thomasbad

rule webshell_b374k_3-2-3 {
   meta:
      description = "first ground detect b374k 3.2.3 web shell"
      author = "thomasbad"
      date = "2022-06-22"
      hash1 = "53fe44b4753874f079a936325d1fdc9b1691956a29c3aaf8643cdbd49f5984bf"
   strings:
      $x1 = "var Zepto=function(){function G(a){return a==null?String(a):z[A.call(a)]||\"object\"}function H(a){return G(a)==\"function\"}fun" ascii
      $s2 = "$cmd = execute(\"taskkill /F /PID \".$pid);" fullword ascii
      $s3 = "$cmd = trim(execute(\"ps -p \".$pid));" fullword ascii

thomasbad

layout	title	published	tags
post	clamav - install and configure on mac osx	true	blog clamav

Install Clamav

Install clamav via homebrew

thomasbad

@echo off
:: Ensure admin privileges
fltmc >nul 2>&1 || (
    echo Administrator privileges are required.
    PowerShell Start -Verb RunAs '%0' 2> nul || (
        echo Right-click on the script and select "Run as administrator".
        pause & exit 1
    )
    exit 0
)

thomasbad

# Ask if the script have run as admin, if not, run as admin
if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))  
{  
  $arguments = "& '" +$myinvocation.mycommand.definition + "'"
  Start-Process powershell -Verb runAs -ArgumentList $arguments
  Break
}
# PowerShell Window Title
$host.UI.RawUI.WindowTitle = "PS Title"

thomasbad

#Sample 1
$str = '< > : " / \ | ? *'

$strFixed = $str.Replace('<','_').Replace('>','_').Replace(':','_').Replace('"','_').Replace('/','_').Replace('\','_').Replace('|','_').Replace('?','_').Replace('*','_')

$strFixed

#Sample 2
$strFixed2 = $str -replace '[<>:"/\\|?*]','_'

thomasbad

$ErrorActionPreference = 'SilentlyContinue'
$Button = [System.Windows.MessageBoxButton]::YesNoCancel
$ErrorIco = [System.Windows.MessageBoxImage]::Error
$Ask = 'Do you want to run this as an Administrator?
        Select "Yes" to Run as an Administrator
        Select "No" to not run this as an Administrator
        
        Select "Cancel" to stop the script.'

If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator')) {

thomasbad

(netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)}  | Select-String "Key Content\W+\:(.+)$" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize 
pause

thomasbad

thomasbad

thomasbad