Thứ Ba, 18 tháng 1, 2022

How to solve “unmatched double quote” error using dbus-monitor in combination with xargs

 From man xargs:

--delimiter=delim
-d delim
      Input  items  are terminated by the specified character.  Quotes
      and backslash are not special; every character in the  input  is
      taken  literally.   Disables  the  end-of-file  string, which is
      treated like any other argument.  This  can  be  used  when  the
      input consists of simply newline-separated items, although it is
      almost always better to design your program to use --null  where
      this  is  possible.   The  specified  delimiter  may be a single
      character, a C-style character escape such as \n, or an octal or
      hexadecimal escape code.  Octal and hexadecimal escape codes are
      understood as for the printf command.   Multibyte characters are
      not supported.

As an example:

$ echo '"""' | xargs
\xargs: unmatched double quote; by default quotes are special to xargs unless you use the -0 option
$ echo '"""' | xargs -d '\n'
"""

$ echo '"""' | xargs -d ' ' 
"""

Of course, using either may break things, but perhaps not as much as -0.

Read More
Người đăng: vào lúc Không có nhận xét nào:

Thứ Hai, 10 tháng 1, 2022

INSTALL WINDOWS 10 ON DIGITALOCEAN

 

Table of Contents

Summary

In this guide we will learn how to install Windows 10 1803 on Digital Ocean using the official Windows ISO. This process will take between 1-2 hours and requires some level of linux and virtualization knowledge.

Preparation

If you don’t already have a DigitalOcean account, you can use my referral code and get $10 off your new account.

First create two droplets, in this example I created two 2GB instance named imageserver and windows respectively.

We will use imageserver temporarily to build and host the Windows installation files. As such it will be deleted at the end.

windows will be where our Windows installation will eventually live. This droplet can be any size.

For this guide to work imageserver must have at least 2GB of ram, however we can select a more powerful droplet as it will only be used temporarily and thus only costs a fraction of a cent for a faster installation process.

Build environment

Once they have been spun up, we will ssh into imageserver and setup the required dependencies.

# Install qemu
apt-get update && apt-get install qemu -y

# Create disk image
qemu-img create -f raw windows10.img 16G

# Get virtio drivers
wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso

Windows ISO

We will also need a copy of the Windows 10 ISO. To get this you will need to visit Microsoft’s ISO download page to generate a unique link.

Select Windows 10 and English, then right click on 64-bit Download and select copy link location.

Replace the link within the single quotes in the next section with your own. Make sure you keep the quotes and -O Win10_1803_English_x64.iso line.

# Download Windows 10 ISO
wget -O Win10_1803_English_x64.iso 'https://software-download.microsoft.com/pr/Win10_1803_English_x64.iso?t=72da8fbf-7dff-49e0-9fbe-7a61e523c2ac&e=1537466952&h=6662b277f04183b1a08d25fbc1256aec'

Windows installation

Now that we have all the required dependencies, we can go ahead and start the installation. Using the following command we will start emulating the Windows ISO and a VNC server so we can connect to it.

# Start Windows 10 VM with VNC
 qemu-system-x86_64 \
  -m 1G \
  -cpu host \
  -enable-kvm \
  -boot order=d \
  -drive file=Win10_1803_English_x64.iso,media=cdrom \
  -drive file=windows10.img,format=raw,if=virtio \
  -drive file=virtio-win.iso,media=cdrom \
  -vnc :0 \
  # Press CTRL + C to stop virtualization

Replace -m 1G with -m 2G or -m 6G if your imageserver droplet is 4GB or 8GB

Now on your local machine you will need to use a VNC Viewer to access it. In this example I use xtightvncviewer on my local debian system. Replace imageserver with your servers IP.

# Install vncviewer
sudo apt-get install xtightvncviewer

# Connect to imageserver
vncviewer imageserver

After connecting to the VNC server we should see the Windows language selection screen.

If we hit next then install now we should be presented with a screen asking for our license key. Either enter your key or select I don't have a product key and continue to the selection screen. I choose Windows 10 Pro for this demo and grudgingly ignored the EULA.

Hot tip: you can use the tab, enter and arrow keys to navigate the entire installation process.

Drivers

Now for the important bits!

First select Custom: Install Windows only (advanced).

Then select Load driver then click browse.

You’ll want to scroll down to CD Drive (E:) virtio-win-0.1.1.

Now we can select the Network driver, which can be found in E:\NetKvm\w10\amd64.

We will also need to uncheck Hide drivers that aren't compatible with this computer's hardware then select the first option Red Hat VirtIO Ethernet Adapter and next.

Now we need to repeat this process again selecting Load driver, browse and scrolling down to CD Drive (E:) virtio-win-0.1.1.

This time we need to select E:\viostor\w10\amd64 and install the Red Hat VirtIO SCSI controller.

We should now see our drive. Go ahead and highlight it then click next one last time.

