Misc OSCE scripts
These are scripts I wrote while working on my OSCE. They were all written prior to any exam attempt and are a snapshot of my thinking prior to any exam attempt.
Generally speaking, these scripts are to more easily shove bytes around.
00diff
00diff is a "horizontal diff" that is intended to eat files of hexadecimal characters and display the differences between them.
Screenshot:
root@kali:~/Desktop/OSCE/6# python ~/Desktop/00diff.py orig.00 new.00
orig.00 0x00000000 6681caff 0f42526a 0258cd2e 3c055a74
new.00 0x00000000 6681caff 0f42526a 0258cd00 3c055a74
^^
Download:
Listing directory https://download.elifulkerson.com/files/00diff/0.1:
00diff July 03 2019 15:39:29 3119 Python script, ASCII text executable
00diff.asc July 03 2019 15:43:34 801 GnuPG signature
00diff.md5 July 03 2019 15:43:34 41 MD5 checksum
00diff.sha1 July 03 2019 15:43:34 49 SHA1 checksum
00diff.sha256 July 03 2019 15:43:34 73 SHA256 checksum
00diff.sha512 July 03 2019 15:43:34 137 SHA512 checksum
↩ Browse the download server
badbytes
badbytes is a script to quickly determine if any particular "bad" bytes are present in a file, and their position
cat badbytes.py | ./badbytes.py "02 20 00"
Download:
Listing directory https://download.elifulkerson.com/files/badbytes/0.1:
badbytes July 03 2019 15:40:50 511 Python script, ASCII text executable
badbytes.asc July 03 2019 15:43:55 801 GnuPG signature
badbytes.md5 July 03 2019 15:43:55 43 MD5 checksum
badbytes.sha1 July 03 2019 15:43:55 51 SHA1 checksum
badbytes.sha256 July 03 2019 15:43:55 75 SHA256 checksum
badbytes.sha512 July 03 2019 15:43:55 139 SHA512 checksum
↩ Browse the download server
inversebytes
inversebytes is a script where given a set of bytes will return the opposite set of bytes. For instance, if you pass it a single byte it will return the 255 other possible bytes that don't include what you sent. Bytes are specified in hex in the form "000102030405" for instance to specify 0x00, 0x01, 0x02, 0x03, 0x04, 0x05.
Download:
Listing directory https://download.elifulkerson.com/files/inversebytes/0.1:
inversebytes July 03 2019 15:41:32 317 Python script, ASCII text executable
inversebytes.asc July 03 2019 15:45:31 801 GnuPG signature
inversebytes.md5 July 03 2019 15:45:31 47 MD5 checksum
inversebytes.sha1 July 03 2019 15:45:31 55 SHA1 checksum
inversebytes.sha256 July 03 2019 15:45:32 79 SHA256 checksum
inversebytes.sha512 July 03 2019 15:45:32 143 SHA512 checksum
↩ Browse the download server
encoder
This is my shellcode encoder/decoder. You will need to read the code for the syntax, it isn't directly useful from the command line.
Download:
Listing directory https://download.elifulkerson.com/files/encoder/0.1:
decoder_lib.py June 03 2019 02:33:02 27160 Python script, ASCII text executable
decoder_lib.py.asc July 03 2019 15:44:42 801 GnuPG signature
decoder_lib.py.md5 July 03 2019 15:44:43 49 MD5 checksum
decoder_lib.py.sha1 July 03 2019 15:44:43 57 SHA1 checksum
decoder_lib.py.sha256 July 03 2019 15:44:43 81 SHA256 checksum
decoder_lib.py.sha512 July 03 2019 15:44:43 145 SHA512 checksum
decoder_settings.py June 03 2019 02:27:26 692 ASCII text
decoder_settings.py.asc July 03 2019 15:44:49 801 GnuPG signature
decoder_settings.py.md5 July 03 2019 15:44:49 54 MD5 checksum
decoder_settings.py.sha1 July 03 2019 15:44:49 62 SHA1 checksum
decoder_settings.py.sha256 July 03 2019 15:44:49 86 SHA256 checksum
decoder_settings.py.sha512 July 03 2019 15:44:50 150 SHA512 checksum
encode June 03 2019 02:27:26 862 Python script, ASCII text executable
encode.asc July 03 2019 15:45:02 801 GnuPG signature
encode.md5 July 03 2019 15:45:02 41 MD5 checksum
encode.sha1 July 03 2019 15:45:02 49 SHA1 checksum
encode.sha256 July 03 2019 15:45:02 73 SHA256 checksum
encode.sha512 July 03 2019 15:45:02 137 SHA512 checksum
encode_math June 03 2019 02:27:26 666 Python script, ASCII text executable
encode_math.asc July 03 2019 15:45:10 801 GnuPG signature
encode_math.md5 July 03 2019 15:45:10 46 MD5 checksum
encode_math.sha1 July 03 2019 15:45:10 54 SHA1 checksum
encode_math.sha256 July 03 2019 15:45:11 78 SHA256 checksum
encode_math.sha512 July 03 2019 15:45:11 142 SHA512 checksum
↩ Browse the download server
bytes
I gave bytes its own page. It is an attempt at a general purpose format converter for the various byte representations.
http-proxy-to-js-inject
This is an http proxy program that if it intercepts a POST request generates some javascript that would send that same POST request as a Javascript injection.
Download:
Listing directory https://download.elifulkerson.com/files/http-proxy-to-js-inject/0.1/:
http-proxy-to-js-inject.py July 03 2019 15:41:11 1400 Python script, ASCII text executable
http-proxy-to-js-inject.py.asc July 03 2019 16:09:38 801 GnuPG signature
http-proxy-to-js-inject.py.md5 July 03 2019 16:09:38 61 MD5 checksum
http-proxy-to-js-inject.py.sha1 July 03 2019 16:09:38 69 SHA1 checksum
http-proxy-to-js-inject.py.sha256 July 03 2019 16:09:38 93 SHA256 checksum
http-proxy-to-js-inject.py.sha512 July 03 2019 16:09:38 157 SHA512 checksum
↩ Browse the download server
