Gregory Boddin gboddin

## hostnames.txt
ace
adria
agrajag
alistair
amy
angharad
anubis
apophis
archer
arthur

## readme.txt
$ ./proxy 5858
-> open proxy on port 5858
$ curl -x socks5h://<target>:5858 http://192.168.0.1

## nebula.service
# This is a mostly empty service, but allows commands like stop, start, reload
# to propagate to all nebula@ service instances.

[Unit]
Description=Nebula VPN
Documentation=info:nebula
After=network.target
Wants=network.target

[Service]

## gopot.go
package main

import (
	"bufio"
	"fmt"
	"log"
	"net"
	"time"
)
var lport = ":8883"

## probe.sh
user@leakixsyn001:~$ ulimit -n 4096 ; sudo ./ip4scout random -r 25000 -p 27017,9200|./l9tcpid service --deep-http  --max-threads=2048|pv -rabl|tee open.json|./l9explore service --explore-timeout 5s -t 2048 -l|tee leaks.json |./l9filter transform -i l9 -o human
2020/12/15 01:28:56 selected input : l9
2020/12/15 01:28:56 selected output :  human
2020/12/15 01:28:56 Recommended blacklist loaded
2020/12/15 01:28:56 30 networks in blacklist
2020/12/15 01:28:56 Loaded 2 ports to scan
2020/12/15 01:28:56 Using source port 7427
2020/12/15 01:28:56 Listening!
IP: 47.104.19.66, PORT:9200, PROTO:elasticsearch, SSL:false
HTTP/1.1 200 OK

## l9examples.sh
ip4scout random -p 3306,9200,5601|l9serviceid|tee services.json|l9explore service --plugin-directory=~/.l9plugins/services > leaks.json

## jarm-list.csv

          
            HASH
            Description

            
              21d2ad00021d21d00021d2ad21d21df4e3c58923bbd15f0f36892ab3187607
              QNAP devices

            
              29d29d00029d29d21c29d29d29d29de89a29da3ee50098446f31579da51a6e
              Docker registries

            
              29d29d20d29d29d00029d29d29d29d7d36b37b24a2d9588a0b8abfe23303d7
              Kubernetes masters

            
              29d29d15d29d29d21c29d29d29d29d7e041aa174fa2d3165f8bda79299bfea
              Ubiquity/CommVault

            
              2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d
              F5?

            
              3fd3fd0003fd3fd0003fd3fd3fd3fd5b4368bf786845fef915ced422fd1b09
              Minio

            
              29d29d00029d29d21c42d43d00041db6525da0b3c6db046c54191c7bbf62aa
              FSecure policy manager

## output.txt
192.168.0.63:9051 <- suspicious
198.100.148.114
46.19.141.86
198.100.148.114
46.19.141.86

192.168.0.63:9052
185.12.45.114
185.12.45.114
185.12.45.114

## default.conf
server {
  location / {
      gzip on;
      gzip_vary on;
      gzip_min_length 10240;
      gzip_proxied expired no-cache no-store private auth;
      gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
      gzip_disable "MSIE [1-6]\.";
      root /usr/share/nginx/html;
      try_files $uri $uri/ /index.html;

## dpull.sh
#!/usr/bin/env bash
set -o pipefail

# hello-world                      latest              ef872312fe1b        3 months a910 B
# hello-world                      latest              ef872312fe1bbc5e05aae626791a47ee9b032efa8f3bda39cc0be7b56bfe59b9   3 months ago        910 B

# debian                           latest              f6fab3b798be        10 weeks ago        85.1 MB
# debian                           latest              f6fab3b798be3174f45aa1eb731f8182705555f89c9026d8c1ef230cbf8301dd   10 weeks ago        85.1 MB
if ! command -v curl &> /dev/null; then
	echo >&2 'error: "curl" not found!'
	$ ./proxy 5858
	-> open proxy on port 5858
	$ curl -x socks5h://<target>:5858 http://192.168.0.1
	# This is a mostly empty service, but allows commands like stop, start, reload
	# to propagate to all nebula@ service instances.

	[Unit]
	Description=Nebula VPN
	Documentation=info:nebula
	After=network.target
	Wants=network.target

	[Service]
	package main

	import (
	"bufio"
	"fmt"
	"log"
	"net"
	"time"
	)
	var lport = ":8883"
	user@leakixsyn001:~$ ulimit -n 4096 ; sudo ./ip4scout random -r 25000 -p 27017,9200\|./l9tcpid service --deep-http --max-threads=2048\|pv -rabl\|tee open.json\|./l9explore service --explore-timeout 5s -t 2048 -l\|tee leaks.json \|./l9filter transform -i l9 -o human
	2020/12/15 01:28:56 selected input : l9
	2020/12/15 01:28:56 selected output : human
	2020/12/15 01:28:56 Recommended blacklist loaded
	2020/12/15 01:28:56 30 networks in blacklist
	2020/12/15 01:28:56 Loaded 2 ports to scan
	2020/12/15 01:28:56 Using source port 7427
	2020/12/15 01:28:56 Listening!
	IP: 47.104.19.66, PORT:9200, PROTO:elasticsearch, SSL:false
	HTTP/1.1 200 OK
	HASH	Description
	21d2ad00021d21d00021d2ad21d21df4e3c58923bbd15f0f36892ab3187607	QNAP devices
	29d29d00029d29d21c29d29d29d29de89a29da3ee50098446f31579da51a6e	Docker registries
	29d29d20d29d29d00029d29d29d29d7d36b37b24a2d9588a0b8abfe23303d7	Kubernetes masters
	29d29d15d29d29d21c29d29d29d29d7e041aa174fa2d3165f8bda79299bfea	Ubiquity/CommVault
	2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d	F5?
	3fd3fd0003fd3fd0003fd3fd3fd3fd5b4368bf786845fef915ced422fd1b09	Minio
	29d29d00029d29d21c42d43d00041db6525da0b3c6db046c54191c7bbf62aa	FSecure policy manager
	192.168.0.63:9051 <- suspicious
	198.100.148.114
	46.19.141.86
	198.100.148.114
	46.19.141.86

	192.168.0.63:9052
	185.12.45.114
	185.12.45.114
	185.12.45.114
	server {
	location / {
	gzip on;
	gzip_vary on;
	gzip_min_length 10240;
	gzip_proxied expired no-cache no-store private auth;
	gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
	gzip_disable "MSIE [1-6]\.";
	root /usr/share/nginx/html;
	try_files $uri $uri/ /index.html;
	#!/usr/bin/env bash
	set -o pipefail

	# hello-world latest ef872312fe1b 3 months a910 B
	# hello-world latest ef872312fe1bbc5e05aae626791a47ee9b032efa8f3bda39cc0be7b56bfe59b9 3 months ago 910 B

	# debian latest f6fab3b798be 10 weeks ago 85.1 MB
	# debian latest f6fab3b798be3174f45aa1eb731f8182705555f89c9026d8c1ef230cbf8301dd 10 weeks ago 85.1 MB
	if ! command -v curl &> /dev/null; then
	echo >&2 'error: "curl" not found!'