Now we wait for the installation to complete. This will take about 5 minutes.

Once we see the Windows needs to restart to continue screen we can close vncviewer, go back to our terminal, and hit CTRL+C to stop virtualization.

Disk transfer

Now that we have a Windows 10 image with the correct drivers we will need to compress it and transfer it to our Windows Droplet.

To do this first we compress the image using the following command.

# Compress image
dd if=windows10.img | gzip -c > windows10.gz

This will take a a little while, so now is probably a good time to grab some water or stretch a bit.

The following will show up when it’s done.

33554432+0 records in
33554432+0 records out
17179869184 bytes (17 GB, 16 GiB) copied, 723.762 s, 23.7 MB/s

Once the image has been compressed we can go ahead and host it using the following.

python3 -m http.server

Now we need to jump back to the DigitalOcean dashboard and open the windows droplet we created earlier.

First click Recovery on the bottom left, then select Boot from Recovery ISO and turn off the droplet using the switch in the top right.

As soon as the droplet is powered off we can hit the power switch again and bring it online.

Once it’s powered on with the recovery ISO we can SSH into it. SSH is needed as the DigitalOcean console doesn’t support the | pipe character.

--------------------------------------------------------------------

DigitalOcean Recovery Environment 18.04.1 (Zesty Zona)

This image has been mounted by the DigitalOcean Support Team.
When you have completed your work in the recovery environment
update your support ticket to request that your droplet be booted
to it's disk.

This rescue environment is based on Ubuntu 18.04.

--------------------------------------------------------------------
Last login: Wed Sep 19 19:32:54 2018
root@windows:~#

Now we need to type the following, replacing imageserver with the IP of your imageserver droplet.

wget -O- http://imageserver:8000/windows10.gz | gunzip | dd of=/dev/vda

This should take about 7 minutes. Near the end it may appear to hang, but it is just copying the file to the disk.

--2018-09-19 19:44:19--  http://imageserver:8000/windows10.gz
Connecting to imageserver:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3901220354 (3.6G) [application/gzip]
Saving to: ‘STDOUT’

-                              100%[=================================================>]   3.63G  39.2KB/s    in 7m 14s  

2018-09-19 19:51:34 (8.57 MB/s) - written to stdout [3901220354/3901220354]

33554432+0 records in
33554432+0 records out
17179869184 bytes (17 GB, 16 GiB) copied, 436.588 s, 39.4 MB/s

Once the copy is complete we can run shutdown 0 and go back to the recovery page on the digital ocean dashboard. We then select Boot from Hard Drive and power the droplet back on.

We should now be able to press the console button in the top right to complete our Windows installation.

The Basics

At this point we a have a mostly functional Windows install. We just need to complete the initial setup, configure the network settings and enable remote desktop.

Go ahead and fill in the basics, choosing do this later when you get to network settings, and put special care (or better yet random generation) into choosing a secure password.

Once the basics are done, we need to configure the network.

Network Settings

We can do this by clicking on the network icon in the bottom right, then selecting Network & Internet Settings

Now we can click Change adapter options at the bottom of this window.

From here we can select our Ethernet adapter and click the little drop down in the top right, then selecting Change settings of this connection

Now double click on Internet Protocol Version 4 (TCP/IPv4) to bring up the IPv4 settings.

You can use the information at the bottom of the Droplet Console to complete the next section. You will also need to enter DNS servers. In this example I used 1.1.1.1 provided by CloudFlare and 8.8.8.8 provided by Google.

Remote Desktop

Now that our droplet is connected to the network we will need to setup a better way to manage it. For this guide we will set up Remote Desktop Protocol (aka RDP), however you could also setup VNC or another remote desktop application if you prefer.

First we goto the start menu and search Remote Desktop settings

From here we toggle the Enable Remote Desktop button, then click Advanced settings

Lastly we need to uncheck Require computers use Network Level Authentication otherwise we will receive a CredSSP error when trying to connect.

Read More
Người đăng: vào lúc Không có nhận xét nào:

Create Image Windows to install windows vps DigitalOcean, Linode, Vurlt

 Step1: Download & Install PuTTy, PuTTy Key Generator

Step2: Create SSH keys add to Cloud Server

Step3: Create Cloud Server

Step4: Open PuTTy connect to Cloud Server


Step5: Install qemu

apt-get update && apt-get install qemu -y


Step6: Create disk image

apt install qemu-utils

qemu-img create -f raw windows2012.img 16G


Step7: Get virtio drivers

wget -O virtio-win.iso ‘https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.185-2/virtio-win-0.1.185.iso’


Step8: Wget Windows2012.iso

wget -O Windows2012R2.iso ‘https://Your Link Windows.ISO’


