| #!/usr/bin/env python2 | |
| """ | |
| Author: takeshix <takeshix@adversec.com> | |
| PoC code for CVE-2014-0160. Original PoC by Jared Stafford (jspenguin@jspenguin.org). | |
| Supportes all versions of TLS and has STARTTLS support for SMTP,POP3,IMAP,FTP and XMPP. | |
| """ | |
| import sys,struct,socket | |
| from argparse import ArgumentParser |
Add the following chunk to your existing ISC dhcpd.conf file.
if exists user-class and ( option user-class = "iPXE" ) {
filename "http://boot.smidsrod.lan/boot.ipxe";
}
else {
filename "undionly.kpxe";
}
(or see https://gist.github.com/4008017 for a more elaborate setup
| /* Everything but DEBUG and LOG output to BIOS console */ | |
| #undef CONSOLE_PCBIOS | |
| //#define CONSOLE_PCBIOS ( CONSOLE_USAGE_ALL & ~CONSOLE_USAGE_DEBUG & ~CONSOLE_USAGE_LOG ) | |
| #define CONSOLE_PCBIOS ( CONSOLE_USAGE_ALL & ~CONSOLE_USAGE_LOG ) | |
| #define CONSOLE_VESAFB | |
| /* Everything but TUI output to syslog console */ | |
| #undef CONSOLE_SYSLOG | |
| #define CONSOLE_SYSLOG ( CONSOLE_USAGE_ALL & ~CONSOLE_USAGE_TUI ) |
| # Send a native logstash json event to the logstash server | |
| $template ls_json,"{%timestamp:::date-rfc3339,jsonf:@timestamp%,\"@message\":\"%msg:::json%\",\"@fields\":{%fromhost:::jsonf:host%,%syslogfacility-text:::jsonf:syslog_facility%,%syslogfacility:::jsonf:syslog_facility_code%,%syslogseverity-text:::jsonf:syslog_severity%,%syslogseverity:::jsonf:syslog_severity_code%,%app-name:::jsonf:program%,%procid:::jsonf:pid%}}" | |
| *.* @@mylogstashhost:5543;ls_json |
| ## Configure eth0 | |
| # | |
| # vi /etc/sysconfig/network-scripts/ifcfg-eth0 | |
| DEVICE="eth0" | |
| NM_CONTROLLED="yes" | |
| ONBOOT=yes | |
| HWADDR=A4:BA:DB:37:F1:04 | |
| TYPE=Ethernet | |
| BOOTPROTO=static |
| require 'faraday' | |
| require 'json' | |
| require 'securerandom' | |
| get '/ping' do | |
| id = params[:id].to_i | |
| users = [] | |
| case params[:system] |
| # Microsoft IIS logging....Use NXLOG for client side logging | |
| filter { | |
| if [type] == "iis" { | |
| if [message] =~ "^#" { | |
| drop {} | |
| } | |
| grok { | |
| match => [ | |
| "message", "%{TIMESTAMP_ISO8601:logtime} %{IPORHOST:hostname} %{URIPROTO:cs_method} %{URIPATH:cs_stem} (?:%{NOTSPACE:cs_query}|-) %{NUMBER:src_port} %{NOTSPACE:cs_username} %{IP:clientip} %{NOTSPACE:cs_useragent} %{NUMBER:sc_status} %{NUMBER:sc_subresponse} %{NUMBER:sc_win32_status} %{NUMBER:timetaken}", | |
| "message", "%{TIMESTAMP_ISO8601:logtime} %{IPORHOST:hostname} %{URIPROTO:cs_method} %{URIPATH:cs_stem} (?:%{NOTSPACE:cs_query}|-) %{NUMBER:src_port} %{NOTSPACE:cs_username} %{IP:clientip} %{NOTSPACE:cs_useragent} %{NOTSPACE:cs_referrer} %{NUMBER:sc_status} %{NUMBER:sc_subresponse} %{NUMBER:sc_win32_status} %{NUMBER:timetaken}" |
| input { | |
| file { | |
| path => "/var/log/nginx/access.log" | |
| type => "nginx-access" | |
| sincedb_path => "/var/log/.nginxaccesssincedb" | |
| } | |
| } | |
| input { | |
| file { | |
| path => "/var/log/nginx/error.log" |
| { | |
| "title": "IIS", | |
| "services": { | |
| "query": { | |
| "list": { | |
| "0": { | |
| "query": "agent:MSIE", | |
| "alias": "", | |
| "color": "#806EB7", | |
| "id": 0, |