View CheckAngelfire.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
if ((Get-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Windows').GetValue('SystemLookup')) {Write-Host "Angelfire found!"} else {Write-Host "Nothing"} |
View config.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
development: | |
adapter: mysql2 | |
encoding: utf8 | |
database: my_database | |
username: root | |
password: | |
apt: | |
- somepackage | |
- anotherpackage |
View gist:1000402
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
(function(){ | |
var re = /(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|localhost/; | |
if(re.test(window.location.hostname)) return; | |
var _gaq=[['_setAccount','UA-23156659-1'],['_trackPageview'],['_trackPageLoadTime']]; | |
(function(d,t){var g=d.createElement(t),s=d.getElementsByTagName(t)[0];g.async=1; | |
g.src=('https:'==location.protocol?'//ssl':'//www')+'.google-analytics.com/ga.js'; | |
s.parentNode.insertBefore(g,s)}(document,'script')); | |
})(); |
View print_ts_la.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
import os | |
from time import sleep | |
FILE_PATH = 'ts.txt' | |
def get_atime_1(): | |
result = os.stat(FILE_PATH, follow_symlinks = False) | |
return result.st_atime |
View CILStreamObfuscation.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
${🤷} = New-Object Reflection.Emit.DynamicMethod('💩', [UInt32], @([UInt32], [UInt32])) | |
${🤔} = ${🤷}.GetILGenerator() | |
@(@(2, 275120805),@(3, 275120805),@(88, -261739867),@(42, 23440101)) | % { | |
${🤔}.Emit([Activator]::CreateInstance([System.Reflection.Emit.OpCode], [Reflection.BindingFlags] 'NonPublic, Instance', $null, @(($_[0] -as [System.Reflection.Emit.OpCode].Assembly.GetType('System.Reflection.Emit.OpCodeValues')), $_[1]), $null)) | |
} | |
${💩} = ${🤷}.CreateDelegate([Func``3[UInt32, UInt32, UInt32]]) | |
${💩}.Invoke(2,3) |
View star basic macro malware.txt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## Uploaded by @JohnLaTwC | |
25b4214da1189fd30d3de7c538aa8b606f22c79e50444e5733fb1c6d23d71fbe.unzip\Basic\Standard\Module1.xml | |
<?xml version="1.0" encoding="UTF-8"?> | |
<!DOCTYPE script:module PUBLIC "-//OpenOffice.org//DTD OfficeDocument 1.0//EN" "module.dtd"> | |
<script:module xmlns:script="http://openoffice.org/2000/script" script:name="Module1" script:language="StarBasic">REM ***** BASIC ***** | |
Sub OnLoad | |
Dim os as string |
View prelease201902-shell_items.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import datetime | |
from typing import AnyStr, Generator, Optional, Tuple, Type, Union | |
import uuid | |
from kaitaistruct import BytesIO, KaitaiStream | |
import known_uuids | |
import logging | |
import ShellItemList |
View SimpleTCGLogParser.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Import-Module HgsDiagnostics | |
$GetHgsTrace = Get-Command Get-HgsTrace | |
$RemoteAttestationCoreReference = $GetHgsTrace.ImplementingType.Assembly.GetReferencedAssemblies() | Where-Object { $_.Name -eq 'Microsoft.Windows.RemoteAttestation.Core' } | |
Add-Type -AssemblyName $RemoteAttestationCoreReference.FullName | |
$MostRecentTCGLog = Get-ChildItem C:\Windows\Logs\MeasuredBoot | Sort-Object -Property LastWriteTime -Descending | Select-Object -First 1 | Select-Object -ExpandProperty FullName | |
$LogBytes = [IO.File]::ReadAllBytes($MostRecentTCGLog) | |
$ParsedTCGLog = [Microsoft.Windows.RemoteAttestation.Core.TcgEventLog]::Parse($LogBytes) | |
$ParsedTCGLog.TcgData.Children | Sort-Object -Property PcrIndex | Group-Object -Property PcrIndex |
View x8664-asm-cheetsheet.txt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Registers | |
Caller-saved Callee-saved | |
RAX RCX RSP RDI RSI RDX R8 R9 R10 R11 RBP RBX R12 R13 R14 R15 | |
Args: RDI, RSI, RDX, RCX, R8, R9, XMM0–7 | |
Return: RAX | |
Simple Compile | |
yasm -f macho64 foo.asm && gcc foo.c foo.o -Wall -Wextra -g -O1 |
View apfs_cli_tools.txt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
➜ ~ sw_vers | |
ProductName: Mac OS X | |
ProductVersion: 10.12.1 | |
BuildVersion: 16B2333a | |
➜ ~ ls -l /System/Library/Filesystems/apfs.fs/Contents/Resources | |
total 2088 | |
-rwxr-xr-x 1 root wheel 349760 22 Sep 03:48 apfs.util | |
-rwxr-xr-x 1 root wheel 352880 22 Sep 03:48 apfs_invert |
OlderNewer