Jeff Geiger jeffgeiger

ROCK Sensor Hardware Options

This document is a list of hardware that has been used for development and home use as a ROCK sensor. The first option would be to repurpose a machine if possible (minimum specs below). If your budget permits you can build a powerful system in a small form factor for under $1000.

Some of the more important aspects to look for are IPMI for baremetal remote management, dual Intel NICs, quiet, and relatively low-power. You don't want to have to wear hearing protection while sitting next to your infrastructure.

Sensor Hardware Options

Repurposed Hardware

ROCK Sensor Parts List

Below is the hardware I use for development and home use of my ROCK sensor. It’s an extremely powerful system in a small form factor, under $1000. The most important aspects to me were that I wanted IPMI for baremetal remote management, dual Intel NICs, quiet, and relatively low-power. I sit by this thing and work everyday and don’t want to wear hearing protection while I write code.

The prices reflect what I paid for them in March 2016. No doubt the prices will have changed and newer, better stuff is probably available. Things like RAM and SSDs go on sale all the time, so look for that if you’re a bargain shopper.

Sensor Hardware

Case: Antec ISK 300-150 Black Mini-ITX Desktop Computer Case 150 Watt Power Supply - $70.70
RAM: https://www.amazon.com/gp/product/B015YPB1NK/ref=oh_aui_detailpage_o04_s00?ie=UTF8&psc=1[CRUCIAL TECHNOLOGY 16GBx2 32GB Kit, DDR4 2133 MT/s DIMM 288 (CT2K16G4D

#petya #petrWrap #notPetya

Win32/Diskcoder.Petya.C

Ransomware attack.

About

This gist was built by the community of the researchers and was scribed by Kir and Igor from the QIWI/Vulners. We are grateful for the help of all those who sent us the data, links and information. Together we can make this world a better place!

Gist updates

Grab the main page with all the links:
curl https://slackmojis.com/ > emoji

Open file in vim and run the following commands:

v/src=/d
%s/^.*https:/https:/g"
%s/?.*$//g

	VMware vSphere 6 Enterprise Plus
	1C20K-4Z214-H84U1-T92EP-92838
	1A2JU-DEH12-48460-CT956-AC84D
	MC28R-4L006-484D1-VV8NK-C7R58
	5C6TK-4C39J-48E00-PH0XH-828Q4
	4A4X0-69HE3-M8548-6L1QK-1Y240

	VMware vSphere with Operations Management 6 Enterprise
	4Y2NU-4Z301-085C8-M18EP-2K8M8
	1Y48R-0EJEK-084R0-GK9XM-23R52

	# Add this file to /etc/yum.repos.d/local-mirrors.repo
	# Change the IP below accordingly

	[mirror-base]
	name=Base mirror
	baseurl=http://192.168.100.10/base
	enabled=1
	cost=500
	gpgcheck=1
	gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

	If you want to run a pcap through Zeek, but don't have ROCK or don't need "all the things".

	# Fire up the Docker container, mapping the directory with your pcap
	## If pcap in your current directory
	docker run -it -v $(pwd):/pcap broplatform/bro:3.0.0 /bin/bash
	## If pcap is somewhere else
	docker run -it -v [directory where your pcap is]:/pcap broplatform/bro:3.0.0 /bin/bash

	# If you have to build your own for some reason
	# This can be skipped if the `docker run...` worked above

	Import-Module ActiveDirectory

	$password = (Read-Host -AsSecureString "AccountPassword")
	$users = import-csv ".\users.csv"

	foreach ($user in $users){
	New-ADUser `
	-SamAccountName ($user.GivenName + "." + $user.Surname).ToLower() `
	-UserPrincipalName (($user.GivenName + "." + $user.Surname).ToLower() + "@" + $env:USERDNSDOMAIN) `
	-DisplayName ($user.GivenName + " " + $user.Surname) `

	#!/bin/bash

	#
	# Raspberry Pi3 - CentOS 7 - Wi-Fi configuration
	#

	# Usage: ./wifi-setup.sh [SSID] [PSK]

	if [ -z "$1" ]; then
	echo "Enter WAP SSID:";