BwRy / exploit.html

Created October 12, 2023 11:51 — forked from mistymntncop/exploit.html

BwRy / exploit-1104608.js

Created October 12, 2023 11:51 — forked from mistymntncop/exploit-1104608.js

	// POC Exploit for v8 issue 1104608 (https://bugs.chromium.org/p/chromium/issues/detail?id=1104608)
	// author: @mistymntncop
	// bug discovered by: @r3tr0spect2019
	// Exploit strategy based on @r3tr0spect2019's "Real World CTF" presentation on the bug.
	// https://www.youtube.com/watch?v=rSaIlBWwxsY
	//
	// Build d8 using:
	// a) Run once
	// git checkout 3505cf00eb4c59b87f4b5ec9fc702f7935fdffd0
	// gclient sync --with_branch_heads

BwRy / DWARF VM line machine notes

Created October 12, 2023 11:51 — forked from mistymntncop/DWARF VM line machine notes

	DWARF has a clever (too clever?) VM representation for source line to asm mapping.
	VM has state which represents virtual program and source line counters.
	The DW_LNS_advance_pc instruction advances the program counter while the DW_LNS_advance_line instruction
	advances the line counter. Both these instructions encode the "advance amount" value as a variably sized immediate operand.
	The DW_LNS_copy instructions tells us that current VM pc and source counter states correspond together
	both counter values can be copied to a array of line numbers and assembly addresses. When the VM reads a byte from the
	instruction stream it compares this value with a VM specified "opcode base" variable. If the value is below the "opcode base"
	then it represents an opcode for an instruction. If the value is above the "opcode base" then it represents the operand for
	an implicit "instruction". This special implicit "instruction" advances both the program and source line counters at once
	using this single byte value. But how

BwRy / ImageMagick-snippets.md

Created July 10, 2023 13:39 — forked from MohamedAlaa/ImageMagick-snippets.md

ImageMagick Snippets

Remove white background color of an image in ImageMagick

$ convert  your.jpg  -transparent white  your.png

Flatten a transparent image with a white background:

BwRy / tmux-cheatsheet.markdown

Created July 10, 2023 13:39 — forked from MohamedAlaa/tmux-cheatsheet.markdown

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

BwRy / CMake_3_20_Ubuntu_18_04.md

Created March 27, 2023 11:48 — forked from bmegli/CMake_3_20_Ubuntu_18_04.md

CMake 3.20 in Ubuntu 18.04 (reversible way)

Check current version

BwRy / exfiltrate.html

Created March 21, 2019 22:25 — forked from HacKanCuBa/exfiltrate.html

PoC to exfiltrate signal-desktop messages exploiting CVE-2018-11101 or CVE-2018-10994

	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="utf-8"/>
	<!--
	DO NOT USE THIS IN REAL LIFE, IT'S JUST A POC! Be nice, don't hack activists :)
	by HacKan: https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injection-variant-2
	under GNU GPL v3.0+
	-->
	</head>

BwRy / spectre.c

Created January 19, 2018 21:42 — forked from ErikAugust/spectre.c

Spectre example code

	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#ifdef _MSC_VER
	#include <intrin.h> /* for rdtscp and clflush */
	#pragma optimize("gt",on)
	#else
	#include <x86intrin.h> /* for rdtscp and clflush */
	#endif

BwRy / eternalblue7_exploit.py

Created January 4, 2018 21:23 — forked from worawit/eternalblue7_exploit.py

Eternalblue exploit for Windows 7/2008

	#!/usr/bin/python
	# This file has no update anymore. Please see https://github.com/worawit/MS17-010
	from impacket import smb
	from struct import pack
	import sys
	import socket

	'''
	EternalBlue exploit for Windows 7/2008 by sleepya
	The exploit might FAIL and CRASH a target system (depended on what is overwritten)

BwRy / Get-Functions.ps1

Created October 30, 2017 16:45 — forked from dfch/Get-Functions.ps1

Enumerate all functions in a PowerShell script file via AST

	#Requires -Version 3
	# http://d-fens.ch/2015/04/26/nobrainer-enumerate-all-functions-in-a-powershell-script-file-via-ast
	[CmdletBinding(
	SupportsShouldProcess = $true
	,
	ConfirmImpact = 'Low'
	,
	DefaultParameterSetName = 'list'
	)]
	Param