Mariusz Banach mgeeky

tmux cheat sheet

(C-x means ctrl+x, M-x means alt+x)

Prefix key

The default prefix is C-b. If you (or your muscle memory) prefer C-a, you need to add this to ~/.tmux.conf:

remap prefix to Control + a

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

Exploiting Lua 5.1 on 32-bit Windows

The following Lua program generates a Lua bytecode program called ignore-unsigned-sga.fnt, which in turn loads a DLL from within an extremely locked down Lua 5.1 sandbox in a program called RelicCOH2.exe. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

if string.dump(function()end):sub(1, 12) ~= "\27Lua\81\0\1\4\4\4\8\0" then
  error("This generator requires a 32-bit version of Lua 5.1")
end

local function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed

	#!/bin/bash

	if [ "$1" = "-h" -o "$1" = "--help" -o -z "$1" ]; then cat <<EOF
	appify v3.0.1 for Mac OS X - http://mths.be/appify
	Creates the simplest possible Mac app from a shell script.

	Appify takes a shell script as its first argument:

	`basename "$0"` my-script.sh

	# GNU Screen - main configuration file
	# All other .screenrc files will source this file to inherit settings.
	# Author: Christian Wills - [email protected]

	# Allow bold colors - necessary for some reason
	attrcolor b ".I"

	# Tell screen how to set colors. AB = background, AF=foreground
	termcapinfo xterm 'Co#256:AB=\E[48;5;%dm:AF=\E[38;5;%dm'

	# the following two lines give a two-line status, with the current window highlighted
	hardstatus alwayslastline
	hardstatus string '%{= kG}[%{G}%H%? %1`%?%{g}][%= %{= kw}%-w%{+b yk} %n*%t%?(%u)%? %{-}%+w %=%{g}][%{B}%m/%d %{W}%C%A%{g}]'

	# huge scrollback buffer
	defscrollback 5000

	# no welcome message
	startup_message off

	#!/usr/bin/env ruby
	#
	# Proof-of-Concept exploit for Rails Remote Code Execution (CVE-2013-0156)
	#
	# ## Advisory
	#
	# https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
	#
	# ## Caveats
	#

	#include <windows.h>
	#include <wchar.h>

	#define LOAD_LIBRARY_SEARCH_SYSTEM32 (0x00000800)

	HMODULE loadlibrary_system(const wchar_t* name)
	{
	/* If running on Windows 8 or a system with KB2533623, LoadLibraryEx with
	LOAD_LIBRARY_SEARCH_SYSTEM32 does the right thing */
	if (GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "AddDllDirectory"))

-param(
-    [parameter(Mandatory=$true)]
-	[string] $path
-)
-# the code below has been used from
-#    https://blogs.technet.com/b/heyscriptingguy/archive/2013/10/19/weekend-scripter-use-powershell-and-pinvoke-to-remove-stubborn-files.aspx
-# with inspiration from
-#    http://www.leeholmes.com/blog/2009/02/17/moving-and-deleting-really-locked-files-in-powershell/
-# and error handling from

	// MIT License - Copyright (c) 2016 Can Güney Aksakalli
	// https://aksakalli.github.io/2014/02/24/simple-http-server-with-csparp.html

	using System;
	using System.Collections.Generic;
	using System.Linq;
	using System.Text;
	using System.Net.Sockets;
	using System.Net;
	using System.IO;