AysadKozanoglu

# LUA block to detect, block and log Log4Shell attacks (C) Infiniroot 2021 (@infiniroot)
# with lua fixes and other enhancements from Andreas Nanko (@andreasnanko)
rewrite_by_lua_block {
function decipher(v)
    local s = tostring(v)
    s=ngx.unescape_uri(s)
    if string.find(s, "${base64:") then
      t=(string.gsub(s, "${${base64:([%d%a%=]+)}}", "%1"))
      s=string.gsub(s, "${base64:([%d%a%=]+)}", tostring(ngx.decode_base64(t)))
    end

AysadKozanoglu

#  Author: Aysad Kozanoglu
# Version: 0.1
# changed: Wed 26 Oct 2022 08:56:15 PM CEST
# please note: while injecting this file, filename must be named exactly preseed.cfg (debian defaults)
# example -> /var/lib/config/buster/preseed.cfg
# -initrd-inject=/var/lib/libvirt/images/preseeds/buster/preseed.cfg
#
# full command example for virt-install

#### Contents of the preconfiguration file (for squeeze)

AysadKozanoglu

" mkdir ~/.vim/config
" ~/.vim/config/molokai.vim
"
" Vim color file
"
" Author: Tomas Restrepo <tomas@winterdom.com>
" https://github.com/tomasr/molokai
"
" Note: Based on the Monokai theme for TextMate
" by Wimer Hazenberg and its darker variant

AysadKozanoglu

in this script webserver is nginx, so pre handling is only for nginx but you can change it to your needs and webserver
```
ACMEDOMAIN=domainname.tld

/root/.acme.sh/acme.sh --standalone --issue -d www.${ACMEDOMAIN} -d ${ACMEDOMAIN} \
--cert-file /etc/ssl/${ACMEDOMAIN}-cert.pem \
--key-file /etc/ssl/${ACMEDOMAIN}-priv.pem \
--fullchain-file /etc/ssl/${ACMEDOMAIN}-fullchain.pem \
--pre-hook "nginx -s stop; killall nginx" \
--post-hook "nginx"

AysadKozanoglu

###  create desktop file 
#### user specific shortcut ~/.local/share/applications/telegram.desktop
#### globaly for all users shortcut /usr/share/applications/telegram.desktop

```
[Desktop Entry]
Version=1.5
Name=Telegram Desktop
Comment=Official desktop version of Telegram messaging app
TryExec=/home/ghost/packages/Telegram/Telegram

AysadKozanoglu

local copy remote file over hops with command scp

server A: 192.168.1.10 (hops over)

server B: 192.168.1.11 (remote file is here)

scp -oProxyJump=<user>@serverA <user>@<serverB>:<PATHtoFile> Downloads/

AysadKozanoglu

put in server section of your virtual Host configuration following regex

server {


if ($request_uri ~* "jndi:*|\$\{*") {
              return 403;
}

AysadKozanoglu

check your php extentions for spell extension existing

php -m | grep spell

info: you have to see pspell in the output, if not than install the php extension (see notice below)

config/config.inc.php

AysadKozanoglu

sha256enc.php

<?php 

$keystr = $argv[1];

echo "\n\nplain String:\n$keystr \n\nsha256 hash:\n". hash('sha256', $keystr ) ."\n\n" ;

?&gt;

AysadKozanoglu

####SIBIT - systemintegration.berlin / Germany

get by known AWS ip the originAS for whole AWS network

whois 13.125.40.66 | grep "OriginAS"

you would get in the output originAS like

OriginAS: AS16509 #--> AWs ripe ORIGIN