thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is still a new situation. There is a lot we don't know. We don't know if there are more possible exploit paths. We only know about this one path. Please update your systems regardless.

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

djsime1

Reset Forgotten FZ PIN

:: Last updated May 5th 2022. ::

First method

• Plug your device in to a PC and open qFlipper.
• On the device, hold LEFT and BACK simultaneously for 2 seconds.
• Release BACK first, then wait until the LED becomes blue to release LEFT.
• In qFlipper settings (Wrench icon), set Firmware Update Channel to "Development."
• If you see a blue "REPAIR" button and the text "Dev XXXXXXXX" (With X being a random character) click the repair button.
• Accept the confirmation prompt.

tothi

# MINIMAL USB gadget setup using CONFIGFS for simulating Razer Gaming HID
# devices for triggering the vulnerable Windows Driver installer
# credits for the Windows Driver install vuln: @j0nh4t
#
# https://twitter.com/j0nh4t/status/1429049506021138437
# https://twitter.com/an0n_r0/status/1429263450748895236
#

# the script was developed & tested on Android LineageOS 18.1

gladiatx0r

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

• Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
• Relaying that machine authentication to LDAPS for configuring RBCD
• RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

nginx-gists

# Builds NGINX from the QUIC+HTTP/3 development branch
# - Based on the official NGINX docker image, including all modules built by default
# - OpenSSL replaced with LibreSSL to support QUIC's TLS requirements (statically linked)
#
# docker build --no-cache -t nginx:quic .
# docker run -d -p 443:443 -p 443:443/udp nginx:quic
#
# Note that a suitable configuration file and TLS certificates are required for testing!
# See <https://quic.nginx.org/readme.html> for more info

andrebrait

Here is the best setup (I think so :D) for K-series Keychron keyboards on Linux.

Note: many newer Keychron keyboards use QMK as firmware and most tips here do not apply to them. Maybe the ones related to Bluetooth can be useful, but everything related to Apple's keyboard module (hid_apple) on Linux, won't work. As far as I know, all QMK-based boards use the hid_generic module instead. Examples of QMK-based boards are: Q, Q-Pro, V, K-Pro, etc.

Most of these commands have been tested on Ubuntu 20.04 and should also work on most Debian-based distributions. If a command happens not to work for you, take a look in the comment section.

Make Fn + F-keys work (NOT FOR QMK-BASED BOARDS)

Older Keychron keyboards (those not based on QMK) use the hid_apple driver on Linux, even in the Windows/Android mode, both in Bluetooth and Wired modes.

frispete

#!/bin/bash

meetsh=$(basename "$0")
meetctl=$(basename "${0%%.sh}")
# jitsi components
jitsi=(-f docker-compose.yml)
jitsilst=$meetctl.lst
test -f $jitsilst && {
    # read list of additional jitsi components
    while read line; do

jdembowski

#!/usr/bin/python3

# This Python script will
#
# - Log into a WordPress installation using supplied credentials.
# - Get a single published post using the REST call /wp/v2/posts
# - Get a valid nonce from '/wp-admin/post.php?post=xxx&action=edit'
# - Use cookie+nonce to retrieve on post in draft status via REST.
#
# Getting that valid nonce must be performed prior to each WP REST call

aw

Proxmox VE 6.x release includes a feature to add custom cloud-init configs. Unfortunately there is poor documentation, so I had to figure this out by adding pieces of information together.

The custom cloud-init files (user-data, meta-data, network-config)

The cloud-init files need to be stored in a snippet. This is not very well documented:

1. Go to Storage View -> Storage -> Add -> Directory
2. Give it an ID such as snippets, and specify any path on your host such as /snippets
3. Under Content choose Snippets and de-select Disk image (optional)
4. Upload (scp/rsync/whatever) your user-data, meta-data, network-config files to your proxmox server in /snippets/snippets/ (the directory should be there if you followed steps 1-3)

omaryoussef

PUT _ingest/pipeline/laravel
{
    "description": "Parses Laravel log files.",
    "processors": [
        {
          "rename": {
            "field": "message",
            "target_field": "event.original"
          }
        },