kernelsmith

require 'zip'
source_file = "blah.zip"
string = File.binread(source_file)
Zip::File.open_buffer(string) do |entries|
  entries.each {|entry| puts entry.name }
end

kernelsmith

require 'net/http'
# Must be somedomain.net instead of somedomain.net/, otherwise, it will throw exception.
Net::HTTP.start("somedomain.net") do |http|
    resp = http.get("/blah.zip")
    open("blah.zip", "wb") do |file|
        file.write(resp.body)
    end
end

kernelsmith

with reverse_tcp its listen -> accept -> recv(4) -> recv(length) -> jmp(buffer)

kernelsmith

# 0) setup our variables
<% rc_primary_lhost = "192.168.130.1" %>
<% rc_lhost_for_local = rc_primary_lhost %>

<% rc_primary_lport = "4433" %>
<% rc_lport_for_local = "4443" %>

## primary exploit options
#<% rc_primary_exploit = "exploit/windows/smb/psexec" %> #>
<% rc_primary_exploit = "exploit/windows/browser/ms14_012_textrange" %>

kernelsmith

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"LocalAccountTokenFilterPolicy"=dword:00000001

kernelsmith

    if mod
      # Don't report module run events here as it will be taken care of
      # in +Post.run_simple+
      # meterpreter scripts don't need SESSION, but it's not gonna hurt
      opts = { 'SESSION' => self.sid }
      args.each do |arg|
        k,v = arg.split("=", 2)
        opts[k] = v
      end
      if mod.type == "post" 

kernelsmith

curl -Ls http://school.edu | egrep -q yellow && echo "school delayed" | mail -s school my@phone

kernelsmith

== RubyInject ==

RubyInject is a Mac OS X framework that allows you to inject at runtime the
Ruby interpreter into any running application, using the mach_star mechanism.

It will spawn a new thread on the remote process, initialize the Ruby
interpreter, start a new DRb server that exposes an expression evaluator, and
advertises the DRb server URI on bonjour (if you have the ruby-dnssd library).
https://github.com/rentzsch/mach_star

kernelsmith

def checkit(arr3)
  if arr3.first =~ /uid=/
    print arr3.first.strip.split('modbusconfig=')[1].split(',')[0]
    print ':'
    print arr3[1].split(' ')[1]
    print ':'
    print arr3[2].split(' ')[1]
    print "\r\n"
  end
end

kernelsmith

1) extend and include
2) constants
3) attribute macros
4) other macros (if any)
5) public class methods
6) public instance methods
7) protected and private methods near the end