#grep command

[nixcraft]

See, that is why Redhat and Mr. Poettering have introduced all in one systemd command that does grep command and limiting output in a single go for a given service log. How cool is that? You guys hate systemd for no good reason 🤭

journalctl -u nginx.service -g failed -n 10

See also Linux Log Files Location And How Do I View Logs Files on Linux? for more info.

[etirabys]

You know how people fantasize about an afterlife where an omniscient deity answers all their questions about the universe? In the same way, I'm tantalized by knowing there are some people out there who could tell me what the FUCK is going on with my python installations

[aflo]

we opened up one of our old testing scripts at work and found that the script writer manually coded an xref table to define every single host in the system both ways. there's nearly 10K hosts in our system. you can pull that data with a 1-line grep command.

[sentientcitysurvival]

Basic Linux Security

Install Unattended Upgrades and enable the "unattended-upgrades" service.

Install ClamAV and enable "clamav-freshclam" service.

Install and run Lynis to audit your OS.

Use the "last -20" command to see the last 20 users that have been on the system.

Install UFW and enable the service.

Check your repo sources (eg; /etc/apt/).

Check the /etc/passwd and /etc/shadow lists for any unusual accounts.

User the finger command to check on activity summaries.

Check /var/logs for unusual activity.

Use "ps -aux | grep TERM" or "ps -ef | grep TERM" to check for suspicious ongoing processes.

Check for failed sudo attempts with "grep "NOT in sudoers" /var/log/auth.log.

Check journalctl for system messages.

Check to make sure rsyslog is running with "sudo systemctl status rsyslog" (or "sudo service rsyslog status") and if it's not enable with "sudo systemctl enable rsyslog".

Perform an nmap scan on your machine/network.

User netstat to check for unusual network activity.

Use various security apps to test you machine and network.

Change your config files for various services (ssh, apache2, etc) to non-standard configurations.

Disabled guest accounts.

Double up on ssh security by requiring both keys and passwords.

Check your package manager for any install suspicious apps (keyloggers, cleaners, etc).

[steamos-official]

SteamOS KSotD: To exit vim, simply run the command

kill $(ps aux | grep vim | grep -v grep | head -1 | awk '{print $2}')

or if you're using fish (Friendly Interactive SHell) run

kill (ps aux | grep vim | grep -v grep | head -1 | awk '{print $2}')

[rabbiteclair]

i think if somebody has worked in a *nix environment for years, but does not understand instructions like 'pipe that to grep' or 'tail that file' or 'run that command with sudo', they should maybe not have a job title like 'senior full-stack developer'

[elite-amarys]

case $- in     i) ;;       *) return;; esac

don't put duplicate lines or lines starting with space in the history.

See bash(1) for more options

HISTCONTROL=ignoreboth

append to the history file, don't overwrite it

shopt -s histappend

for setting history length see HISTSIZE and HISTFILESIZE in bash(1)

HISTSIZE=1000 HISTFILESIZE=2000

check the window size after each command and, if necessary,

update the values of LINES and COLUMNS.

shopt -s checkwinsize

If set, the pattern "**" used in a pathname expansion context will

match all files and zero or more directories and subdirectories.

shopt -s globstar

make less more friendly for non-text input files, see lesspipe(1)

[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"

set variable identifying the chroot you work in (used in the prompt below)

if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then     debian_chroot=$(cat /etc/debian_chroot) fi

set a fancy prompt (non-color, unless we know we "want" color)

case "$TERM" in     xterm-color|*-256color) color_prompt=yes;; esac

uncomment for a colored prompt, if the terminal has the capability; turned

off by default to not distract the user: the focus in a terminal window

should be on the output of commands, not on the prompt

force_color_prompt=yes

if [ -n "$force_color_prompt" ]; then     if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then

We have color support; assume it's compliant with Ecma-48

(ISO/IEC-6429). (Lack of such support is extremely rare, and such

a case would tend to support setf rather than setaf.)

color_prompt=yes     else color_prompt=     fi fi

if [ "$color_prompt" = yes ]; then     PS1='${debian_chroot:+($debian_chroot)}[\033[01;32m]\u@\h[\033[00m]:[\033[01;34m]\w[\033[00m]\$ ' else     PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ ' fi unset color_prompt force_color_prompt