Step9: Start Virtualization Process on the templateimage server

apt install qemu-system-x86-xen


qemu-system-x86_64

-m 3G

-cpu host

-enable-kvm

-boot order=d

-drive file=Windows2012R2.iso,media=cdrom

-drive file=windows2012.img,format=raw,if=virtio

-drive file=virtio-win.iso,media=cdrom

-vnc :0


To complete windows setup you need to connect templateimage server with VNC

# Press CTRL + C to stop virtualization


Step10: Install VNC Viewer


Step11: Open VNC Viewer connect IP Cloud Server and Install Windows

11.1 Load Driver: NetKVM/2k12R2/amd64

11.2 Load Driver: Viostor/2k12R2/amd64

11.3 Enable Remote Desktop

11.4 Control PanelAll Control Panel ItemsWindows FirewallAllowed apps: Remote Desktop stick Private & Public

11.5 Enable Ctrl Alt Delete


Step12: Press CTRL + C to stop virtualization


Step13: Install GZIP

apt-get install gzip


Step14: Compress image

dd if=windows2012.img | gzip –c Windows2012R2.gz

Wait until finished (5-20p)


Step15: Install Apache2

apt install apache2

sudo ufw app list

sudo ufw allow ‘Apache’

sudo ufw status

sudo systemctl status apache2


Step16: Move Windows2012R2.gz to /var/www/html/


cd /var/www/

cd html

cp Windows2012R2.gz /var/www/html/


Step17: Install Windows.GZ on DigitalOcean, Linode, Vurlt

Read More
Người đăng: vào lúc Không có nhận xét nào:

Thứ Sáu, 7 tháng 1, 2022

wazuh v4 Telegram Integration

 nano /var/ossec/integrations/custom-telegram

-----------------------------------------------------------------------
#!/bin/sh

WPYTHON_BIN="framework/python/bin/python3"

SCRIPT_PATH_NAME="$0"

DIR_NAME="$(cd $(dirname ${SCRIPT_PATH_NAME}); pwd -P)"
SCRIPT_NAME="$(basename ${SCRIPT_PATH_NAME})"

case ${DIR_NAME} in
    */active-response/bin | */wodles*)
        if [ -z "${WAZUH_PATH}" ]; then
            WAZUH_PATH="$(cd ${DIR_NAME}/../..; pwd)"
        fi

        PYTHON_SCRIPT="${DIR_NAME}/${SCRIPT_NAME}.py"
    ;;
    */bin)
        if [ -z "${WAZUH_PATH}" ]; then
            WAZUH_PATH="$(cd ${DIR_NAME}/..; pwd)"
        fi

        PYTHON_SCRIPT="${WAZUH_PATH}/framework/scripts/${SCRIPT_NAME}.py"
    ;;
     */integrations)
        if [ -z "${WAZUH_PATH}" ]; then
            WAZUH_PATH="$(cd ${DIR_NAME}/..; pwd)"
        fi

        PYTHON_SCRIPT="${DIR_NAME}/${SCRIPT_NAME}.py"
    ;;
esac


${WAZUH_PATH}/${WPYTHON_BIN} ${PYTHON_SCRIPT} "$@"
-----------------------------------------------------------------------------------

nano /var/ossec/integrations/custom-telegram.py

-----------------------------------------------------------------------------------
#!/usr/bin/env python

import sys
import json
import requests
from requests.auth import HTTPBasicAuth

#CHAT_ID="xxxx"
CHAT_ID=""

# Read configuration parameters
alert_file = open(sys.argv[1])
hook_url = sys.argv[3]


# Read the alert file
alert_json = json.loads(alert_file.read())
alert_file.close()

# Extract data fields
alert_level = alert_json['rule']['level'] if 'level' in alert_json['rule'] else "N/A"
description = alert_json['rule']['description'] if 'description' in alert_json['rule'] else "N/A"
agent = alert_json['agent']['name'] if 'name' in alert_json['agent'] else "N/A"
# Generate request
msg_data = {}
msg_data['chat_id'] = CHAT_ID
msg_data['text'] = {}
msg_data['text']['description'] =  description
msg_data['text']['alert_level'] = str(alert_level)
msg_data['text']['agent'] =  agent
headers = {'content-type': 'application/json', 'Accept-Charset': 'UTF-8'}


# Send the request
requests.post(hook_url, headers=headers, data=json.dumps(msg_data))

sys.exit(0)
------------------------------------------------------------------------------------------------------

chown root:ossec /var/ossec/integrations/custom-telegram*

chmod 750 /var/ossec/integrations/custom-telegram*

--------------------------------------------------------------------------------------------------------
nano /var/ossec/etc/ossec.conf

<integration>
        <name>custom-telegram</name>
        <level>3</level>
        <hook_url>https://api.telegram.org/bot*YOUR API KEY*/sendMessage</hook_url>
        <alert_format>json</alert_format>
    </integration>
    
 ----------------------------------------------------------------------------------------------------------
 systemctl restart wazuh-manager
Read More
Người đăng: vào lúc Không có nhận xét nào:
Đăng ký: Bài đăng (Atom)