Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

vdbelt

addEventListener('fetch', event => {

    event.respondWith(purgeCache(event.request))

})

async function purgeCache(request) {

    const url = new URL(request.url)

alewolf

/**
* Title: Triple Match MCC
* Descritpion: Adds the missing match types of each keyword in every ad group
* Author: Wolf+Bär Agency, Aleksandar Vucenovic
* Website: https://wolfundbaer.ch
* License: GNU GPLv3
* Version: 0.4
* URL: https://gist.github.com/alewolf/ae90ea9c658df09b08d129f58575213c
* URL: 
*/

levelsio

<?
	//
	// [ BUY BTC & ETH DAILY ON BITSTAMP ]
	// by @levelsio
	//
	// 2017-08-23
	//
	// 1) buy $40/day BTC
	// 2) buy $10/day ETH
	//

jazzsequence

<?php
/**
 * Add `unfiltered_html` capability to editors (or other user roles).
 * On WordPress multisite, `unfiltered_html` is blocked for everyone but super admins. This gives that cap back to editors 
 * and above.
 *
 * @author Justin Tadlock
 * @link   http://themehybrid.com/board/topics/add-unfiltered_html-capability-to-editor-role#post-4629
 * @param  array  $caps    An array of capabilities.
 * @param  string $cap     The capability being requested.

eteubert

<?php
/**
 * Plugin Name: Multisite: Passwort Reset on Local Blog
 * Plugin URI:  https://gist.github.com/eteubert/293e07a49f56f300ddbb
 * Description: By default, WordPress Multisite uses the main blog for passwort resets. This plugin enables users to stay in their blog during the whole reset process.
 * Version:     1.0.0
 * Author:      Eric Teubert
 * Author URI:  http://ericteubert.de
 * License:     MIT
 */

KartikTalwar

The fastest remote directory rsync over ssh archival I can muster (40MB/s over 1gb NICs)

This creates an archive that does the following:

rsync (Everyone seems to like -z, but it is much slower for me)

• a: archive mode - rescursive, preserves owner, preserves permissions, preserves modification times, preserves group, copies symlinks as symlinks, preserves device files.
• H: preserves hard-links
• A: preserves ACLs

wardbekker

# Split MYSQL dump file

zcat dump.sql.gz | awk '/DROP TABLE IF EXISTS/{n++}{print >"out" n ".sql" }'

# Parallel import using GNU Parallel http://www.gnu.org/software/parallel/

ls -rS *.sql | parallel --joblog joblog.txt mysql -uXXX -pYYY db_name "<"