Skip to content

Instantly share code, notes, and snippets.

View secretnonempty's full-sized avatar

r0b0t secretnonempty

17 followers · 146 following
View GitHub Profile
@secretnonempty
secretnonempty / ip6_expl_poc.c
Created April 6, 2021 21:43 — forked from Cryptogenic/ip6_expl_poc.c
Kernel exploit POC (Proof-of-Concept) for IP6_EXTHDR_CHECK double free (CVE-2020-9892). Interleaves with multi-threads for code exec. Mainly a reference for PS4 implementation.
/*
* IP6_EXTHDR_CHECK Double Free (CVE-2020-9892) Exploit PoC for FreeBSD 9.0
* https://github.com/google/security-research/security/advisories/GHSA-gxcr-cw4q-9q78
* -
* Bug credit: Andy Nguyen (@theflow0)
* Exploit credit: @SpecterDev, @tihmstar
* Thanks: @sleirsgoevy, @littlelailo, flatz (@flat_z), @balika011
* -
* Build: gcc -o expl ip6_expl_poc.c -pthread
* -
@secretnonempty
secretnonempty / udp2tcp_dns.py
Created July 12, 2020 05:29 — forked from 4ft35t/udp2tcp_dns.py
Convert DNS UDP to TCP
#!/usr/bin/python
import socket, os, select, struct
import errno
import logging
from logging import info, warn, error
logging.root.setLevel(logging.INFO)
@secretnonempty
secretnonempty / proxy_s5.py
Created July 10, 2020 23:11 — forked from yaonie/proxy_s5.py
#!/usr/bin/python
# Filename s5.py
# Python Dynamic Socks5 Proxy
# Usage: python s5.py 1080
# Background Run: nohup python s5.py 1080 &
# Email: ringzero@557.im
import socket, sys, select, SocketServer, struct, time
class ThreadingTCPServer(SocketServer.ThreadingMixIn, SocketServer.TCPServer): pass
@secretnonempty
secretnonempty / proxy.py
Created June 22, 2020 21:51 — forked from scturtle/proxy.py
use opera's built-in VPN as proxy
#!/usr/bin/env python3
import asyncio
from vpn import get_proxy
proxy = port = auth = None
pool = asyncio.Queue(5)
psize = 0
async def process_client(client_reader, client_writer, *, CHUNK=4096):
global psize
@secretnonempty
secretnonempty / DmaHvBackdoor.c
Created August 13, 2019 21:35 — forked from Cr4sh/DmaHvBackdoor.c
Hyper-V backdoor for UEFI
/*
*********************************************************************
Part of UEFI DXE driver code that injects Hyper-V VM exit handler
backdoor into the Device Guard enabled Windows 10 Enterprise.
Execution starts from new_ExitBootServices() -- a hook handler
for EFI_BOOT_SERVICES.ExitBootServices() which being called by
winload!OslFwpKernelSetupPhase1(). After DXE phase exit winload.efi
transfers exeution to previously loaded Hyper-V kernel (hvix64.sys)
@secretnonempty
secretnonempty / hashcat_macos.sh
Created June 19, 2018 13:46 — forked from chadmayfield/hashcat_macos.sh
Install Hashcat on macOS
#!/bin/bash
git clone https://github.com/hashcat/hashcat.git
mkdir -p hashcat/deps
git clone https://github.com/KhronosGroup/OpenCL-Headers.git hashcat/deps/OpenCL
cd hashcat/ && make
./hashcat --version
./hashcat -b -D 1,2
./example0.sh
@secretnonempty
secretnonempty / cross_and_static_compile_shadowsocks-libev.sh
Created May 21, 2018 07:07 — forked from harv/cross_and_static_compile_shadowsocks-libev.sh
cross & static compile shadowsocks-libev
#!/bin/sh
# cross & static compile shadowsocks-libev
PCRE_VER=8.41
PCRE_FILE="http://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-$PCRE_VER.tar.gz"
MBEDTLS_VER=2.6.0
MBEDTLS_FILE="https://tls.mbed.org/download/mbedtls-$MBEDTLS_VER-gpl.tgz"
@secretnonempty
secretnonempty / addsym.cpp
Created March 26, 2017 03:09 — forked from ikonst/addsym.cpp
Adds IDA symbols as WinDbg synthetic symbols
// Adds IDA symbols as WinDbg synthetic symbols
//
// Original code by 'blabb'.
//
// See:
// http://www.woodmann.com/forum/entry.php?262-addsym-windbg-extension-%28extension-to-load-names-from-ida-to-windbg%29
// http://reverseengineering.stackexchange.com/questions/3850/importing-list-of-functions-and-addresses-into-windbg
#include <engextcpp.hpp>