nathanqthai

Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

jpkrohling

receivers:
  otlp/loadbalancer:
    protocols:
      grpc:
        endpoint: localhost:4317
  otlp/backend-1:
    protocols:
      grpc:
        endpoint: localhost:55690
  otlp/backend-2:

FZambia

package main

import (
	"context"
	"crypto/tls"
	"encoding/binary"
	"errors"
	"io"
	"log"
	"net/url"

mancubus77

#!/bin/bash
#
# /etc/rc.d/init.d/node_exporter
#
#  Prometheus node exporter
#
#  description: Prometheus node exporter
#  processname: node_exporter

# Source function library.

thomasdarimont

Setup

Add this to your .profile, .bashrc, .zshrc...

decode_base64_url() {
  local len=$((${#1} % 4))
  local result="$1"
  if [ $len -eq 2 ]; then result="$1"'=='
  elif [ $len -eq 3 ]; then result="$1"'=' 
  fi
 echo "$result" | tr '_-' '/+' | openssl enc -d -base64

r0mdau

Kibana Readonly

With this tip, kibana can't be modified. So you can share the uri to anyone on the internet. It's a network method to protect kibana from changes of anonymous.

Quick start

1. You need to have a working kibana exposed over http on internet
2. On the same elasticsearch server, install nginx : apt-get install nginx
3. In the directory /etc/nginx/sites-available, create a new file and edit it, for example : vi /etc/nginx/sites-available/kibana-readonly
4. Write the following configuration :

brenopolanski

A simple Ghostscript command to merge two PDFs in a single file is shown below:

gs -dNOPAUSE -sDEVICE=pdfwrite -sOUTPUTFILE=combine.pdf -dBATCH 1.pdf 2.pdf

Install Ghostscript:

Type the command sudo apt-get install ghostscript to download and install the ghostscript package and all of the packages it depends on.

plentz

# to generate your dhparam.pem file, run in the terminal
openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048