Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

psct

---
 - name: set up docker & compose
   hosts: docker
   become: yes

   tasks:
   - name: update package index
     apt:
       name: "*"
       state: latest

psct

---
 - name: set name, adjust /etc/hosts
   hosts: all
   become: yes

# order matters!
   tasks:
   - name: adjust /etc/hosts
     replace:
       path: /etc/hosts

psct

---
 - name: add ssh, deploy root key
   hosts: all
   become: yes

   tasks:
   - name: disable password authentication
     lineinfile: 
       path: /etc/ssh/sshd_config
       regexp: '^PasswordAuthentication'

psct

#!/bin/bash
# enable host for ansible
set -e
PUBKEY=""
id -u ansible > /dev/null 2>&1 || \
adduser ansible --disabled-password \
--gecos "" --quiet
mkdir -p /home/ansible/.ssh
echo "$PUBKEY" \
> /home/ansible/.ssh/authorized_keys

april

# pretty sudo prompt
read -r -d '' SUDOPROMPT << EOM
🌺🌳🌸🌷🌷🌸🌻🌷🌷🌸🌸🌸🌸🌷🌼🌷🌳🌺🌼🌺🌸🌻🌼🌼🌳🌳🌼🌺🌻🌷🐛🌷🌼🌻🌳🌸🌷🌷🌻🌸
🌸🦉🌻🌸🌳🌷🌸🌷🌸🌳🌸🌻🌳🐌🌻🌷🌷🌼🌻🌺🌺🌻🌼🌻🌻🌼🌺🌻🌳🌼🌳🌺🌳🌷🌻🌼🌷🌼🌻🌸
🌳🌸🌻🌺🌻🌳🌺🌺🌻🌺🌸🌻🌷🌷🌼🌻🌺🌼🌻🌻🌷🌳🌻🌸🌳🌷🌻🌳🌳🌳🌳🌼🌳🌳🌺🌷🌳🌺🌳🌺
🦉🌸🌻🌺🌺🌳🌸🌸🌼🌻🌺🌼🌷🌸🌳🌼🌺🌸🌺🌷🌻🌷🌺🌺🌳🌷🌷🐰🌸🌻🌳🌸🌼🌷🌼🌳🌷🐹🌼🌺
🌷🌳🌻🌸🌸🌼🐰🌷🌺🌷🌺🌻🌷🌸🌺🌻🌳🌻🌷🌻🌻🌺🌸🌸🌺🌻🌸🌻🌳🌳🌻🐦🌻🌼🌼🌻🌻🌺🌳🐰
🌼🐦🌻🌳🌸🌸🌳🌷🌺🌼🌳🌷🌸🌻🌼🌻🐛🌻🌼🌷🌺🌼🌺🌸🌺🦔🌷🌸🌷🌻🌻🌺🌼🌷🐌🌸🌷🌼🌸🐹
🌸🌳🌻🌼🌻🌳🌸🌷🌺🌷🌷🌼🌻🌷🌻🌺🌼🌼🌳🌸🌻🌻🌸🌼🌼🌸🌳🌺🌻🌻🌳🌺🌷🐰🌻🌼🐹🌷🌷🌳
🌼🌷🌻🌸🌼🌳🌻🌻🌳🌷🌼🌻🌺🌺🌺🌺🌺🌳🌻🌼🌷🌸🌸🌻🌺🌻🌳🌸🌷🌺🌺🌼🌸🌺🌻🌻🌷🌸🌻🌷

matchilling

package com.matchilling.api.rest.data

import com.fasterxml.jackson.core.JsonGenerator
import com.fasterxml.jackson.databind.JsonSerializer
import com.fasterxml.jackson.databind.SerializerProvider
import org.springframework.boot.jackson.JsonComponent
import org.springframework.data.domain.PageImpl
import java.io.IOException

@JsonComponent

Andor

---
variables:
  terraform_image: terraform-vault-jq

default:
  image:
    name: $terraform_image
  cache:
    key: terraform
    paths:

bgauduch

Setup multiple git identities & git user informations

/!\ Be very carrefull in your setup : any misconfiguration make all the git config to fail silently ! Go trought this guide step by step and it should be fine 😉

Setup multiple git ssh identities for git

• Generate your SSH keys as per your git provider documentation.
• Add each public SSH keys to your git providers acounts.
• In your ~/.ssh/config, set each ssh key for each repository as in this exemple:

haircut

Install and use pip on macOS without sudo / admin access

Most recently tested on macOS Sierra (10.12.6)

1. Download the installation script; curl https://bootstrap.pypa.io/get-pip.py -o ~/Downloads/get-pip.py
2. Run the installation, appending the --user flag; python ~/Downloads/get-pip.py --user. pip will be installed to ~/Library/Python/2.7/bin/pip
3. Make sure ~/Library/Python/2.7/bin is in your $PATH. For bash users, edit the PATH= line in ~/.bashrc to append the local Python path; ie. PATH=$PATH:~/Library/Python/2.7/bin. Apply the changes, source ~/.bashrc.
4. Use pip! Remember to append --user when installing modules; ie. pip install <package_name> --user

Note