Skip to content

Instantly share code, notes, and snippets.

View aserper's full-sized avatar

Amit Serper aserper

55 followers · 1 following
View GitHub Profile
@aserper
aserper / gist:94ce1b762259b6c5cacedb4dd666e2a7
Created March 21, 2024 17:52
from bcc import BPF
# BPF program that instruments setenv function
prog = """
#include <uapi/linux/ptrace.h>
int trace_setenv(struct pt_regs *ctx) {
// Assuming the first argument to setenv is a pointer to the environment variable name
char env_var_name[256];
bpf_probe_read_user(&env_var_name, sizeof(env_var_name), (void *)PT_REGS_PARM1(ctx));
@aserper
aserper / gist:7b629de0272483c8ff5d5682a126d44a
Created March 20, 2024 15:10
from bcc import BPF
# eBPF program
prog = """
#include <uapi/linux/ptrace.h>
// Instrument the fchdir syscall entry
TRACEPOINT_PROBE(syscalls, sys_enter_fchdir) {
// args is a built-in structure provided by the tracepoint
// It contains all the arguments of the syscall being traced
@aserper
aserper / gist:d495b119395bf8352558d4b824f46f93
Created March 19, 2024 14:52
from bcc import BPF
# eBPF program
prog = """
#include <uapi/linux/ptrace.h>
// Instrument the chdir syscall entry
TRACEPOINT_PROBE(syscalls, sys_enter_chdir) {
// args is a built-in structure provided by the tracepoint
// It contains all the arguments of the syscall being traced
@aserper
aserper / gist:20a0e129ac8781ff946b1bd517b1b723
Created March 19, 2024 14:43
from bcc import BPF
# Define the eBPF program
prog = """
#include <uapi/linux/ptrace.h>
// Instrument the chmod syscall entry
TRACEPOINT_PROBE(syscalls, sys_enter_chmod) {
// args is a built-in structure provided by the tracepoint
// It contains all the arguments of the syscall being traced
@aserper
aserper / gist:53c70e2ff26c1fc656ac31b514253475
Created April 12, 2022 19:51
/tmp/exp
@aserper
aserper / gist:e36d382668c6cf2c996c5143025097c0
Created June 13, 2019 16:09
AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Sdr0tIIL8yPhKTLzVMnRKj1zzGqtR4tKpM2bfBEx+AHyvBL8jDZDJ6fuVwEB+aZ8bl/pA5qhFWRRWhONLnLN9RWFx/880msXITwOXjCT3Qa6VpAFPPMazJpbppIg+LTkbOEjdDHvdZ8RhEt7tTXc2DoTDcs73EeepZbJmDFP8TCY7hwgLi0XcG8YHkDFoKFUhvSHPkzAsQd9hyOWaI1taLX2VZHAk8rOaYqaRG3URWH3hZvk8Hcgggm2q/IQQa9VLlX4cSM4SifM/ZNbLYAJhH1x3ZgscliZVmjB55wZWRL5oOZztOKJT2oczUuhDHM1qoUJjnxopqtZ5DrA76WH user@localhost"
@aserper
aserper / dropped_port_scanner.py
Created June 13, 2019 15:16
dropped python portscanner
#! /usr/bin/env python
#coding: utf-8
import threading
import socket
from re import findall
import httplib
import os
from random import randrange
import random
@aserper
aserper / gist:cbcd0c8ecbda9398911ecaa1c7f2f71b
Created March 8, 2019 17:24
Hacked wordpress domains used as a C2 redirector
http://printofcenter.pl/media/system/info.php?url=
http://printofcenter.pl/media/system/log.php?url=
http://moippo.org.ua/media/system/log.php?url=
http://moippo.org.ua/media/system/info.php?url=
http://nihir.org/wp-includes/rest-api/info.php?url=
http://nihir.org/wp-includes/rest-api/log.php?url=
http://airsoft.monokpeti.xyz/wp-includes/js/log.php?url=
http://airsoft.monokpeti.xyz/wp-includes/js/info.php?url=
http://asoftel.east.3cx.us/wp-includes/js/log.php?url=
http://asoftel.east.3cx.us/wp-includes/js/info.php?url=
@aserper
aserper / gist:d0f1f2eb66b582ca04f195707a8d0126
Created July 2, 2017 11:54
Form1 from Karo. NotPetya svchost.exe
using ;
using ;
using ;
using ;
using ;
using IWshRuntimeLibrary;
using SmartAssembly.Delegates;
using SmartAssembly.HouseOfCards;
using System;
using System.Collections.Generic;
@aserper
aserper / gist:43664a1daf7d309c46edc2f739d78ecd
Created May 9, 2017 16:48
domains from proton.b encrypted file
handbrakestore.com
handbrake.cc
luwenxdsnhgfxckcjgxvtugj.com
6gmvshjdfpfbeqktpsde5xav.com
kjfnbfhu7ndudgzhxpwnnqkc.com
yaxw8dsbttpwrwlq3h6uc9eq.com
qrtfvfysk4bdcwwwe9pxmqe9.com
fyamakgtrrjt9vrwhmc76v38.com
kcdjzquvhsua6hlfbmjzkzsb.com
ypu4vwlenkpt29f95etrqllq.com