ajxchapman

TL;DR

• Guide from https://glitchwitch.io/blog/2018-09/windows-10-on-digitalocean/
• Download Windows ISO from https://www.microsoft.com/en-us/software-download/windows10ISO

Steps

• Create a build droplet with 4GB RAM
• Install QEMU and run the Windows 10 installation ISO

$ apt-get update && apt-get install qemu -y
$ qemu-img create -f raw windows10.img 16G

ajxchapman

import json
import re
import sys

scopes = []
f = sys.stdin
if len(sys.argv) == 2:
    f = open(sys.argv[1])
scopes_defs = [x.strip().lower() for x in f.readlines() if len(x.strip())]

ajxchapman

Scripts developed for solving HackerOne H1-702 2019 CTF

• image_extract.py performs character extraction on targetted against the HackerOne H1-702 CTF announcement image
• decrypt_sqli.py performs blind sqli data extraction with encrypted payloads targetting against the FliteThermostat API
• timing_attack.py performs an HTTP piplining based timing against the FliteThermostat Backend
• wordlist_generator.py generates wordlists from a give corpus or set of corpuses
• httplib.py performs efficient asynchronous HTTP requests against the FliteThermostat Backend

ajxchapman

Linux Gateway with WPAD and PAC

Simple setup to create a Linux gateway on Ubuntu 18.04 that provides WPAD settings via DHCP option 252.

systemctl disable systemd-resolved.service
systemctl stop systemd-resolved
apt update
apt install dnsmasq
unlink /etc/resolv.conf
echo "nameserver 8.8.8.8" > /etc/resolv.conf

ajxchapman

import base64
import os
import sys

search = " ".join(sys.argv[2:]) or None

path = None
with open(sys.argv[1]) as f:
    for line in f:
        if '<path>' in line:

ajxchapman

// https://gist.github.com/richinseattle/c527a3acb6f152796a580401057c78b4
#include <stdio.h>
#include <ctype.h>
 
#ifndef HEXDUMP_COLS
#define HEXDUMP_COLS 16
#endif
 
void hexdump(void *mem, unsigned int len)
{

ajxchapman

import re
import requests
import sys

TOKEN="*x-csrf-token Header*"
COOKIE="*__Host-session Cookie*"
USERNAME="*HackerOne Username*"

bugs = []
pages = 1

ajxchapman

package main

import (
	"fmt"
	"net"
	"os"
)

func connect() {
	c, err := net.Dial("tcp4", fmt.Sprintf("%s:4444", os.Args[1]))

ajxchapman

#NoEnv  ; Recommended for performance and compatibility with future AutoHotkey releases.
; #Warn  ; Enable warnings to assist with detecting common errors.
SendMode Input  ; Recommended for new scripts due to its superior speed and reliability.
SetWorkingDir %A_ScriptDir%  ; Ensures a consistent starting directory.
SetTitleMatchMode, RegEx

Run, "Wireshark-win64-3.2.6.exe"

WinWait, Wireshark [\d\.]+ 64-bit Setup,, 30
Loop, 7

ajxchapman

CVE-2019-5418 Demo

Build Docker container: Dockerfile

FROM ruby:2.5
RUN apt-get update -qq && apt-get install -y nodejs postgresql-client
RUN mkdir /myapp
WORKDIR /myapp
COPY Gemfile /myapp/Gemfile