Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

anonyco

//(function(){"use strict";

var Object_freeze = Object.freeze;

/**
 * @param {!Array<MutationRecord>} mutationRecords
 * @return {undefined}
 */
function redoMutations(undidMutations) {
  if (undidMutations) for (var i=undidMutations.length|0, record, type, target, addedNodes, removedNodes, nextSibling, value; i; ) {

liach

Minecraft Forge and FabricMC both have similar infrastructures: mod loaders, mod api, gradle build tools, deobuscation tools.

Mod loader: supposed to just load mods in Minecraft and deobfuscate the game.
Mod API: Offer events, loaders, hooks (e.g. model loading systems, config systems, standard energy API)
Gradle build tool: The gradle plugin that is used to build mods
Deobfuscation tool: Converts obfuscated Minecraft to deobfuscated ones so that modders can understand what they are modding

Minecraft Forge:
 - Mod loader: Forge (more exactly, fmllauncher source set since 1.13, previously FML)
 - Mod API: Forge (previously Forge and part of FML)

ppoffice

#!/bin/sh
# Modified from ivandavidov/minimal-linux-script
# https://github.com/ivandavidov/minimal-linux-script
# This script includes a dynamic linked busybox, openssl, python and
# network support

set -ex

KERNEL_VERSION=4.17.2
BUSYBOX_VERSION=1.28.4

jaykishanmutkawoa

root@Socat-TLS-Client:~/tls13_new/socat-1.7.3.2# diff -uNp sslcls.c.orig sslcls.c
--- sslcls.c.orig       2018-03-17 10:47:30.239634794 -0400
+++ sslcls.c    2018-03-17 04:40:53.144981137 -0400
@@ -147,6 +147,26 @@ const SSL_METHOD *sycTLSv1_2_server_meth
 }
 #endif

+#if HAVE_TLSv1_3_client_method
+const SSL_METHOD *sycTLSv1_3_client_method(void) {
+   const SSL_METHOD *result;

fodra

Javascript encoding type values

The character encodings currently supported by Node.js include:

• 'ascii' - For 7-bit ASCII data only. This encoding is fast and will strip the high bit if set.

• 'utf8' - Multibyte encoded Unicode characters. Many web pages and other document formats use UTF-8.

• 'utf16le' - 2 or 4 bytes, little-endian encoded Unicode characters. Surrogate pairs (U+10000 to U+10FFFF) are supported.

FZX

gsettings set org.cinnamon.desktop.privacy remember-recent-files false
gsettings set org.cinnamon.theme name "Mint-Y-Dark"
gsettings set org.cinnamon.desktop.interface gtk-theme "Mint-Y-Dark"
gsettings set org.cinnamon.desktop.wm.preferences theme "Mint-Y-Dark"
gsettings set org.cinnamon.desktop.interface cursor-blink false

gsettings set org.gnome.system.proxy autoconfig-url "http://mediahint.com/default.pac"
gsettings set org.gnome.system.proxy mode auto

gsettings set org.cinnamon enabled-applets "['panel1:left:0:[email protected]:0', 'panel1:left:2:[email protected]:2', 'panel1:left:3:[email protected]:3', 'panel1:right:0:[email protected]:4', 'panel1:right:1:[email protected]:5', 'panel1:right:2:[email protected]:6', 'panel1:right:3:[email protected]:7', 'panel1:right:11:[email protected]:1', 'panel1:right:5:[email protected]:9', 'panel1:right:6:[email protected]:10', 'panel1:right:7:[email protected]:11', 'panel1:right:8:[email protected]:12', '

tsaarni

*** RSA

# Generate self-signed certificate with RSA 4096 key-pair
openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout rsakey.pem -out rsacert.pem

# print private and public key
openssl rsa -in rsakey.pem -text -noout

# print certificate
openssl x509 -in rsacert.pem -text -noout

JavaScript-Packer

function en(c) {
  var x = "charCodeAt", b, e = {}, f = c.split(""), d = [], a = f[0], g = 256;
  for (b = 1; b < f.length; b++) c = f[b], null != e[a + c] ? a += c :(d.push(1 < a.length ? e[a] :a[x](0)), 
  e[a + c] = g, g++, a = c);
  d.push(1 < a.length ? e[a] :a[x](0));
  for (b = 0; b < d.length; b++) d[b] = String.fromCharCode(d[b]);
  return d.join("");
}

function de(b) {

Redchards

#ifndef PLATFORM
#define PLATFORM

#define GCC_COMPILER     1
#define MVSC_COMPILER    2
#define ICC_COMPILER     3
#define BORLAND_COMPILER 4

#define LINUX   1
#define WINDOWS 2