Anthony Kava anthonykava

Infosec Discords with Useful Activity:

The CyberSec Lounge: https://disboard.org/server/join/509544906335715349

Infosec Community: https://discord.gg/bw8DzNn

Whitehat Hacking: https://discord.gg/dCu7n6J

HackTheBox: https://discord.gg/2NJt27j

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

An collection of documents about icecast/shoutcast streaming.

icy_meta.md contains the basics of metadata within the stream. The document where I got this information from (http://www.smackfu.com/stuff/programming/shoutcast.html) is not available any more.
spec.md is a copy of this gist https://gist.github.com/ePirat/adc3b8ba00d85b7e3870 just to prevent the informtation from disappearing. You may find the discussion beneath the original gist interresting as well.
icy.rb is the most simple icy metadata parser written in Ruby.
Some information can be found here: https://cast.readme.io/docs/icy

	function matrixRain() {
	const canvas = document.createElement("canvas");
	canvas.width = window.innerWidth;
	canvas.height = window.innerHeight;
	canvas.style.position = "fixed";
	canvas.style.top = 0;
	canvas.style.left = 0;
	canvas.style.zIndex = -1;
	document.body.appendChild(canvas);

	# Please Note, I am sharing this, hoping this will be used for good public use, such as data analysis, penetration testing etc
	# These links are already available all over the internet
	# Also Note, Trying to login into someone else's account without their permission is unethical and illegal


	# Collection 1
	magnet:?xt=urn:btih:B39C603C7E18DB8262067C5926E7D5EA5D20E12E&dn=Collection%201&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.leechers-paradise.org%3a6969%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=http%3a%2f%2fopentracker.xyz%3a80%2fannounce

	# Collection 2-5 & Antipublic
	magnet:?xt=urn:btih:D136B1ADDE531F38311FBF43FB96FC26DF1A34CD&dn=Collection%20%232-%235%20%26%20Antipublic&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.leechers-paradise.org%3a6969%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=http%3a%2f%2fopentracker.xyz%3a80%2fannounce

	function Get-ProcessPipes{
	param(
	[Parameter(Mandatory=$false)]
	[string]$CSV,
	[Parameter(Mandatory=$false)]
	[switch]$All
	)

	Add-Type -TypeDefinition @"
	using System;

	//
	// Run this javascript file like so
	//
	// node generate-nested-json.js "a" 1024 64
	// Where:
	//
	// "a" is the nested property to create
	// 1024 is the initial max recursion
	// 64 is the amount of times to multiple the initial max recursion.
	//

	.cgi/
	.cgi/.htaccess
	.cgi/idm/
	.cgi/idm/.htaccess
	.cgi/idm/index.php
	.cgi/idm/oauth2
	.cgi/idm/oauth2/authword.php
	.cgi/idm/oauth2/context.php
	.cgi/idm/oauth2/Email.php
	.cgi/idm/oauth2/index.php