSingleObject locating & patching. It has been written when I realised there are many topics on the Offensive-Security OSCE/CTP forums touching problem of finding this particular Windows API. Since RE is one of my stronger FU's I decided to write down my explanation of the subject.

Contents:

Keybase proof

I hereby claim:

  • I am hashtagmarkus on github.

  • I am hashtagmarkus (https://keybase.io/hashtagmarkus) on keybase.

  • I have a public key ASDECDbRMdCEIf8Ko1W3Bz2XXfGG5jiBkRXWVS8UdgFq8Ao

unzip titan-1.0.0-hadoop1.zip
# for vertices core
mkdir solr-5.3.1/server/solr/configsets/vertices
mkdir solr-5.3.1/server/solr/configsets/vertices/conf
cp -r titan-1.0.0-hadoop1/conf/solr/* solr-5.3.1/server/solr/configsets/vertices/conf
# for edges core
mkdir solr-5.3.1/server/solr/configsets/edges
mkdir solr-5.3.1/server/solr/configsets/edges/conf
cp -r titan-1.0.0-hadoop1/conf/solr/* solr-5.3.1/server/solr/configsets/edges/conf
cqlsh> use titan;
cqlsh:titan> desc tables;
titan_ids edgestore system_properties_lock_
edgestore_lock_ graphindex_lock_ graphindex
txlog systemlog system_properties
@HashtagMarkus
HashtagMarkus / titan-cassandra-solr.properties
Last active February 11, 2016 18:56
titan cassandra solr configuration file
storage.hostname=127.0.0.1
...
index.search.backend=solr
index.search.solr.mode=http
index.search.solr.http-urls=http://localhost:8983/solr
@HashtagMarkus
HashtagMarkus / TitanGraphOfTheGods.groovy
Last active February 11, 2016 19:01
Example creation of the first Titan graph
graph = TitanFactory.open('conf/titan-cassandra-solr.properties')
GraphOfTheGodsFactory.load(graph)
g = graph.traversal()
// find hercules
hercules = g.V().has('name', 'hercules').next()
// find parents name of hercules
g.V(hercules).out('father', 'mother').values('name')
// find all places within the given circle
g.E().has('place', geoWithin(Geoshape.circle(37.97, 23.72, 50)))
@HashtagMarkus
HashtagMarkus / gist:32075e726e4990059c84
Last active September 2, 2021 07:28
Error creating solr core
ERROR: Expected JSON response from server but received: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<title>Error 500 {msg=com/vividsolutions/jts/geom/CoordinateSequenceFactory,trace=java.lang.NoClassDefFoundError: com/vividsolutions/jts/geom/CoordinateSequenceFactory
at java.lang.Class.getDeclaredConstructors0(Native Method)
at java.lang.Class.privateGetDeclaredConstructors(Class.java:2671)
at java.lang.Class.getConstructor0(Class.java:3075)
at java.lang.Class.newInstance(Class.java:412)
at com.spatial4j.core.context.SpatialContextFactory.makeSpatialContext(SpatialContextFactory.java:98)
at org.apache.solr.schema.AbstractSpatialFieldType.init(AbstractSpatialFieldType.java:120)