Skip to content

Instantly share code, notes, and snippets.

@gyrospectre
gyrospectre / options.yaml
Created December 30, 2019 01:03
Fleet options config to enable ATC for Mac quarantine and chrome history
apiVersion: v1
kind: options
spec:
config:
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
- SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY time LIMIT 1
options:
FrameInfo(
frame=<frame at 0x7fead1ce39a0, file '/tmp/new_runtime.py', line 168, code main>,
filename='/tmp/new_runtime.py',
lineno=168, function='main',
code_context=[' backdoored_run(app_root, handler, lambda_runtime_api_addr)\n'],
index=0
),
@gyrospectre
gyrospectre / exfil_post
Last active October 3, 2021 06:29
exfil_post
START RequestId: ecc7732f-6d4d-484c-92b3-fdf41508ad2a Version: $LATEST
[DEBUG] 2021-10-02T05:41:24.876Z Starting new HTTPS connection (1): en713emlh144f.x.pipedream.net:443
END RequestId: ecc7732f-6d4d-484c-92b3-fdf41508ad2a
const StackTrace = require('error-stack-parser')
function check_entrypoint () {
var st = StackTrace.parse(new Error())
var entrypoint = st[ st.length -1 ]
console.log(serialize(entrypoint))
entry_file = entrypoint.fileName
if (!entry_file.startsWith('/var/runtime/')) {
def get_stackinfo():
stack = inspect.stack()
stack_hash = hashlib.sha256(str(stack).encode('utf-8')).hexdigest()
stack_info = {
'stack_hash': stack_hash,
'entry_frame': {
'filename': stack[-1].filename,
'code_context': stack[-1].code_context
}
{
"stack_hash": "2f74ab12d499b7e418d71593dcd1eff56c81a764ec44a2e01a675066bf303047",
"entry_frame": {
"filename": "/var/runtime/bootstrap.py",
"code_context": [
" main()\n"
]
}
}
def get_entrypoint():
stack = inspect.stack()
entrypoint = {
'filename': stack[-1].filename,
'code_context': stack[-1].code_context
}
return entrypoint
def check_entrypoint():
$ curl -X POST <API URL> -d "{test12344: 'test1'}"
{"test12344": "test1"}
$./exploit.sh ...
[+] Creating evil yaml with payload 'switch_runtime.py' and data 'exploit.tmp'
[+] Done, evil yaml at evil_yaml
{"Output": "Successfully took over the bootstrap runtime"}
$ curl -X POST <API URL> -d "{test12344: 'test1'}"
Exception('Runtime has been tampered with, aborting! File: /tmp/new_runtime.py')
@gyrospectre
gyrospectre / shellcat.py
Last active October 15, 2022 06:31
Bind Shell Logger
import time
import socket
BANNER = [
"bash: cannot set terminal process group (5237): Inappropriate ioctl for device",
"bash: no job control in this shell",
]
LISTEN_ON = '0.0.0.0'
PORT = 51337
LOGFILE = './honey.log'