Skip to content

Instantly share code, notes, and snippets.

View steeve85's full-sized avatar

Steeve Barbeau steeve85

65 followers · 31 following
View GitHub Profile
@steeve85
steeve85 / git-clone_github-starred-projects.py
Last active May 30, 2018 20:02
Simple script to git clone each GitHub project starred by a user.
#!/usr/bin/env python
import urllib2, json, os, subprocess
# Simple script to git clone each project starred by a user.
# /!\ There is an API rate limit. To increase it, authenticated actions are needed -_-
# http://developer.github.com/v3/#rate-limiting
user = "steeve85"
i = 1
json_data = None
@steeve85
steeve85 / gist:5394539
Created April 16, 2013 09:11
.vimrc configuration for Metasploit // https://github.com/rapid7/metasploit-framework/wiki/Style-Tips
if !exists("au_loaded")
let au_loaded = 1
augroup rb
au FileType ruby set shiftwidth=4 tabstop=4 softtabstop=4 textwidth=78
au FileType ruby set noexpandtab
au FileType ruby hi BogusWhitespace ctermbg=darkgreen guibg=darkgreen
au FileType ruby match BogusWhitespace /\s\+$\|^\t\+ \+\|^ \+\t*/
augroup END
endif
@steeve85
steeve85 / decode_apt1.py
Created March 31, 2013 19:51
xor algo used in an APT1 sample
#!/usr/bin/python
# encoded data
encoded = []
encoded.append([0x2D, 0xC8, 0xD4, 0xDD, 0xCF, 0xCC, 0xDA, 0xC9, 0xDE, 0xC7, 0xD6, 0xF2, 0xF8, 0xE9, 0xF4, 0xE8, 0xF4, 0xFD, 0xEF, 0xC7, 0xCC, 0xF2, 0xF5, 0xFF, 0xF4, 0xEC, 0xE8, 0xC7, 0xD8, 0xEE, 0xE9, 0xE9, 0xFE, 0xF5, 0xEF, 0xCD, 0xFE, 0xE9, 0xE8, 0xF2, 0xF4, 0xF5, 0xC7, 0xC9, 0xEE, 0xF5, 0xB6, 0x00])
encoded.append([0x08, 0x21, 0x0F, 0x39, 0x1C, 0x08, 0x0D, 0x18, 0x09, 0x64, 0x00])
encoded.append([0x26, 0xB2, 0xAE, 0xAE, 0xAA, 0xE0, 0xF5, 0xF5, 0xE8, 0xEB, 0xEC, 0xF4, 0xEB, 0xEF, 0xF4, 0xE8, 0xEB, 0xEA, 0xF4, 0xEC, 0xE2, 0xF5, 0xEB, 0xE3, 0xED, 0xF4, 0xEB, 0xF4, 0xEB, 0xEC, 0xF4, 0xE9, 0x85, 0xED, 0xF4, 0xB2, 0xAE, 0xB7, 0xB6, 0xFC, 0x0, 0x0])
encoded.append([0x32, 0x3D, 0x1F, 0x0A, 0x19, 0x1C, 0x1C, 0x11, 0x5F, 0x44, 0x5E, 0x40, 0x50, 0x58, 0x13, 0x1F, 0x1D, 0x00, 0x11, 0x04, 0x19, 0x12, 0x1C, 0x15, 0x4B, 0x50, 0x3D, 0x23, 0x39, 0x35, 0x50, 0x46, 0x5E, 0x40, 0x4B, 0x50, 0x27, 0x19, 0x1E, 0x14, 0x1F, 0x07, 0x03, 0x50, 0x3E, 0x24, 0x50, 0x45, 0x5E, 0x41, 0x59,
@steeve85
steeve85 / nmap.diff
Created November 20, 2012 09:33
Nmap Bug in Msf
--- lib/msf/core/auxiliary/nmap-error.rb 2012-11-19 11:14:06.000000000 +0100
+++ lib/msf/core/auxiliary/nmap.rb 2012-11-19 11:14:58.000000000 +0100
@@ -225,7 +225,7 @@
disallowed_characters = /([\x00-\x19\x21\x23-\x26\x28\x29\x3b\x3e\x60\x7b\x7c\x7d\x7e-\xff])/n
badchar = str[disallowed_characters]
if badchar
- print_error "Malformed nmap arguments (contains '#{c}'): #{str}"
+ print_error "Malformed nmap arguments (contains '#{badchar}'): #{str}"
return false
end
@steeve85
steeve85 / nmap_scan2
Created June 9, 2012 22:36
Nmap Dionaea stealthier scan
[steeve@omega ~]$ sudo nmap -sS -sV AAA.BBB.CCC.DDD
Starting Nmap 6.00 ( http://nmap.org ) at 2012-06-09 23:54 CEST
Nmap scan report for blah.blah.com (AAA.BBB.CCC.DDD)
