tomaszklim

REM  Code from https://payload.pl/jak-prosto-wirusy-rozbrajaja-zabezpieczenia-windows-10/

for /f “delims=” %%I in (‘wevtutil el’) do (wevtutil cl “%%I”)
wevtutil sl Security /e:false

tomaszklim

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

tomaszklim

# Download and unpack your chosen OpenCV version., eg. as `/usr/local/src/opencv-3.4.1`
# You can use https://github.com/pisecurity/opencv-manager repository as well.

# This is important. On Ubuntu 20.04 LTS, it is not enough to install just python-dev.
apt-get install python-dev python-numpy python-is-python2 python2.7 python2.7-dev python2.7-minimal

# All unrelated build settings were cut off.
cd /usr/local/src/opencv-3.4.1/build
cmake \
    -DENABLE_PRECOMPILED_HEADERS=OFF \

tomaszklim

#!/bin/bash

api_key="u123456-qa9oic80zsll1xi0fhbwso1"

if [ "$3" = "" ]; then
    echo "usage: $0 <check-id> <search-for> <replace-with> [--execute]"
    exit 0
fi

tmp=/tmp/uptimerobot-$1-$$.tmp

tomaszklim

#!/bin/sh

if [ ! -f /swapfile ]; then
        dd if=/dev/zero of=/swapfile bs=1M count=16384
        chmod 0600 /swapfile
        mkswap /swapfile
        swapon /swapfile
        if ! grep -q swapfile /etc/fstab; then
                echo "/swapfile none swap sw 0 0" >>/etc/fstab
        fi

tomaszklim

echo "Installing Espeo custom monitoring client"
yum install -y git
git clone https://github.com/serverfarmer/heartbeat-linux /opt/heartbeat
/opt/heartbeat/setup.sh
echo "http://monitoring.espeo.pl/cgi-bin/heartbeat-local.cgi" >/etc/heartbeat/server.url

tomaszklim

#!/bin/sh
# Espeo Software server analysis script
# Written by Tomasz Klim
# Version 1.2
#
# Run this script as root and send us the created TGZ package.

WD=`pwd`
path=$WD/analysis
mkdir -p $path/etc $path/log $path/ls $path/proc

tomaszklim

#!/bin/sh
# Written by Tomasz Klim, 2019-07-05
#
# This is a simplified, open source version. It relies on $MAILTO variable
# defined in /etc/crontab file for all cron tasks. A better approach would
# be to send emails in dedicated format, to dedicated list of recipients.
#
# Add this to /etc/crontab:
# * * * * * root /etc/local/docker-logtail.sh

tomaszklim

#!/bin/sh

apt install apt-transport-https ca-certificates curl software-properties-common

echo "deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable" >/etc/apt/sources.list.d/docker.list
curl -fsSL https://download.docker.com/linux/ubuntu/gpg |apt-key add -

apt update
apt install docker-ce python-pip

tomaszklim

#!/bin/sh

git clone https://github.com/CISOfy/lynis /opt/lynis
cd /opt/lynis && /opt/lynis/lynis audit system --cronjob --quiet |grep -v custom.prf
grep warning /var/log/lynis-report.dat |egrep -v "(CONT-8104|KRNL-5830|NETW-2705)"