shenyuanv

/var/profile
find /var/ -type f -exec md5 {} \;

shenyuanv

ipsw=$(find . -name "*.ipsw")
for f in $ipsw;do
    unzip -o $f "kernelcache.*" -d $f.d
done

kernels=$(find . -name "kernelcache.*" -not -name "*.dec")
for k in $kernels;do
    offset=$(LANG=C grep -obUaP "\xff\xcf\xfa\xed" $k | head -n1 | cut -d':' -f1)
    ./lzssdec -o $offset < $k > $k.dec
    echo $offset

shenyuanv

#!/usr/bin/env bash

# ------------------------------------------------------------
# -- Setup parameters
# ------------------------------------------------------------

if [ -z $1 ]; then
	echo "usage: $0 <dir_name>"
	exit;
fi

shenyuanv

@echo off
setlocal
set BackupFolder=C:\Temp
if not exist "%BackupFolder%" md "%BackupFolder%"
for %%a in (HKLM HKCU HKCR HKU HKCC) do (
	echo Exporting %%a to %BackupFolder%\%%a.reg ...
	reg.exe export "%%a" "%BackupFolder%\%%a.reg" /y
)

echo Exporting hosts file ...

shenyuanv

"C:\Program Files\Wireshark\dumpcap.exe" -i "Wi-Fi" -a duration:60 -w ./test.pcap
ftp -s:test.pcap <SERVERDOMAIN.COM>

shenyuanv

#!/usr/bin/env python
import os
import zipfile
from shutil import copyfile

#Process list
#PCAP
#local.host
base_dir = "./base"
pcap_path = base_dir + "/all.pcap"

shenyuanv

#!/usr/bin/env bash

# ------------------------------------------------------------
# -- Setup parameters
# ------------------------------------------------------------

if [ -z $1 ]; then
	echo "usage: $0 <dir_name>"
	exit;
fi

shenyuanv

function Get-StapSuspects(){
    <#
    .SYNOPSIS
	    Dump process binary which connect to specific domain by SystemTap

    .DESCRIPTION
	    Dump process binary which connect to specific domain by SystemTap

    .PARAMETER RemoteHostName
        Domain list you want to check

shenyuanv

from pwn import *
import time

atoi_got = 0x601050
puts_got = 0x601018
sleep_got = 0x601060
setvbuf_got = 0x601048
exit_got = 0x601058
setvbuf_offset = 0x6FE70
sleep_offset = 0xCC230

shenyuanv