Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

mahype

zend_extension="xdebug.so"

[xdebug]
xdebug.mode = debug
xdebug.start_with_request = yes

pedrolamas

#!/bin/bash
currentAttempt=0
totalAttempts=10
delay=15

while [ $currentAttempt -lt $totalAttempts ]
do
	currentAttempt=$(( $currentAttempt + 1 ))
	
	echo "Attempt $currentAttempt of $totalAttempts..."

danielstgt

#!/bin/bash
if [ "$EUID" -ne 0 ]
  then echo "Please run as root"
  exit
fi

apt-get install pkg-config libmagickwand-dev -y
cd /tmp
wget https://pecl.php.net/get/imagick-3.4.4.tgz
tar xvzf imagick-3.4.4.tgz

Zodiac1978

Am 28.12. habe ich mit einem Tweet zur #Projekt26 Challenge herausgefordert. Alle zwei Wochen bloggen und kommentieren, über Wordpress oder Verwandtes, in Deutsch oder Englisch. Alle Details dazu in diesem Artikel: https://torstenlandsiedel.de/2019/12/28/projekt26-jetzt-erst-recht/

Für 2021 geht es hier weiter: https://gist.github.com/Zodiac1978/2f13339f8431d1e5edf3365c39bdb12d

KW 1+2

• https://nairobi-notes.de/2019/12/blogging-challenge-projekt26-accepted/
• https://www.wp-wartung24.de/eine-neue-chance-projekt26-2020/

frnwtr

const WordpressPurgeCSS = {
    whitelist: [
        "rtl",
        "home",
        "blog",
        "archive",
        "date",
        "error404",
        "logged-in",
        "admin-bar",

shospodarets

const puppeteer = require('puppeteer');

(async () => {

    const browser = await puppeteer.launch();
    const page = await browser.newPage();
// Adjustments particular to this page to ensure we hit desktop breakpoint.
    page.setViewport({width: 1000, height: 600, deviceScaleFactor: 1});

    await page.goto('https://www.chromestatus.com/samples', {waitUntil: 'networkidle'});

cyberwani

<?php
// Unload CF7 assests
add_filter( 'wpcf7_load_js', '__return_false' );
add_filter( 'wpcf7_load_css', '__return_false' );


add_action( 'the_content', 'load_cf7_assets' );
function load_cf7_assets($content){
	global $post;
	

rap2hpoutre

# stop script on error signal
set -e

# remove old deployment folders
if [ -d "/home/forge/deploy" ]; then
  rm -R /home/forge/deploy
fi
if [ -d "/home/forge/backup" ]; then
  rm -R /home/forge/backup
fi

a-vasyliev

server {
        listen       443;
        server_name  example.com;

        error_log    /var/log/nginx/example_com_error.log warn;

        ssl                    on;
        ssl_certificate        /etc/nginx/ssl/your.crt; #certificate chains
        ssl_certificate_key    /etc/nginx/ssl/your.key; #private key