Antti Virtanen lokori

## mandros.py
import sys
import requests
import threading
import HTMLParser
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

'''
Description: Reverse MSSQL shell through xp_cmdshell + certutil for exfiltration
Author: @xassiz
'''

## .bash_profile
# start at home
cd ~

ln -sfv /usr/local/opt/redis/*.plist ~/Library/LaunchAgents


ln -sfv /usr/local/opt/mysql56/*.plist ~/Library/LaunchAgents

export PATH=./node_modules/.bin:$PATH

## getdomains.sh
#!/bin/bash

## Y-Tunnukseen perustuva domainejen haku (.fi)

## Esimerkki: getdomains 1093944-1 # MTV Oy
# Laita tämä .bashrc tai .zshrc

# Käyttöesimerkkejä:

# Looppaa Y-tunnuksetn kaikki domainit läpi ja tee kysely

## curl_mass_uploader.sh
#!/bin/bash

upload_file () {
  SESSION=df831243-602e-4c27-8afe-09a6760be8ad
  XSRF=83872690-237b-c176-8830-ac11ba76d7b3
  URL="http://192.168.50.1:8080/api/UPLOOOD"
  echo "Handling file $1"
  curl -v -i -X POST -H "Content-Type: multipart/form-data" -H "Cookie: ring-session=$SESSION; XSRF-TOKEN=$XSRF" -F "file=@$1;type=application/vnd.openxmlformats-officedocument.s\
preadsheetml.sheet" -F "x-xsrf-token=$XSRF" $URL >> logifile.txt 2>&1
  echo "-----------------------" >> logifile.txt

## supergobuster.sh
#!/bin/bash
set -eu

URL=$1

echo "super go bustering for super brute: $URL"

gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/tomcat.txt
gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/nginx.txt
gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/apache.txt

## htb-enum.sh
#!/bin/bash

set -eu

echo "Running super enum against $1"

# quick scan TCP
# nmap -v -sC -sV -oA initial_nmap $1

# quick scan UDP

## tirsk-spoofing.php
<?php
    /*
            This file can be useful in conjunction with DNSSpoof
     */
?>

<html>
<body>

<audio class="my_audio"  preload="none" id = "saundi">

## writeup-for-reaktor-CTF
Reaktor's Java application CTF challenge from Disobey 2018

It seems I was not the only one struggling with the Java application challenge. There was
JAR file and that's how it began.

After decompiling the JAR the main class contained code which didn't do anything. It looks like this:

		String encryptedResult = "[3, 63, -54, -8, -45, -89, -91, 40, -111, -77, -76, -49, 119, 8, -46, 9, -70, 99, -12, 3, 124, 65, -66, 104, -18, 4, 64, 87, 6, -72, 68, 121, -32, -52, -104, 25, -54, 71, -84, -128, -35, -115, -74, -26, -30, -127, -96, -42]";
		String result = (String) null;
		String url = (String) null;

## website-terminal-copy-paste.html
<!DOCTYPE html>
<html>
  <head>
    <title>Copy-Paste from Website to Terminal</title>
  </head>
  <style>
    .codeblock {
      background-color: lightyellow;
      border: 1px dotted blue;
      margin-left: 50px;

## VeryInsecureHTTPSJava.java
import javax.net.ssl.*;
import java.security.GeneralSecurityException;

/**
 * Vain kehityskäyttöön. Mahdollistaa https://localhost yhteydet ohittamalla Javan SSL turvamekanismit.
 * <p>
 * <ul>
 *   <li>http://stackoverflow.com/questions/2893819/telling-java-to-accept-self-signed-ssl-certificate</li>
 *   <li>http://stackoverflow.com/questions/859111/how-do-i-accept-a-self-signed-certificate-with-a-java-httpsurlconnection</li>
 *   <li>http://stackoverflow.com/questions/2290570/pkix-path-building-failed-while-making-ssl-connection</li>
	import sys
	import requests
	import threading
	import HTMLParser
	from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

	'''
	Description: Reverse MSSQL shell through xp_cmdshell + certutil for exfiltration
	Author: @xassiz
	'''
	# start at home
	cd ~

	ln -sfv /usr/local/opt/redis/*.plist ~/Library/LaunchAgents


	ln -sfv /usr/local/opt/mysql56/*.plist ~/Library/LaunchAgents

	export PATH=./node_modules/.bin:$PATH
	#!/bin/bash

	## Y-Tunnukseen perustuva domainejen haku (.fi)

	## Esimerkki: getdomains 1093944-1 # MTV Oy
	# Laita tämä .bashrc tai .zshrc

	# Käyttöesimerkkejä:

	# Looppaa Y-tunnuksetn kaikki domainit läpi ja tee kysely
	#!/bin/bash

	upload_file () {
	SESSION=df831243-602e-4c27-8afe-09a6760be8ad
	XSRF=83872690-237b-c176-8830-ac11ba76d7b3
	URL="http://192.168.50.1:8080/api/UPLOOOD"
	echo "Handling file $1"
	curl -v -i -X POST -H "Content-Type: multipart/form-data" -H "Cookie: ring-session=$SESSION; XSRF-TOKEN=$XSRF" -F "file=@$1;type=application/vnd.openxmlformats-officedocument.s\
	preadsheetml.sheet" -F "x-xsrf-token=$XSRF" $URL >> logifile.txt 2>&1
	echo "-----------------------" >> logifile.txt
	#!/bin/bash
	set -eu

	URL=$1

	echo "super go bustering for super brute: $URL"

	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/tomcat.txt
	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/nginx.txt
	gobuster -u $URL -l -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/apache.txt
	#!/bin/bash

	set -eu

	echo "Running super enum against $1"

	# quick scan TCP
	# nmap -v -sC -sV -oA initial_nmap $1

	# quick scan UDP
	<?php
	/*
	This file can be useful in conjunction with DNSSpoof
	*/
	?>

	<html>
	<body>

	<audio class="my_audio" preload="none" id = "saundi">
	Reaktor's Java application CTF challenge from Disobey 2018

	It seems I was not the only one struggling with the Java application challenge. There was
	JAR file and that's how it began.

	After decompiling the JAR the main class contained code which didn't do anything. It looks like this:

	String encryptedResult = "[3, 63, -54, -8, -45, -89, -91, 40, -111, -77, -76, -49, 119, 8, -46, 9, -70, 99, -12, 3, 124, 65, -66, 104, -18, 4, 64, 87, 6, -72, 68, 121, -32, -52, -104, 25, -54, 71, -84, -128, -35, -115, -74, -26, -30, -127, -96, -42]";
	String result = (String) null;
	String url = (String) null;
	<!DOCTYPE html>
	<html>
	<head>
	<title>Copy-Paste from Website to Terminal</title>
	</head>
	<style>
	.codeblock {
	background-color: lightyellow;
	border: 1px dotted blue;
	margin-left: 50px;
	import javax.net.ssl.*;
	import java.security.GeneralSecurityException;

	/**
	* Vain kehityskäyttöön. Mahdollistaa https://localhost yhteydet ohittamalla Javan SSL turvamekanismit.
	* <p>
	* <ul>
	* <li>http://stackoverflow.com/questions/2893819/telling-java-to-accept-self-signed-ssl-certificate</li>
	* <li>http://stackoverflow.com/questions/859111/how-do-i-accept-a-self-signed-certificate-with-a-java-httpsurlconnection</li>
	* <li>http://stackoverflow.com/questions/2290570/pkix-path-building-failed-while-making-ssl-connection</li>