own2pwn

/*
 *********************************************************************

  Part of UEFI DXE driver code that injects Hyper-V VM exit handler
  backdoor into the Device Guard enabled Windows 10 Enterprise.
  
  Execution starts from new_ExitBootServices() -- a hook handler 
  for EFI_BOOT_SERVICES.ExitBootServices() which being called by
  winload!OslFwpKernelSetupPhase1(). After DXE phase exit winload.efi
  transfers exeution to previously loaded Hyper-V kernel (hvix64.sys)

own2pwn

import datetime, requests
import numpy as np
import matplotlib.pyplot as plt
import matplotlib.dates as mdates
import json, collections, os

UTC_OFFSET = -14400 # Local offset from UTC
START_DATE = "2016-01-01" # Day to start chat
TMP_DIR = "/tmp" # Writable temp directory, without trailing slash

own2pwn

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#ifdef _MSC_VER
#include <intrin.h> /* for rdtscp and clflush */
#pragma optimize("gt",on)
#else
#include <x86intrin.h> /* for rdtscp and clflush */
#endif

own2pwn

#import <Foundation/Foundation.h>

typedef uint64_t CGSSpace;
typedef uint64_t CGSManagedDisplay;
typedef int CGSConnection;

typedef enum _CGSSpaceSelector {
	kCGSSpaceCurrent = 5,
	kCGSSpaceOther = 6,
	kCGSSpaceAll = 7

own2pwn

static void dispatch_repeated_internal(dispatch_time_t firstPopTime, double intervalInSeconds, dispatch_queue_t queue, void(^work)(BOOL *stop))
{    
    __block BOOL shouldStop = NO;
    dispatch_time_t nextPopTime = dispatch_time(firstPopTime, (int64_t)(intervalInSeconds * NSEC_PER_SEC));
    dispatch_after(nextPopTime, queue, ^{
        work(&shouldStop);
        if(!shouldStop)
        {
            dispatch_repeated_internal(nextPopTime, intervalInSeconds, queue, work);
        }

own2pwn

static void dispatch_repeated_internal(dispatch_time_t firstPopTime, double intervalInSeconds, dispatch_queue_t queue, void(^work)(BOOL *stop))
{    
    __block BOOL shouldStop = NO;
    dispatch_time_t nextPopTime = dispatch_time(firstPopTime, (int64_t)(intervalInSeconds * NSEC_PER_SEC));
    dispatch_after(nextPopTime, queue, ^{
        work(&shouldStop);
        if(!shouldStop)
        {
            dispatch_repeated_internal(nextPopTime, intervalInSeconds, queue, work);
        }

own2pwn

##Creating a timer with Grand Central Dispatch

At the following is the implementation file of a sample class that shows, how to make a timer with the help of Grand Central Dispatch. The timer fires on a global queue, just change the queue to the main queue or any custom queue and the timer fires on this queue and not on the global queue anymore.

#import <Foundation/Foundation.h>

@interface SampleClass : NSObject
- (void)startTimer;

own2pwn

##Creating a timer with Grand Central Dispatch

At the following is the implementation file of a sample class that shows, how to make a timer with the help of Grand Central Dispatch. The timer fires on a global queue, just change the queue to the main queue or any custom queue and the timer fires on this queue and not on the global queue anymore.

#import <Foundation/Foundation.h>

@interface SampleClass : NSObject
- (void)startTimer;

own2pwn

1. XSS in feedback form. Got access to moderator account. Nothing useful here though, except the list of approved accounts.
2. Trying to register own team - got password to email. Password is 4 digits, so can be easily bruteforced.
3. Login form is protected with simple captcha. Wrote simple script using pytesseract https://github.com/madmaze/pytesseract to recognize captcha and bruteforce login form. After 10 minutes got password for one of approved team account.

import sys                                                                 
import io                   
import re                     
import requests                     
import pytesseract            

own2pwn

Twitter Official Consumer Key

Twitter for Android

type:            PIN
Consumer key:    3nVuSoBZnx6U4vzUxf5w
Consumer secret: Bcs59EFbbsdF6Sl9Ng71smgStWEGwXXKSjYvPVt7qys

Twitter for iPhone

type:            PIN

Consumer key: IQKbtAYlXLripLGPWd0HUA