Skip to content

Instantly share code, notes, and snippets.

View Sh1n0g1's full-sized avatar

Sh1n0g1 Sh1n0g1

117 followers · 6 following
View GitHub Profile
@Sh1n0g1
Sh1n0g1 / ip2geo.py
Created December 21, 2016 01:02
IP2geolocation
#Bulk IP Address 2 Geolocation Using freegeoip.net
#Input: IP Address List
#Output: IP, Latitude, Longitude (CSV Format)
import urllib, json
#Paste your ipaddress list
ips="""
@Sh1n0g1
Sh1n0g1 / ScreenShot.ps1
Created January 10, 2017 01:27
Take a screenshot by powershell
[Reflection.Assembly]::LoadWithPartialName("System.Drawing")
function screenshot([Drawing.Rectangle]$bounds, $path) {
$bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height
$graphics = [Drawing.Graphics]::FromImage($bmp)
$graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size)
$bmp.Save($path)
$graphics.Dispose()
@Sh1n0g1
Sh1n0g1 / pefile_peid.py
Created January 25, 2017 11:32
Get the matching result of UserDB.txt(PEid) using pefile
import sys
import peutils
import pefile
try:
pe = pefile.PE(sys.argv[1])
signatures = peutils.SignatureDatabase('./sig/userdb.txt')
matches = signatures.match_all(pe, ep_only = True)
if type(matches) is list:
for m in matches:
@Sh1n0g1
Sh1n0g1 / Test-RegistryName.ps1
Created March 23, 2017 02:49
Test-RegistryName
<#
.EXAMPLE
Test-RegistryName -Path "HKCU:\Software\Sysinternals\Strings" -Name "EulaAccepted"
#>
function Test-RegistryName {
param (
[parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]$Path,
[parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]$Name
)
@Sh1n0g1
Sh1n0g1 / Write-RegistryValue.ps1
Created March 23, 2017 03:00
Write Registry Value (and Create key if needed)
<#
.EXAMPLE
Write-RegistryValue -Path "HKCU:\Software\Sysinternals\Strings" -Name "EulaAccepted
#>
function Write-RegistryValue{
param (
[parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]$Path,
[parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]$Name,
[parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]$Value
@Sh1n0g1
Sh1n0g1 / Open-CDTray.ps1
Created March 28, 2017 01:40
Open CD Tray by PowerShell
$MemDef =@"
[DllImport("winmm.dll", CharSet = CharSet.Ansi)]
public static extern int mciSendStringA(
string lpstrCommand,
string lpstrReturnString,
int uReturnLength,
IntPtr hwndCallback
);
"@
@Sh1n0g1
Sh1n0g1 / Play-Mario.ps1
Created April 20, 2017 12:47 — forked from davewilson/Play-Mario.ps1
Super Mario Theme in PowerShell
Function Play-Mario {
[System.Console]::Beep(659, 125);
[System.Console]::Beep(659, 125);
[System.Threading.Thread]::Sleep(125);
[System.Console]::Beep(659, 125);
[System.Threading.Thread]::Sleep(167);
[System.Console]::Beep(523, 125);
[System.Console]::Beep(659, 125);
[System.Threading.Thread]::Sleep(125);
[System.Console]::Beep(784, 125);
@Sh1n0g1
Sh1n0g1 / Play-Doremi.ps1
Last active April 16, 2019 12:20
Note Scale for PowerShell [console]::beep
$C=261.6
$Cs=277.2
$Db=$Cs
$D=293
$Ds=311.1
$Eb=$Ds
$E=329.6
$F=349.2
$Fs=370.0
$Gb=$Fs
@Sh1n0g1
Sh1n0g1 / ja.json
Created May 2, 2017 07:25
Japanese Keyboard Map for Bash Bunny
{
"__comment":"Thanks to WireShark + USBPcap!",
"a":"00,00,04",
"b":"00,00,05",
"c":"00,00,06",
"d":"00,00,07",
"e":"00,00,08",
"f":"00,00,09",
"g":"00,00,0a",
"h":"00,00,0b",
@Sh1n0g1
Sh1n0g1 / VTUploadCheck.sh
Created June 27, 2017 00:33
Detect the malware upload on VT without API key
#!/bin/sh
sha256="d868ef71f3489e9f9c0a17b9b3c704789aae7c362457cea5c8e1e17185437303"
url="https://www.virustotal.com/en/file/$sha256/analysis/"
while :
do
result=$(wget -qO- $url );
reslen=${#result}
if [ "$reslen" -lt "1000" ] ; then
echo "VirusTotal blocks us!";
break;