Casey Bleeker geekbleek

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096

Prerequisites:

You'll need:

A paid ngrok account
A reserved domain on ngrok, e.g. the FQDN you're generating certs for
A registed domain and access to change DNS records

How to

Install certbot and ngrok

brew cask install certbot ngrok

Converting a Word Document to Markdown in One Move

The Problem

A lot of important government documents are created and saved in Microsoft Word (*.docx). But Microsoft Word is a proprietary format, and it's not really useful for presenting documents on the web. So, I wanted to find a way to convert a .docx file into markdown.

Installing Pandoc

On a mac you can use homebrew by running the command brew install pandoc.

	// An usage of AWS.IotData in Lambdas
	//
	// This example assumes some things
	// 1. That you have a environment variable AWS_IOT_ENDPOINT. This is the url that you can find in AWS IoT dashboard settings
	// 2. The lambda and your aws iot devices are on the same account and region

	const AWS = require('aws-sdk');
	const iotData = new AWS.IotData({ endpoint: process.env.AWS_IOT_ENDPOINT });

	const handler = (event, context) => {

	Note: I created this for Cisco Live San Diego 2015.

	My name is Ashley.
	I am the explainer,
	In the next 10 mins,
	We talk containers

	Chapter 1: The situation

	Let’s meet a web app

	# See list of docker virtual machines on the local box
	$ docker-machine ls
	NAME ACTIVE URL STATE URL SWARM DOCKER ERRORS
	default * virtualbox Running tcp://192.168.99.100:2376 v1.9.1

	# Note the host URL 192.168.99.100 - it will be used later!

	# Build an image from current folder under given image name
	$ docker build -t gleb/demo-app .