Ilya Nazarov nilya

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

ClamAV Setup Notes

Context

ClamAV can be used in a few different ways. Most importantly, it provides the ability to scan files in realtime (on-access) or to scan the file system periodically.

I tried configuring ClamAV to both perform on-access virus scanning and to perform nightly full filesystem scanning. Using the on-access option did not prove to be very useful, however a scheduled full system scan seems to be of value.

Here is my story.

How to configure static website using Nginx with MinIO ?

1. Install nginx

2. Install minio

3. Install mc client

4. Create a bucket:

$ mc mb myminio/static
Bucket created successfully ‘myminio/static’.

Hyperlinks (a.k.a. HTML-like anchors) in terminal emulators

[ Update 2025-03-24: Commenting is disabled permanently. Previous comments are archived at web.archive.org. ]

Most of the terminal emulators auto-detect when a URL appears onscreen and allow to conveniently open them (e.g. via Ctrl+click or Cmd+click, or the right click menu).

It was, however, not possible until now for arbitrary text to point to URLs, just as on webpages.

	"""
	MxGraph Primitives
	<move x="0" y="0"/>
	<line x="0" y="0"/>
	<quad x1="0" y1="0" x2="0" y2="0"/>
	<curve x1="0" y1="0" x2="0" y2="0" x3="0" y3="0"/>
	Updated with changed from https://gist.github.com/dabenny
	"""
	from xml.dom import minidom
	import re

	More recent resolution:

	1. cd ~/../../etc (go to etc folder in WSL).
	2. echo "[network]" \| sudo tee wsl.conf (Create wsl.conf file and add the first line).
	3. echo "generateResolvConf = false" \| sudo tee -a wsl.conf (Append wsl.conf the next line).
	4. wsl --terminate Debian (Terminate WSL in Windows cmd, in case is Ubuntu not Debian).
	5. cd ~/../../etc (go to etc folder in WSL).
	6. sudo rm -Rf resolv.conf (Delete the resolv.conf file).
	7. In windows cmd, ps or terminal with the vpn connected do: Get-NetIPInterface or ipconfig /all for get the dns primary and
	secondary.

	theory
	Consensus_Demo
	imports
	Network
	begin

	datatype 'val msg
	= Propose 'val
	\| Accept 'val

	<?php
	// For laravel 5 based systems
	// /path/to/project/app/Console/Commands/AllowSSHFromIP.php

	namespace App\Console\Commands;

	use Aws\Ec2\Ec2Client;
	use Carbon\Carbon;
	use Illuminate\Console\Command;

	browser.commands.onCommand.addListener(async (command) => {
	let num = parseInt(command.substr(9, 10)) - 1;
	let tabs = await browser.tabs.query({currentWindow: true});
	if (tabs.length < num) {
	return;
	}
	browser.tabs.update(tabs[num].id, {active: true});
	});

	#!/bin/bash

	user_name="$1"

	echo "Removing user: ${user_name}"

	echo "Deleting Access Keys:"
	keys=("$(aws iam list-access-keys --user-name "${user_name}" \| jq -r '.AccessKeyMetadata[] \| .AccessKeyId')")
	if [[ "${#keys}" -gt "0" ]]; then
	# shellcheck disable=SC2068