haxxinen

#!/usr/bin/env python3
import argparse
import os
import pefile

class DllCharacteristics():
    def __init__(self):
        self.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = False
        self.IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = False
        self.IMAGE_DLLCHARACTERISTICS_NO_BIND = False

haxxinen

# Spotify
0.0.0.0 spclient.wg.spotify.com
0.0.0.0 video-ad-stats.googlesyndication.com
0.0.0.0 googleads.g.doubleclick.net
0.0.0.0 partner.googleadservices.com
0.0.0.0 c.betrad.com
0.0.0.0 pixel.mathtag.com
0.0.0.0 cm.g.doubleclick.net
0.0.0.0 partnerad.l.doubleclick.net
0.0.0.0 server.adformdsp.net

haxxinen

#!/usr/bin/env python3
import sys

if __name__ == "__main__":
	if len(sys.argv) != 2:
		print("usage: %s names.txt" % (sys.argv[0]))
		sys.exit(0)

	for line in open(sys.argv[1]):
		name = ''.join([c for c in line if  c == " " or  c.isalpha()])

haxxinen

1. Show interfaces by name

$ ip addr | awk '/: /{sub(":","--",$2); print $2}'
lo--
ens33--
docker0--

2. Show interfaces by name and corresponding IP addresses

haxxinen

File: /tmp/elements.xml

<?xml version="1.0"?>
<elements>
    <parent name="A">
        <child value="a"></child>
        <child value="b"></child>
 

haxxinen

info

• even root can be privileged and unprivileged
• super-user does not always imply root (uid == 0)
• can run a process as root w/o any capabilities (and the other way around)
• process capabilities have been around for a while (file capabilities is something more recent)
• capabilities are enabled by default in all modern Linux distros (nobody uses them :D - "but the man in the box does...")
  • management tools installed by default
• it's really easy to lose file capabilities when moving files around the system (bugs, bugs, bugs...)

haxxinen

$ cat SimpleHTTPServerv6.py
import BaseHTTPServer, SimpleHTTPServer, socket

class SimpleHTTPServer6(BaseHTTPServer.HTTPServer):
   address_family=socket.AF_INET6

SimpleHTTPServer.test(ServerClass=SimpleHTTPServer6)
$ SimpleHTTPServerv6.py
$ http http://[::1]:8888

haxxinen

println(hudson.util.Secret.fromString("1234").getEncryptedValue())

Output: {AQAAABAAAAAQc//GkWTtyO8B5f1re53AX+8S0yCRKA8h7ean+y/sQig=}

println(hudson.util.Secret.decrypt('{AQAAABAAAAAQc//GkWTtyO8B5f1re53AX+8S0yCRKA8h7ean+y/sQig=}'))

Output: 1234

haxxinen

# curl -sO https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
# pip install 2to3 && 2to3 -w linuxprivchecker.py >/dev/null 2>/dev/null
# apt-get install python-autopep8 -yqq && autopep8 -i linuxprivchecker.py
# sed -i 's/results = out.*/results = out.decode("utf-8").split("\\n")/g' linuxprivchecker.py
# python3 linuxprivchecker.py

haxxinen

([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")