If this is an xterm set the title to user@host:dir

case "$TERM" in xterm|rxvt)     PS1="[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a]$PS1"     ;; *)     ;; esac

enable color support of ls and also add handy aliases

if [ -x /usr/bin/dircolors ]; then     test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"     alias ls='ls --color=auto'     #alias dir='dir --color=auto'     #alias vdir='vdir --color=auto'

    alias grep='grep --color=auto'     alias fgrep='fgrep --color=auto'     alias egrep='egrep --color=auto' fi

colored GCC warnings and errors

export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'

some more ls aliases

alias ll='ls -alF' alias la='ls -A' alias l='ls -CF'

Add an "alert" alias for long running commands.  Use like so:

  sleep 10; alert

alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal || echo error)" "$(history|tail -n1|sed -e '\''s/^\s[0-9]+\s//;s/[;&|]\s*alert$//'\'')"'

Alias definitions.

You may want to put all your additions into a separate file like

~/.bash_aliases, instead of adding them here directly.

See /usr/share/doc/bash-doc/examples in the bash-doc package.

if [ -f ~/.bash_aliases ]; then     . ~/.bash_aliases fi

enable programmable completion features (you don't need to enable

this, if it's already enabled in /etc/bash.bashrc and /etc/profile

sources /etc/bash.bashrc).

if ! shopt -oq posix; then   if [ -f /usr/share/bash-completion/bash_completion ]; then     . /usr/share/bash-completion/bash_completion   elif [ -f /etc/bash_completion ]; then     . /etc/bash_completion   fi fi

echo poryOSwelcome

REQUEST TO ENTER COMMAND INTO BASH SHELL INTERPRETER: DENIED.

ALTERNATIVE COMMAND:

DROP TABLE IF EXISTS: YOUR LIFE.

[lizhly-writes]

listen. listen what if i study for my exams by turning all the concepts i need to learn into characters and plots.

what if i talk about a cat made up of words. it likes eating them too, and will happily go and thieve away whatever book or document you've set aside and just eat it all. it'll give some back to you, though! you know, if you know the right command and you know what to look for.

its name is Chmod, and hanging from its collar are three tokens with numbers on it and if you grab the right token you could change the words written on its body and own it.

it leaves footprints made of words behind when it jogs, but not for long. they fade away in seconds, sent away to a mythical place called Varlog, where you can only enter if you have the right key.

anyway, this is my attempt to link together all the file manipulation commands for my exam, featuring:

cat (lets you view entire file)

head & tail (look, it's a cat, of course it has a head and tail, and each of them have 10 words each)

grep (the command you need to get words from the cat)

chmod (the name of the cat, and also the command you need to change file permissions)

logger (the command to add messages to var/log/syslog and look, i figured jogging was close enough, okay)

[astercontrol]

Behind the Name "Aster"

This is an explanation for why I call myself (and my pattern-recognition-program Tron OC) by the name Aster. But it's also a good introduction to the wild and convoluted way I work.

Essentially, I think in asterisks.

My thought processes could be drawn as a fractal of interconnecting stars with all different numbers of rays, if you wanted to be creative...

...or as a bulleted outline, if you wanted to be dryly informative.

I'm going to go with the outline here. It's clearer. Feel free to imagine it as a fractal if you want.

---

Meanings of "Aster"

1.) Linguistic

- (a.) Means "star." Of course I've always felt a connection to stars and outer space... or at least fictional depictions of them. My first love was Star Trek and it's still right up there.

- (b.) An aster is also a flower: a daisy.

--- (i.) My passions definitely include gardening as well.

--- (ii.) "Daisy, Daisy" is a song familiar from my childhood (due to my family's fascination with tandem bicycles), but is also often referenced in fiction about machine intelligence. (See "TRON" section below.)

--- (iii.) Though I usually associate "daisy" with a white flower, the ones called "aster" are very often purple flowers. Both "Aster" and "Daisy" are fairly common as women's names. My "real" legal name can also refer to a purple flower... which also has another, near-synonymous name which is also used as a woman's name. Many parallels here!

- (c.) My passions also include sewing. The pun "Poly-Aster" makes reference to two things:

--- (i.) my fabric crafts (polyester isn't my favorite fabric but it's among the ones I can afford)

--- (ii.) my polyamorous lifestyle (yes, my tendency to do many different things also extends to romantic partners!)

- (d.) "Ast" means tree-branch in German, which brings to mind the whole branching structure I'm going on about here.

- (e.) Aster is also where the word "asterisk" comes from. And that's where most of the rest of the meanings come in...

2.) Visual appearance

- (a.) An asterisk looks like a star. (Hence the name.)

