Cortex init.d Script Failure on Centos7

If you install Cortex from Yum on Centos7 you will most likely receive this error:

/etc/init.d/cortex: line 26: /lib/init/vars.sh: No such file or directory

This is the fix:

perl -pi -e ‘s|. /lib/init/vars.sh|[ -r /lib/init/vars.sh ] && . /lib/init/vars.sh|g’ /etc/init.d/cortex perl -pi -e ‘s|. /lib/lsb/init-functions|[ -r /etc/init.d/functions ] && . /etc/init.d/functions|g’ /etc/init.d/cortex

Return AlienVault OSSIM Current Version from Command Line

If you want to return the current AlienVault OSSIM version you are running from a command line try this:

version=$(dpkg -l | grep ossim-cd-tools | awk ‘{print $3}’ | awk -F’-‘ ‘{ print $1 }’) echo $version

Parallel Gzip

Lzop use to be my favorite fast compression program. That is until I learned about parallels gzip (pigz)

Compress a Folder # compress a folder called “myfolder” at maximum compression using six threads tar cf – myfolder | pigz -9 -p 6 > myfolder.tar.gz Compress a Folder (Using Variables): # compress a folder called . . . → Read More: Parallel Gzip

Graylog 2.4.6 manual index backup and restore

When you do not have enterprise support closing and opening elastic search indexes can break stuff in Graylog 2.4.6.

Elastic Search Indexes Close/Open

The official documentation for Elasticsearch 2.4.6 closing and opening an index can be found here:

https://www.elastic.co/guide/en/elasticsearch/reference/2.4/indices-open-close.html

curl -XPOST ‘localhost:9200/my_index/_close’ curl -XPOST ‘localhost:9200/my_index/_open’ Closing an index

To close an index:

# curl -XPOST . . . → Read More: Graylog 2.4.6 manual index backup and restore

Script to Backup Alienvault OSSIM Master Server

Script to backup AlienVault OSSIM master server . . . → Read More: Script to Backup Alienvault OSSIM Master Server

tmux horizontal window splitting

To split terminal in to four horizontal tmux windows you can run the following code:

#!/bin/bash tmux new-window -a -n WinSplit tmux new-session -d -s WinSplit tmux selectp -t WinSplit tmux split-window -v tmux set-window-option -g window-status-current-bg blue tmux split-window -v tmux split-window -v tmux select-layout even-vertical tmux attach -t WinSplit

The result is something . . . → Read More: tmux horizontal window splitting

Compare two Files and Print Lines that Match

The proper way to compare two files and print lines that match:

awk ‘NR==FNR{arr[$0];next} $0 in arr’ file1.txt file2.txt

Here is a shell script you can run:

#!/bin/bash # Filename: showdupes.sh # source: http://brakertech.com/compare-two-files-and-print-lines-that-match/ # this file takes two text files as input # sorts them and outputs lines from # file 2 that match . . . → Read More: Compare two Files and Print Lines that Match

Manually Install Kali Linux 2018.4 x64 with VM Fusion 10

Problem

Kali Linux 2018.4 x64 fails to install manually when using VM Fusion 10.1.5 (hangs during “copying data to disk” portion of the install).

Solution Create a new Custom VM Select the iso you downloaded When prompted for the OS of ISO select “Debian 8.x 64 bit” Name the VM ‘kali-linux-2018.4-vm-amd64’ (not required) Set the . . . → Read More: Manually Install Kali Linux 2018.4 x64 with VM Fusion 10

Extracting Password Hashes from Active Directory

Extracting hashes from Active Directory

To extract hashes from Active Directory you must first obtain a copy of the underlying Active Directory database; ntds.dit

For more information on the Data Store Architecture please refer to this Microsoft Technet article

Prerequisites

You must be logged on to a domain controller.

Extracting the Database

To extract . . . → Read More: Extracting Password Hashes from Active Directory

Use ngrep to capture syslog traffic

Instead of using wireshark on Linux to capture traffic try ngrep

# sudo ngrep -d <interface> ‘<search string>’ ‘port 514’

source: http://ngrep.sourceforge.net/usage.html