Skip to content

Instantly share code, notes, and snippets.

View tuantmb's full-sized avatar
😹

Tuan T tuantmb

😹
  • Vietnam
View GitHub Profile
@tuantmb
tuantmb / add CA cert on CentOS Debian Ubuntu.md
Created October 19, 2022 08:35 — forked from kekru/add CA cert on CentOS Debian Ubuntu.md
Add CA cert to local trust store on CentOS, Debian or Ubuntu
  • Open a webpage that uses the CA with Firefox
  • Click the lock-icon in the addressbar -> show information -> show certificate
  • the certificate viewer will open
  • click details and choose the certificate of the certificate-chain, you want to import to CentOS
  • click "Export..." and save it as .crt file
  • Copy the .crt file to /etc/pki/ca-trust/source/anchors on your CentOS machine
  • run update-ca-trust extract
  • test it with wget https://thewebsite.org
@tuantmb
tuantmb / unzip_zip_infected.md
Created August 23, 2022 07:15
Automatically zip & unzip file with password 'infected' 
➞  cat /usr/bin/zipm                                                                                                                                                                                                  system: ruby 3.0.4p208
#!/bin/bash
/usr/bin/zip -er9P infected "$@"

➞  cat /usr/bin/unzipm                                                                                                                                                                                                system: ruby 3.0.4p208
#!/bin/bash
/usr/bin/unzip -P infected "$@"
@tuantmb
tuantmb / New-SYSVOLZip.ps1
Created August 12, 2022 15:43 — forked from HarmJ0y/New-SYSVOLZip.ps1
Compresses all of SYSVOL to a local .zip file.
function New-SYSVOLZip {
<#
.SYNOPSIS
Compresses all folders/files in SYSVOL to a .zip file.
Author: Will Schroeder (@harmj0y)
License: BSD 3-Clause
Required Dependencies: None
@tuantmb
tuantmb / Get-NonstandardService.ps1
Created August 12, 2022 15:41 — forked from enigma0x3/Get-NonstandardService.ps1
Get-NonstandardService
function Get-NonstandardService {
<#
.SYNOPSIS
Returns services where the associated binaries are either not signed, or are
signed by an issuer not matching 'Microsoft'.
Author: Will Schroeder (@harmj0y)
License: BSD 3-Clause
Required Dependencies: None
@tuantmb
tuantmb / ClassUtils.java
Created July 7, 2022 06:58 — forked from JimmyFrix/ClassUtils.java
A utility class for loading and listing classes from a package.
package org.odysseus.util;
import java.io.File;
import java.util.ArrayList;
import java.util.List;
/**
* A utility class for classes.
*
* @author Jimmy Frix
@tuantmb
tuantmb / localgroupmembershipchanges.kql
Created July 2, 2022 10:12 — forked from alexverboon/localgroupmembershipchanges.kql
Hunting for local group membership changes
let ADAZUsers = IdentityInfo
| extend DirectoryDomain = AccountDomain
| extend DirectoryAccount = AccountName
| distinct DirectoryDomain , DirectoryAccount , OnPremSid , CloudSid, AccountUpn, GivenName, Surname;
// check for any new created or modified local accounts
let NewUsers = DeviceEvents
| where ActionType contains "UserAccountCreated" // or ActionType contains "UserAccountModified"
| extend lUserAdded = AccountName
| extend NewUserSID = AccountSid
| extend laccountdomain = AccountDomain
@tuantmb
tuantmb / feedly.opml
Created July 2, 2022 03:31 — forked from breakersall/feedly.opml
Feedly Security Feed
<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0">
<head>
<title>Matt subscriptions in feedly Cloud</title>
</head>
<body>
<outline text="RedTeaming" title="RedTeaming">
<outline type="rss" text="Strategic Cyber LLC" title="Strategic Cyber LLC" xmlUrl="http://blog.strategiccyber.com/feed/" htmlUrl="https://blog.cobaltstrike.com"/>
<outline type="rss" text="Silent Break Security" title="Silent Break Security" xmlUrl="http://silentbreaksecurity.com/feed/" htmlUrl="https://silentbreaksecurity.com"/>
@tuantmb
tuantmb / SimpleHTTPServerWithUpload.py
Created June 18, 2022 04:11 — forked from 591342534/SimpleHTTPServerWithUpload.py
Simple Python Http Server with Upload
#!/usr/bin/env python
"""Simple HTTP Server With Upload.
This module builds on BaseHTTPServer by implementing the standard GET
and HEAD requests in a fairly straightforward manner.
"""
@tuantmb
tuantmb / backdoor_client.py
Created June 15, 2022 07:07
Source: https://www.bleepingcomputer.com/news/security/new-syslogk-linux-rootkit-uses-magic-packets-to-trigger-backdoor/
import socket
import ssl
import time
HOST = "127.0.0.1"
PORT = 42678
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client.setsockopt(sock.SOL_SOCKET, socket. SO_REUSEADDR, 1)
@tuantmb
tuantmb / list_gcp_iprange.sh
Created June 7, 2022 07:07 — forked from n0531m/list_gcp_iprange.sh
Google Cloud Platform : ip address range
#!/bin/bash
# https://cloud.google.com/compute/docs/faq#find_ip_range
# nslookup -q=TXT _cloud-netblocks.googleusercontent.com 8.8.8.8
myarray=()
for LINE in `dig txt _cloud-netblocks.googleusercontent.com +short | tr " " "\n" | grep include | cut -f 2 -d :`
do
myarray+=($LINE)
for LINE2 in `dig txt $LINE +short | tr " " "\n" | grep include | cut -f 2 -d :`