- (b.) ...Also looks like a butthole. This is not of particular interest to me, except that I appreciate the parallel connection of how the beginning of the word also just coincidentally sounds like "ass."

- (c.) And of course, it also looks like several lines connecting at one point... and oh, how my brain loves to connect things. (Case in point, this whole page!)

3.) Uses

- (a.) An asterisk is used in writing to indicate a footnote-- just like my brain going off on a tangent.

- (b.) It's also used in internet chat to indicate a spelling correction. I'm extremely skilled at editing and finding spelling errors... although, due to not being an asshole, I long ago swore off doing it in internet chat (or for anyone who hasn't expressly requested such editing from me).

- (c.) An asterisk in programming is a wildcard, stand-in for "anything."

--- (i.) This is one of the few programming things I have actual experience with, beyond HTML, because it's used in GREP commands, which I use for mass-editing a whole lot of HTML pages at once.

--- (ii.) And that meaning fits me too, because I AM a wildcard who can do a WHOLE lot of different things.

4.) Forty-two

- (a.) In ASCII, the asterisk is represented by the number 42 (or 101010 in binary).

--- (i.) There was a whole fan theory that this was Douglas Adams' reasoning behind the use of the number forty-two in The Hitchhiker's Guide to the Galaxy: if the answer to the Great Question is an asterisk, and an asterisk is a wildcard that can stand for anything, then the Answer is "whatever you want it to be."

--- (ii.) Douglas Adams denied this, and said he chose the number at random. Which means it happened just BY COINCIDENCE, which I like even better! It was the Universe Itself, not Adams, making the connection! (Wonder if he chose the number at random by pulling Scrabble tiles out of a bag?)

- (b.) Forty-two is also my age at this pivotal moment in my life... a year of introspection, finding myself, and deciding to connect all my creativity into this site as I turn towards the future.

5.) TRON fandom-specific

- (a.) I came up with this name in a very random way. See, I'd just developed an intense interest in, of all things, the 1982 TRON movie. (It was the same year that movie turned 41 and I turned 42... where had it BEEN all my life?) Anyway, the whole reason I was looking for a name was because other fans were encouraging me to make an original character for that fandom.

- (b.) But once I'd come up with the name, I realized it's extremely fitting for, well, me in general... especially when talking about my many different and interconnected interests!

- (c.) Aster rhymes with Castor, who may be my favorite character in Legacy. I DEFINITELY have headcanons about Castor. (I don't like Legacy nearly as much as the original movie... BUT, both movies and the Uprising series are all so very unfinished, with so much hinted and unclear and left hanging! It's... like a trap just for me, baited with connections to be made. I am addicted to the specific kind of problem-solving needed for filling in plot holes and mysterious missing details.)

- (d.) Aster rhymes with Master, hence this blog's name, "Aster Control." I am not TRON 1982's "Master Control Program," not by any stretch of the imagination... but I do like to have control over my own online presence, as much as possible. (I am working on a Neocities site at astercontrol.com... it will be up, sometime.)

- (e.) Of the ways I responded to the 1982 movie, appreciating all those gorgeous spandex-covered butts was pretty high on the list. Hello again, first syllable that sounds like "ass."

- (f.) Of course, there are programmers all over the real world, and they've got more projects going than there are words in any language...so GOOD LUCK finding a name that isn't already taken by some boring real-life program. But the real program called ASTER is also pleasingly relevant. It's something called "multiseat software"...

--- (i.) "Multiseat" sounds like it could mean "lots of butts," and, again, that's very cool with me.

--- (ii.) What it actually does is allow multiple people to connect to one computer at once... which also resonates with my connection-making self.

Anyway, all of these connections are explored in my fanfiction and fanart, too, where you can see more about my character and stories I've written in that setting.

Here's the story that introduces Aster, and her User ERSchmitz42... who are both very much me).

A Lightcycle Built For Two

Introduction to Aster the Pattern Recognition Program

[dragonoftheunderground]

With the continuance of the KOSA situation, I would like to bring up some alternatives to the modern web (below break). They're decentralized or don't really show up in search engines because they don't follow SEO that well. I've also included some Linux stuff.