Host is up (0.058s latency).
Not shown: 989 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
22/tcp open ssh OpenSSH 5.5p1 Debian 6+squeeze2 (protocol 2.0)
42/tcp open tcpwrapped
80/tcp open http?
@steeve85
steeve85 / nmap_dionaea_smb.py
Created June 9, 2012 22:32
Nmap Dionaea SMB
class SMB_Negociate_Protocol_Response(Packet):
name="SMB Negociate Response"
smb_cmd = SMB_COM_NEGOTIATE #0x72
fields_desc = [
#[..],
ConditionalField(UnicodeNullField("OemDomainName", "HINMAP"), lambda x: not x.Capabilities & CAP_EXTENDED_SECURITY),
# "ServerName" field needed for case without CAP_EXTENDED_SECURITY
ConditionalField(UnicodeNullField("ServerName", "TRYHARDER"), lambda x: not x.Capabilities & CAP_EXTENDED_SECURITY),
#[..],]
@steeve85
steeve85 / nmap_dionaea_http.py
Created June 9, 2012 22:27
Nmap Dionaea http
def list_directory(self, path):
#[..]
r = []
displaypath = cgi.escape(self.header.path)
r.append('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">')
r.append("<html>\n<title>Directory listing for %s</title>\n" % displaypath)
r.append("<body>\n<h2>Directory listing for %s</h2>\n" % displaypath)
r.append("<hr>\n<ul>\n")
for name in list:
fullname = os.path.join(path, name)
@steeve85
steeve85 / nmap_dionaea_ftp.py
Created June 9, 2012 22:18
dionaea ftp function
def handle_established(self):
self.processors()
#self.reply(WELCOME_MSG, "Welcome to the ftp service")
self.reply(WELCOME_MSG, "Microsoft FTP Service")
@steeve85
steeve85 / dionaea_probes
Created June 9, 2012 21:34
Nmap dionaea probes
match ftp m|^220 Welcome to the ftp service\r\n| p/Dionaea honeypot ftpd/
match http m|^HTTP/1\.0 200 OK\r\nContent-type: text/html; charset=utf-8\r\nContent-Length: 204\r\n\r\n<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 3\.2 Final//EN\"><html>\n<title>Directory listing for /</title>\n<body>\n<h2>Directory listing for /</h2>\n<hr>\n<ul>\n<li><a href=\"\.\./\">\.\./</a>\n</ul>\n<hr>\n</body>\n</html>\n$| p/Dionaea honeypot httpd/
match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x98\x01\x40\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff\x40\x06\0\0\x01\0\x11\x07\0\x03\x01\0\x01\0\0\x10\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\0\0..........\x00\x34\0W\0O\0R\0K\0G\0R\0O\0U\0P\0\0\0H\0O\0M\0E\0U\0S\0E\0R\0-\0.\0.\0.\0.\0.\0.\0\0\0|s p/Dionaea honeypot smbd/
match ms-sql-s m|^\x04\x01\x00\x2b\x00\x00\x00\x00\x00\x00\x1a\x00\x06\x01\x00\x20\x00\x01\x02\x00\x21\x00\x01\x03\x00\x22\x00\x00\x04\x00\x22\x00\x01\xff\x08\x00\x02\x10\x00\x00\x02\x00\x00| p/Dionaea honeypot MS-SQL server/
@steeve85
steeve85 / nmap_probes
Created June 9, 2012 21:32
Nmap probes examples
match backdoor m|^PWD$| p/Subseven backdoor/ i/**BACKDOOR**/ o/Windows/
match asterisk m|^Asterisk Call Manager/([\d.]+)\r\n| p/Asterisk Call Manager/ v/$1/
match quake3 m|^\xff\xff\xff\xffdisconnect$| p/Quake 3 dedicated server/
Probe TCP mydoom q|\x0d\x0d|
rarity 9
ports 706,3127-3198
match mydoom m|\x04\x5b\0\0\0\0\0\0| p/MyDoom virus backdoor/ v/v012604/
# Windows 2003