Jason Taylor rufflabs

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

Useful Tenable Plugins (and how to parse them)

These examples assume you're using my Get-TenablePluginOutput PowerShell function. You can load it from the web here:

$Content = Invoke-WebRequest -Uri https://gist.githubusercontent.com/jasonadsit/db19229634c788276419c5a4134a1b7e/raw/Get-TenablePluginOutput.ps1 | Select-Object -ExpandProperty Content
. ([scriptblock]::Create($Content))

Also assumes you've already set your working directory to one with some .nessus files in it. ;-)

TestService

Windows Service with Python 3.5 and pyinstaller

Requirements

Python 3.5.x
Visual C++ Build Tools 2015
PyInstaller 3.2

Migrate Vagrant VirtualBox VM to VMware Fusion

Notes:

Unfortunately the process is not as simple as I'd have expected it, that's why I wrote this little step-by-step instruction.
My setup is/was:
- OSX 10.9.4
- VirtualBox 4.3.12
- VMware Fusion 6.0.4
- OS as VM to migrate: Ubuntu 10.04.4 LTS

	import json,xmltodict
	"""
	Nmap XML Output to Json Output in Python
	example : data = xml2json('nmap_output.xml')
	"""
	def xml2json(xml):
	xmlfile = open(xml)
	xml_content = xmlfile.read()
	xmlfile.close()
	xmljson = json.dumps(xmltodict.parse(xml_content), indent=4, sort_keys=True)

	#!/usr/bin/python

	from smb.SMBConnection import SMBConnection
	import random, string
	from smb import smb_structs
	smb_structs.SUPPORT_SMB2 = False
	import sys


	# Just a python version of a very simple Samba exploit.

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

	#!/usr/bin/env python
	#
	# Decrypt SSHv2 passwords stored in VanDyke SecureCRT session files
	# Can be found on Windows in:
	# %APPDATA%\VanDyke\Config\Sessions\sessionname.ini
	# Tested with version 7.2.6 (build 606) for Windows
	# Eloi Vanderbeken - Synacktiv

	from Crypto.Cipher import Blowfish
	import argparse

	[
	{
	"name":"ABAP",
	"type":"programming",
	"extensions":[
	".abap"
	]
	},
	{
	"name":"AGS Script",

	<#
	.SYNOPSIS
	A full graceful telnet client using PowerShell and the .NET Framework.

	.DESCRIPTION
	This script was made with a view of using it to have full control over the text
	stream for automating Cisco router and switch configurations.

	.PARAMETER TelnetHost
	The address of the server or router hosting the telnet service.