| NOTE: I am reading and trying to offer information from what I have seen so far. Everyone will have to conduct their own research and make assessments based on findings. | |
| A way to scan the IFS on an IBM i from QSH | |
| This executes a find utility in QSH | |
| NOTE: this should be on many if not all systems – so far I have tested OS 7.1-7.4 with success *UPDATE I tested this with v5r4 and it worked as well | |
| • SBMJOB = Submits the job, JOB(LOG4JSCAN) names the job, and JOBQ(QCTL) submits it to the controlling subsystem (I have been submitting it here to make sure nothing ends it but you could submit it to another JOBQ) | |
| • Find / = we are searching the root path with find | |
| • -path /QSYS.LIB -prune -o = I am excluding /QSYS.LIB (since it cannot contain .jar files) | |
| • -type f = looking for items of the type files |
You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228
This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders
sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log
| from botocore.hooks import _PrefixTrie | |
| import util | |
| import boto3 | |
| from .s3utils import upload_csv | |
| import time | |
| import pprint | |
| class Pipeline: | |
| def __init__(self, name, target, freq, horizon, s3_bucket, related=None, domain="RETAIL", |
| -- Purpose: Delay job for fractions of a second | |
| -- Author : Scott Forstie | |
| -- Contact: [email protected] | |
| -- Date : June 20, 2019 | |
| cl: addlible QSYSINC; | |
| cl: crtsrcpf qtemp/qcsrc; | |
| cl: addpfm file(qtemp/qcsrc) mbr(usleep); | |
| -- | |
| -- The usleep() function suspends a thread for the number of microseconds specified by the of useconds parameter. |
| -- | |
| -- description: printf to the Joblog, using SQL | |
| -- | |
| cl:addlible qsysinc; | |
| cl:crtsrcpf qtemp/qcsrc; | |
| cl:addpfm file(qtemp/qcsrc) mbr(LPRINTF); | |
| insert into qtemp.qcsrc values | |
| (1,010101,'{'), | |
| (2,010101,'extern int Qp0zLprintf (char *format, ...);'), |
| #include <stdio.h> | |
| #include <stdlib.h> | |
| #include <stdint.h> | |
| #if defined(__POWERPC__) | |
| #include <ppc_intrinsics.h> | |
| #else | |
| #ifdef _MSC_VER | |
| #include <intrin.h> /* for rdtscp and clflush */ | |
| #pragma optimize("gt",on) | |
| #else |
Let Tomcat is download and installed under /opt/tomcat.
Also, let tomcat be a non-provileged user under which the server will be running.
We assume that we keep server's binaries under /opt/tomcat and we will create a server instance named foo under /var/tomcat/ (carrying its own conf, logs, webapps, work, lib directories).
See also https://dzone.com/articles/running-multiple-tomcat.
Create a template service unit file at /etc/systemd/system/[email protected]:
| #!/usr/bin/env python | |
| """ | |
| LICENSE http://www.apache.org/licenses/LICENSE-2.0 | |
| """ | |
| import argparse | |
| import datetime | |
| import sys | |
| import time | |
| import threading |