Skip to content

Instantly share code, notes, and snippets.

from collections import Counter
from scapy.all import *
import pandas as pd
import seaborn as sns
import matplotlib.pyplot as plt
def buildPktList():
pcap_file = rdpcap('sender.pcap')
@scratchadams
scratchadams / gist:43607661cbd86137cbcf9e540e2a73ec
Created March 28, 2023 15:10
WASM sanitizer for acropalypse
(module
(import "js" "mem" (memory 1))
(import "console" "log" (func $log (param i32)))
(func $getbyte (param $pos i32) (result i32)
local.get $pos
i32.const 255
i32.and
)
@scratchadams
scratchadams / msg-stitch.py
Created October 19, 2022 00:06
Script to export msg data from teamviewer traffic
from scapy.all import *
import sys
import binascii
import uuid
def buildPktList():
pcap_file = rdpcap('teamviewer-sent.pcapng')
pkt_list = []
@scratchadams
scratchadams / icmp-pcap.xx
Created September 26, 2022 20:24
xx example for icmp pcap
╟ PCAP File Header ╢
╒═════════════════════════════════════════════════════╕
│ │
│ ┌ ┐ ════════════════════════════ │
d4c3 b2a1 │ Magic Number
│ │ ╌╌╌╌ ╌╌╌╌ │ ════════════════════════════ │
0200 0400 │ Major Version/Minor Version
│ │ ╌╌╌╌ ╌╌╌╌ │ ════════════════════════════ │
0000 0000 │ Reserved
│ │ ╌╌╌╌ ╌╌╌╌ │ ════════════════════════════ │
@scratchadams
scratchadams / office-servercache.ps1
Created June 3, 2022 15:41
PSFalcon Script to Check Office Server Cache
$ids = Import-Csv .\test-hosts.csv
$HostIds = $ids.ID
$Param = @{
Command = 'getsid'
HostIds = $HostIds
}
$results = Invoke-FalconRTR @Param
for (cur = g_list_last(follow_info_.payload); cur; cur = g_list_previous(cur)) {
if (dialogClosed() || !isReadRunning) break;
***
QByteArray buffer;
if (!skip) {
//add exception for MUHPROTO
if(follow_type_ == FOLLOW_MUHPROTO) {
buffer.clear();