| create d1 database, bind it to worker | |
| make a log table, add fields you need. |
| Login: | |
| cloudflared tunnel login | |
| Create tunnel: | |
| cloudflared tunnel create infra | |
| Create routing/dns record: | |
| cloudflared tunnel route dns infra YOURDOMAIN.COM | |
| On cloudflare website, in dns record, replace 'infra' with '*' and save. |
| https://forum.proxmox.com/threads/is-it-possible-to-have-containers-auto-login-on-the-web-gui-like-the-node.62097/#post-391377 | |
| Command: | |
| ``` | |
| systemctl edit [email protected] | |
| ``` | |
| File content: |
Article with details regarding the vuln and malicious use & file hashes: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
File: 049af32f678da5e344315ce46787e8fc
Anyrun: https://app.any.run/tasks/3c2f3ff4-3883-4f68-98d1-706138771f46
remnux@remnux:~/Downloads$ md5sum malware.rar
a519226ff8e4edd6d622db45a0099932 malware.rar
remnux@remnux:~/Downloads$ 7z l malware.rar |grep -v ico
| version: "3.6" | |
| services: | |
| so1: | |
| image: splunk/splunk:latest | |
| container_name: so1 | |
| environment: | |
| - SPLUNK_START_ARGS=--accept-license | |
| - SPLUNK_PASSWORD=password | |
| - SPLUNK_LICENSE_URI=Free |
| import requests | |
| GUAC_URL="http://10.0.0.1:8080/guacamole" | |
| GUAC_USERNAME="user" | |
| GUAC_PASSWORD="password" | |
| def get_token(): | |
| url = f"{GUAC_URL}/api/tokens" | |
| payload = f"username={GUAC_USERNAME}&password={GUAC_PASSWORD}" | |
| headers = {"Content-Type": "application/x-www-form-urlencoded"} |
| version: '3' | |
| services: | |
| elasticsearch: | |
| image: docker.elastic.co/elasticsearch/elasticsearch:8.8.0 | |
| container_name: elasticsearch | |
| environment: | |
| - xpack.security.enabled=false #there is no password to access ES!! | |
| - xpack.security.enrollment.enabled=false | |
| - discovery.type=single-node | |
| ulimits: |
| :80 { | |
| reverse_proxy :9000 { | |
| header_up +Remote-User "anonymous" | |
| } | |
| } | |
| version: "3.9" | |
| services: | |
| cloudflared: | |
| image: cloudflare/cloudflared:latest | |
| network_mode: "service:gluetun" | |
| command: tunnel --no-autoupdate --url http://localhost:3000 | |
| #webtop | |
| webtop: |
| # ingest data from hybrid analysis | |
| import requests | |
| import psycopg2 | |
| HA_API = "" | |
| ha_header = {'api-key':HA_API, 'user-agent': 'Falcon Sandbox', 'accept': 'application/json'} | |
| POSTGRES_HOST = "localhost" | |
| POSTGRES_DB = "procsearch" | |
| POSTGRES_SEARCH_USER = "postgres" |