Mohit Dabas MohitDabas

## async_url_secretfinder.py
import aiohttp
import asyncio
import re

_regex = {
    'google_api': r'AIza[0-9A-Za-z-_]{35}',
    'firebase': r'AAAA[A-Za-z0-9_-]{7}:[A-Za-z0-9_-]{140}',
    'google_captcha': r'6L[0-9A-Za-z-_]{38}|^6[0-9a-zA-Z_-]{39}$',
    'google_oauth': r'ya29\.[0-9A-Za-z\-_]+',
    'amazon_aws_access_key_id': r'A[SK]IA[0-9A-Z]{16}',

## MacOS EDR RTR Persistence and Permission.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                MohitDabas
                / MacOS EDR RTR Persistence and Permission.md
            
            
              Created
              November 10, 2023 11:27
            
              
                You can use these one liner in any supported EDR Realtime response script runner.
              
          
    MacOS EDR RTR Persistence and Permission

You can use these one liner in any supported EDR Realtime response script runner.
Persistence on Mac

python3 -c "import os; paths = ['/Library/LaunchAgents','/Library/LaunchDaemons','/System/Library/LaunchDaemons', os.path.expanduser('/users/<username>/Library/LaunchAgents'),os.path.expanduser('/Users/<username>/Library/Preferences'),'/Library/Preferences']; [print(f'File: {filename}\n{repr(open(os.path.join(path, filename), \"rb\").read())}') for path in paths if os.path.exists(path) for filename in os.listdir(path)]; print(f'Directory not found: {[path for path in paths if not os.path.exists(path)]}') if any(not os.path.exists(path) for path in paths) else None"

  
## windows-apis-via-powershell.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                MohitDabas
                / windows-apis-via-powershell.md
            
            
              Last active
              September 17, 2023 11:09
            
              
                Calling Windows APIs via Powershell with Example code
              
          
    Call WinAPI functions in PowerShell using delegate functions with Add-Type and Reflection types

Simplest Method

$code = @"
using System;
using System.Runtime.InteropServices;

public class User32Interop {

  
## Clipboard Saver.py
#please install kivy by using command !pip install kivy


import subprocess
from kivy.app import App
from kivy.uix.boxlayout import BoxLayout
from kivy.uix.textinput import TextInput
from kivy.core.clipboard import Clipboard
from kivy.clock import Clock

## naso.html

<html lang="en">
    <head>
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width, initial-scale=1">
      <title>HTML 5 Based Command Console with multiple autocomplete </title>
      <link rel="stylesheet" href="https://code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">

      <style>
        flex:1;

## inputparser.py
from os import listdir
from os.path import isfile, join
import re
from os import walk
from bs4 import BeautifulSoup


def fileGetter():
    fileNames = []
    mypath='<folder_name>'

## collectfuncNstring.py
from ghidra.program.util import DefinedDataIterator
from ghidra.app.util import XReferenceUtil

def getAddress(offset):
    return currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(offset)


string_and_funcdata=[]
functionManager = currentProgram.getFunctionManager()

## autorunpermissionfinder.py
import re
import os
autoRunFileData=open('autorun.txt',encoding='utf-16').readlines()
count=1
for line in autoRunFileData:
    matches=re.findall(r'[a-zA-Z]:\\[\\\S|*\S]?.*$',line)
    try:
        path=matches[0].split('"\t')[0]
        print(path)
        os.system('accesschk64.exe -wvu  "'+path+'"')

## Jar Debugging
#mvn run on a particular port
mvn jetty:run -D jetty.port=9229

#mvn debug
export MAVEN_OPTS="-Xdebug -Xnoagent  -Xrunjdwp:transport=dt_socket,address=0.0.0.0:9090,server=y,suspend=n"

#visual studio debug config

{
    "version": "0.2.0",

## phpserializeattack.php
<?php
class PHPObjectInjection{
        public $inject;

        function __wakeup(){
           if(isset($this->inject)){
                eval($this->inject);
            }
        }
	import aiohttp
	import asyncio
	import re

	_regex = {
	'google_api': r'AIza[0-9A-Za-z-_]{35}',
	'firebase': r'AAAA[A-Za-z0-9_-]{7}:[A-Za-z0-9_-]{140}',
	'google_captcha': r'6L[0-9A-Za-z-_]{38}\|^6[0-9a-zA-Z_-]{39}$',
	'google_oauth': r'ya29\.[0-9A-Za-z\-_]+',
	'amazon_aws_access_key_id': r'A[SK]IA[0-9A-Z]{16}',
	#please install kivy by using command !pip install kivy


	import subprocess
	from kivy.app import App
	from kivy.uix.boxlayout import BoxLayout
	from kivy.uix.textinput import TextInput
	from kivy.core.clipboard import Clipboard
	from kivy.clock import Clock

	<html lang="en">
	<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>HTML 5 Based Command Console with multiple autocomplete </title>
	<link rel="stylesheet" href="https://code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">

	<style>
	flex:1;
	from os import listdir
	from os.path import isfile, join
	import re
	from os import walk
	from bs4 import BeautifulSoup


	def fileGetter():
	fileNames = []
	mypath='<folder_name>'
	from ghidra.program.util import DefinedDataIterator
	from ghidra.app.util import XReferenceUtil

	def getAddress(offset):
	return currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(offset)



	string_and_funcdata=[]
	functionManager = currentProgram.getFunctionManager()
	import re
	import os
	autoRunFileData=open('autorun.txt',encoding='utf-16').readlines()
	count=1
	for line in autoRunFileData:
	matches=re.findall(r'[a-zA-Z]:\\[\\\S\|\S]?.$',line)
	try:
	path=matches[0].split('"\t')[0]
	print(path)
	os.system('accesschk64.exe -wvu "'+path+'"')
	#mvn run on a particular port
	mvn jetty:run -D jetty.port=9229

	#mvn debug
	export MAVEN_OPTS="-Xdebug -Xnoagent -Xrunjdwp:transport=dt_socket,address=0.0.0.0:9090,server=y,suspend=n"

	#visual studio debug config

	{
	"version": "0.2.0",
	<?php
	class PHPObjectInjection{
	public $inject;

	function __wakeup(){
	if(isset($this->inject)){
	eval($this->inject);
	}
	}