thebeardedgeek

NOTE: I am reading and trying to offer information from what I have seen so far. Everyone will have to conduct their own research and make assessments based on findings.

A way to scan the IFS on an IBM i from QSH

This executes a find utility in QSH 
NOTE: this should be on many if not all systems – so far I have tested OS 7.1-7.4 with success *UPDATE I tested this with v5r4 and it worked as well
•	SBMJOB = Submits the job, JOB(LOG4JSCAN) names the job, and JOBQ(QCTL) submits it to the controlling subsystem (I have been submitting it here to make sure nothing ends it but you could submit it to another JOBQ)
•	Find / = we are searching the root path with find
•	-path /QSYS.LIB -prune -o = I am excluding /QSYS.LIB (since it cannot contain .jar files) 
•	-type f = looking for items of the type files

Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

gallir

from botocore.hooks import _PrefixTrie
import util
import boto3
from .s3utils import upload_csv
import time
import pprint


class Pipeline:
    def __init__(self, name, target, freq, horizon, s3_bucket, related=None, domain="RETAIL",

forstie

-- Purpose: Delay job for fractions of a second
-- Author : Scott Forstie
-- Contact: forstie@us.ibm.com
-- Date   : June 20, 2019

cl: addlible QSYSINC;
cl: crtsrcpf qtemp/qcsrc;
cl: addpfm file(qtemp/qcsrc) mbr(usleep);
--
-- The usleep() function suspends a thread for the number of microseconds specified by the of useconds parameter.

forstie

--
-- description: printf to the Joblog, using SQL
--
cl:addlible qsysinc;
cl:crtsrcpf qtemp/qcsrc;
cl:addpfm file(qtemp/qcsrc) mbr(LPRINTF);
insert into qtemp.qcsrc values
 (1,010101,'{'),                                                  
 (2,010101,'extern int Qp0zLprintf (char *format, ...);'),      

miniupnp

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#if defined(__POWERPC__)
#include <ppc_intrinsics.h>
#else
#ifdef _MSC_VER
#include <intrin.h> /* for rdtscp and clflush */
#pragma optimize("gt",on)
#else

drmalex07

README

Let Tomcat is download and installed under /opt/tomcat. Also, let tomcat be a non-provileged user under which the server will be running.

We assume that we keep server's binaries under /opt/tomcat and we will create a server instance named foo under /var/tomcat/ (carrying its own conf, logs, webapps, work, lib directories). See also https://dzone.com/articles/running-multiple-tomcat.

Create a template service unit file at /etc/systemd/system/tomcat@.service:

master-q

How to shape failover over MySQL

Environment for testing

Server vagrant-db1

• Hostname: vagrant-db1
• OS: CentOS 5.7
• eth0: 10.0.2.15 (for internet service)
• eth1: 192.168.179.6 (for interconnect)

pklaus

#!/usr/bin/env python
"""
LICENSE http://www.apache.org/licenses/LICENSE-2.0
"""

import argparse
import datetime
import sys
import time
import threading