Skip to content

Instantly share code, notes, and snippets.

@Wack0
Wack0 / gist:f865ef369eb8c23ee028
Last active May 9, 2018 23:15
Komodia rootkit findings by @TheWack0lian

First off: this is the first time I "seriously" reversed a kernel-mode NT driver, so keep that in mind when you read this..

The Komodia rootkit config is located in a certain registry entry that's hardcoded in the driver. For Qustodio, it's HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qwd\Data.

The config structure is simple enough. An array of the following structure:

DWORD type;
BYTE unknown[32]; // I don't see anywhere that the driver actually *reads* any of this part,
 // at least, not after writing to it first.
@joech4n
joech4n / boxcar-growl.py
Last active February 24, 2016 17:22
boxcar-growl.py - Send Boxcar Notification with CLI (Python)
#!/usr/bin/env python
# https://gist.github.com/joech4n/1b3d394ceb8b776f06d7
import os
import sys
import subprocess
import argparse
import ConfigParser
import shlex
@taoeffect
taoeffect / gist:8855230
Created February 7, 2014 00:20
DNSChain + DNSCrypt! :-D
dnscrypt-proxy --local-address=127.0.0.1:53 --resolver-address=23.226.227.93:443 --provider-name=2.dnscrypt-cert.okturtles.com --provider-key=1D85:3953:E34F:AFD0:05F9:4C6F:D1CC:E635:D411:9904:0D48:D19A:5D35:0B6A:7C81:73CB
@mickaelandrieu
mickaelandrieu / quotes_json.js
Created November 26, 2013 12:50
Scrap a website with CasperJs, JSON output.
var links = [];
var quotes = [];
var tempUrl = [];
var infos = [];
var maxLinks = 10;
var firstUrl = 'http://www.imdb.com/search/title?at=0&num_votes=5000,&sort=user_rating,desc&start=1&title_type=tv_infoss';
var newUrl;
var x = require('casper').selectXPath;
@zackthehuman
zackthehuman / gist:5762171
Created June 12, 2013 00:59
JavaScript object difference using Underscore
var objectA = { a: '1a', b: '1b', c: '1c' };
var objectB = { a: '2a', b: '2b', d: '2d' };
function objectDifference(minuend, subtrahend) {
var firstIntersection = _.omit(minuend, _.keys(subtrahend)),
secondIntersection = _.omit(subtrahend, _.keys(minuend));
return _.extend(firstIntersection, secondIntersection);
}
@jexchan
jexchan / multiple_ssh_setting.md
Created April 10, 2012 15:00
Multiple SSH keys for different github accounts

Multiple SSH Keys settings for different github account

create different public key

create different ssh key according the article Mac Set-Up Git

$ ssh-keygen -t rsa -C "your_email@youremail.com"
@JeffreyWay
JeffreyWay / gist:1525217
Created December 27, 2011 21:29
Instant Server for Current Directory
alias server='open http://localhost:8000 && python -m SimpleHTTPServer'