Skip to content

Instantly share code, notes, and snippets.

@Wack0
Wack0 / gist:f865ef369eb8c23ee028
Last active May 9, 2018 23:15
Komodia rootkit findings by @TheWack0lian

First off: this is the first time I "seriously" reversed a kernel-mode NT driver, so keep that in mind when you read this..

The Komodia rootkit config is located in a certain registry entry that's hardcoded in the driver. For Qustodio, it's HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qwd\Data.

The config structure is simple enough. An array of the following structure:

DWORD type;
BYTE unknown[32]; // I don't see anywhere that the driver actually *reads* any of this part,
 // at least, not after writing to it first.
@kyledrake
kyledrake / ferengi-plan.txt
Last active April 6, 2024 00:30
How to throttle the FCC to dial up modem speeds on your website using Nginx
# The blog post that started it all: https://neocities.org/blog/the-fcc-is-now-rate-limited
#
# Current known FCC address ranges:
# https://news.ycombinator.com/item?id=7716915
#
# Confirm/locate FCC IP ranges with this: http://whois.arin.net/rest/net/NET-165-135-0-0-1/pft
#
# In your nginx.conf:
location / {
@githubp0b
githubp0b / totalhash.py
Last active June 27, 2022 15:42
Python script to interface with totalhash.com
#!/usr/bin/env python
import sys
import html2text
from optparse import OptionParser
import httplib
import urllib2
import re
message = '\nPython script search totalhash.com see http://totalhash.com/help/ for examples'
@josiahcarlson
josiahcarlson / sort_zset_cols.py
Last active August 23, 2022 08:15
A method to get sql-like multiple-column order by in Redis
'''
sort_zset_cols.py
Copyright 2013 Josiah Carlson
Released into the public domain.
'''
'''
Let's imagine that there are 3 restaurants with price, score, distance info
being:
@rep
rep / masscares.py
Created September 24, 2013 13:31
pycares mass resolver, input names on stdin
#!/usr/bin/python
# -*- coding: utf8 -*-
import sys
import os
import time
import select
import socket
import pycares
# coding=utf-8
"""
LICENSE http://www.apache.org/licenses/LICENSE-2.0
"""
import datetime
import sys
import time
import threading
import traceback
import SocketServer
import numpy as np
import pylab as pl
x = np.random.uniform(1, 100, 1000)
y = np.log(x) + np.random.normal(0, .3, 1000)
pl.scatter(x, y, s=1, label="log(x) with noise")
pl.plot(np.arange(1, 100), np.log(np.arange(1, 100)), c="b", label="log(x) true function")
pl.xlabel("x")
pl.ylabel("f(x) = log(x)")