zer0es onesorzer0es

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

Setup MinIO on Ubuntu 20.04 LTS with Let's Encrypt SSL

✨✨✨✨✨✨✨✨✨✨✨✨✨✨✨✨✨
SUPPORT MY WORK - Everything Helps Thanks
YouTube 🔗 https://YouTube.GetMeTheGeek.com
Buy Me a Coffee ☕ https://www.buymeacoffee.com/getmethegeek
Hire US 🔗 https://getmethegeek.com
Digital Ocean referral 🔗 https://tiny.cc/plxdigitalocean
✨✨✨✨✨✨✨✨✨✨✨✨✨✨✨✨✨

Command Execution

exec           - Returns last line of commands output
passthru       - Passes commands output directly to the browser
system         - Passes commands output directly to the browser and returns last line
shell_exec     - Returns commands output
\`\` (backticks) - Same as shell_exec()
popen          - Opens read or write pipe to process of a command
proc_open      - Similar to popen() but greater degree of control
pcntl_exec - Executes a program

UFW

I use Ubuntu’s Uncomplicated firewall because it is available on Ubuntu and it's very simple.

Install UFW

if ufw is not installed by default be sure to install it first.

	meta:
	id: beaconconfig
	title: Cobalt Strike Beacon Config
	endian: be

	doc: \|
	Cobalt Strike Beacon is a popular offensive security tool. Beacon itself
	is a DLL that gets injected into memory and can be staged from C2 servers.
	The Beacon DLL (in unencoded form) contains a configuration section that gets
	patched by the C2 server. This section is a fixed predictable structure

	rem USE AT OWN RISK AS IS WITHOUT WARRANTY OF ANY KIND !!!!!
	rem https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreference
	rem To also disable Windows Defender Security Center include this
	rem reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
	rem 1 - Disable Real-time protection
	reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
	reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
	reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
	reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
	reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

	# Logparser


	###############
	# Security Log
	###############

	# Find Event id
	& 'C:\Program Files (x86)\Log Parser 2.2\LogParser.exe' -stats:OFF -i:EVT "SELECT * FROM 'Security.evtx' WHERE EventID = '5038'"