Skip to content

Instantly share code, notes, and snippets.

@Attunewise
Attunewise / ConvertFunctions.py
Last active April 24, 2024 01:44
Convert OpenAI functions to system prompt that works with other LLMs
# Converts OpenAI compatible function calling JSON schema to a prompt that instructs the LLM to return
# a JSON object that is a choice of a function call conforming to one of the functions or a message reply
def convert_schema_to_typescript(schema):
if not schema:
return 'any'
if '$ref' in schema:
return schema['$ref'].replace('#/definitions/', '')
@HackingLZ
HackingLZ / altitude.py
Created April 19, 2023 13:29
altitude alert
import csv
import requests
import argparse
from bs4 import BeautifulSoup
from colorama import Fore, Style, init
init(autoreset=True)
known_security_vendors = [
'symantec', 'mcafee', 'trendmicro', 'kaspersky', 'bitdefender',
@realoriginal
realoriginal / Entry.c
Created March 29, 2023 16:40
TLDR: How a socks proxy client is written to tunnel connections from a 'teamserver' to an agent.
/*!
*
* RPROXICMP
*
* GuidePoint Security LLC
*
* Threat and Attack Simulation Team
*
!*/
@rqu1
rqu1 / checkmk.py
Last active November 13, 2023 22:07
check if a PAN firewall is using the default master key when globalprotect is enabled
from hashlib import md5, sha1
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
from base64 import b64encode, b64decode
import sys, time
import requests
DEFAULT_MASTERKEY=b'p1a2l3o4a5l6t7o8'
class PanCrypt():
@zimnyaa
zimnyaa / iocpipe.py
Created February 17, 2022 11:10
Check whether an SMB pipe name for pivoting is a known IoC
import re, sys
def rule_startswith(ioc_string):
def __match(pipename):
if pipename.startswith(ioc_string):
print("\tMATCH startswith({})".format(ioc_string))
return True
return False
return __match
@atucom
atucom / mesh-shell-server.py
Created February 16, 2022 14:56
Meshtastic shell server for executing commands on a remote system attached to a meshtastic radio
#!/usr/bin/env python3
#@atucom
# PoC of getting a remote shell using a meshtastic radio.
# this works by using the meshtastic python package and the device connected over USB serial
# The long/slow transmit speed gives about 10 bytes/sec bandwidth which is crazy slow. It took 5.5mins to run 'ls -la' on my home dir
# This could be further improved by the following:
# - trying the short/fast mode
# - creating a dedicated channel
# - setting a non-default psk for encryption
@mhaskar
mhaskar / client-ipv6-generic.c
Created January 24, 2022 00:09
DNSStager v1.0 beta agent to inject the retrived shellcode in notepad.exe and using Early Bird APC
#include <stdint.h>
#include <inttypes.h>
#include <winsock2.h>
#include <windns.h>
#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
${ctx:loginId}
${map:type}
${filename}
${date:MM-dd-yyyy}
${docker:containerId}
${docker:containerName}
${docker:imageName}
${env:USER}
${event:Marker}
${mdc:UserId}
@daaximus
daaximus / ioctl_names.cpp
Last active October 31, 2023 13:46
Most IOCTLs mapped to their code names
typedef struct _ioctl_t
{
const char* ioctl_name;
uint64_t ctl_code;
} ioctl_t;
// This would likely be better used in some unordered map. This is just a temporary data structure for testing resolution.
//
// Results from NtDeviceIoControlFile hook:
// utweb.exe (14916) :: NtDeviceIoControlFile( 0x65c (\Device\Afd), 0x694, 0x0000000000000000, 0x0000000000000000, 0x00000000044DEE90, 0x12024 (IOCTL_AFD_SELECT), 0x0000000004A3FC18, 0x34, 0x0000000004A3FC18, 0x34 )
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- This inline task executes c# code. -->
  <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe SimpleTasks.csproj -->
  <!-- Save This File And Execute The Above Command -->
  <!-- Original Author: Casey Smith, Twitter: @subTee -->
<!-- Modified by John Baek, @exploitpreacher to use ntqueueapcthread (https://github.com/FuzzySecurity/Sharp-Suite/tree/master/UrbanBishop) -->
  <!-- License: BSD 3-Clause -->
  <Target Name="Hello">
   <ClassExample />
  </Target>