Skip to content

Instantly share code, notes, and snippets.

View michaellrowley's full-sized avatar
😃

Michael Rowley michaellrowley

😃
View GitHub Profile
@michaellrowley
michaellrowley / IRPs.h
Created April 29, 2023 01:06
The IRP major function codes in hexadecimal, as exported from wdm.h in Wine
#define IRP_MJ_MAXIMUM_FUNCTION 0x1b
#define IRP_MJ_CREATE 0x00
#define IRP_MJ_CREATE_NAMED_PIPE 0x01
#define IRP_MJ_CLOSE 0x02
#define IRP_MJ_READ 0x03
#define IRP_MJ_WRITE 0x04
#define IRP_MJ_QUERY_INFORMATION 0x05
#define IRP_MJ_SET_INFORMATION 0x06
#define IRP_MJ_QUERY_EA 0x07
#define IRP_MJ_SET_EA 0x08
@michaellrowley
michaellrowley / NTerrors.hpp
Last active January 30, 2023 22:14
Map of NTSTATUS Error Codes
{0x00000000, {"SUCCESS", "The operation completed successfully."}},
{0x00000000, {"WAIT_0", "The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."}},
{0x00000001, {"WAIT_1", "The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."}},
{0x00000002, {"WAIT_2", "The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."}},
{0x00000003, {"WAIT_3", "The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."}},
{0x0000003F, {"WAIT_63", "The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."}},
{0x00000080, {"ABANDONED", "The caller attempted to wait for a mutex that has been abandoned."}},
{0x00000080, {"ABANDONED_WAIT_0", "The caller attemp
@michaellrowley
michaellrowley / ssrf-detection.go
Created March 6, 2022 14:34
Go SSRF detection
package main
import (
"fmt"
"net"
)
// CIDR explanation: https://docs.netgate.com/pfsense/en/latest/network/cidr.html
var localHostnames = []string{
// https://datatracker.ietf.org/doc/html/rfc5735
@michaellrowley
michaellrowley / DriverInteraction.bat
Last active March 6, 2022 14:31
Driver interaction batch script
# Create an instance of a driver
sc create drivername type=kernel binpath="C:\Users\redacted\Desktop\Driverpath.sys"
# Load/Start the driver
sc start drivername
# Unload/stop the driver
sc stop drivername
# Delete that instance of a driver
sc delete drivername