thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

legowerewolf

↗️ This gist has been transferred to tailscale-dev/deck-tailscale

Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

tomdaley92

Proxmox - Email Alerts Setup (gmail)

1. SSH into proxmox node and become root user. Run the following commands to download extra software dependencies we'll need.

   apt update
   apt install -y libsasl2-modules mailutils

2. Enable 2FA for the gmail account that will be used by going to security settings

liclac

set -l data_status (curl -s https://iceportal.de/api1/rs/status)
set -l data_trip (curl -s https://iceportal.de/api1/rs/tripInfo/trip)
# next stop
echo  (echo $data_trip | jq -r '([ .trip.stops[] | select(.info.passed==false) ]
| first).station.name')
# train number
echo  (echo $data_trip | jq -r '"\(.trip.trainType)-\(.trip.vzn)"')
# speed
echo speed (echo $data_status | jq -r '"\(.speed) km/h"')

Neo23x0

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
JAB	🗣 Jabber	$.	Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq	📺 Television	MZ	MZ header
SUVY	🚙 SUV	IEX	PowerShell Invoke Expression
SQBFAF	🐣 Squab favorite	I.E.	PowerShell Invoke Expression (UTF-16)
SQBuAH	🐣 Squab uahhh	I.n.	PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA	💪 "Pah!"	<.	Often used by Emotet (UTF-16)

azet

# long running queries:
SELECT
  pid,
  now() - pg_stat_activity.query_start AS duration,
  query,
  state
FROM pg_stat_activity
WHERE (now() - pg_stat_activity.query_start) > interval '5 minutes';

## active queries and killing them:

TarlogicSecurity

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Krazybug

#!/usr/bin/env python3

'''
calisuck: index, filter-out smartly and download ebooks from Calibre open directories

Installation:

    You need python 3.5 installed

    Download the file as a zip and unzip-it and get into the dir

Krazybug

'''
O'Meirrcy !!!! Download free ebooks from O'Reilly

Usage:
> git clone  https://gist.github.com/Krazybug/1ae50814d25b0a1d862dfdf7161ee503
> mv 1ae50814d25b0a1d862dfdf7161ee503 omercy
> cd omercy
> pip install requests
> pip install bs4
> python omercy.py