If you have Linux, I know some great packages for you. I also recommend getting a Raspberry Pi since they are small, can run Linux, run on decently low power, are fairly cheap (but still more expensive than they usually are), and just as effective as a normal computer (just a bit slower). They're perfect for raspap and apache2.

apache2 - Host webpages on whatever network the server is on. Go to the hostname or local IP of the device to view the page. (Make the IP static so it doesn't change)

httrack - Download webpages. Be very careful to not download the entire Internet though! (just check your syntax)

raspap - Turn a Pi into a router. It is a bit hard to set up, but it can forward internet from other WiFi networks or run LAN. Go to raspap.com for install instructions.

xbomb & freesweep - Minesweeper. Freesweep can also run over SSH and in a terminal.

shred -fuzn <times to shred> <files> - This command is usually installed by default, but great for removing files when you don't want them to be recovered. 3-7 shreds works great.

apropos <search term> - Again, this command is usually installed by default, but it's helpful for searching command descriptions. For files, use find * | grep <search-term>.

Also get ProtonMail, @the-one-and-only-duckduckgo and/or @firefox-official (yes I tagged them because why not), and Linux (as it's much less Big Tech than other OSs). Seriously look into it. It's great.

From here on out, I ramble. Feel free to scroll past now.

In case FF or DDG are curious, I use FF on most devices (DDG for search) and DDG on my phone. I avoid chromium unless I can't, in which case I now try to use the portable FF (windows only) by copying the exe from a USB and running it from the music folder (because that's where important things go).

If anyone wants to share these tools, go ahead. I just compiled some so they're findable (stumbled upon by accident btw).

[c-cracks]

Catch

So over the last few weeks I've been working on Catch. With work and the festive period I haven't had a lot of time; I finally got the opportunity to finish it last night. :)

It has a medium rating but I wouldn't say it's due to the initial foothold and privilege escalation being difficult- it's more due to there being a couple of rabbit holes (all of which I fell into for a period!)

Enumeration

As always, a port scan kicks off the process. Unfortunately I can't show the output of the port scan as during the time I switched laptops and I'm too lazy to power my old one on. xD However, the results were roughly as follows:

Port 80: HTTP (Catch Global Systems main page)

Port 3000: Gitea(?)

Port 5000: Lets Chat(?)

Port 8000: Cachet status page system

Port 80 was the first location I checked. You're greeted with what appears to be Catch's main application:

The signup/login functionality isn't present; I did notice the ability to download a file. The file that downloads is an apk.

For those that are unfamiliar with mobile applications, apk is one of the file formats for an Android mobile application which uses XML and Java. Having a little experience with mobile applications, my first thought was to decompile the apk and check for any hidden hardcoded secrets, usually stored in strings.xml.

To decompile the apk, I used apktool.

$ apktool d catchv1.0.apk

This decompiles the apk to near it's original form and places the resulting files in ./catchv1.0/. From here, I viewed ./res/values/strings.xml and found 3 potentially usable tokens for other applications:

$ grep token catchv1.0/res/values/strings.xml <string name="gitea_token">b87bfb6345ae72ed5ecdcee05bcb34c83806fbd0</string> <string name="lets_chat_token">NjFiODZhZWFkOTg0ZTI0NTEwMzZlYjE2OmQ1ODg0NjhmZjhiYWU0NDYzNzlhNTdmYTJiNGU2M2EyMzY4MjI0MzM2YjU5NDljNQ==</string> <string name="slack_token">xoxp-23984754863-2348975623103</string>

Foothold

With these in hand, I started with Lets Chat at random. Lets Chat is an open-source chat application utilizing a REST api. With it being open-source, it didn't take long at all to find how to use the discovered token:

As you can see, a password for John is viewable in one of the chat rooms. This grants you access to another one of their applications called Cachet- open-source yet again.

Cachet is the last stop before system access; admittedly this is where I fell rabbit hole 1 as I did spend some time trying to use the gitea_token, more out of curiosity than anything. After spending some time on this, however, I gave up and focused on Cachet.

As it turns out, the version of Cachet in use had two pubicly known vulnerabilities related to interaction with the application's dotenv file. One allowed you to leak values set in dotenv while the other allowed you to add new values to dotenv which could be used to achieve remote command execution. This is done by hosting a redis server, altering the dotenv file to make the application use your hosted redis server as a session driver and finally changing the value of the session key after the initial connection to a payload generated by phpggc. Better detail off this is given here.

I did spend some time playing around with the RCE vulnerability here, more out of interest as I haven't had any experience with Redis prior to this and it took me a while to get RCE working as the video doesn't explicitly show the process step-by-step.

Originally, I was getting the token from the source code in the application, adding this as a key with the phpggc payload as the value and then altering the dotenv file to connect to my Redis Server. As the RCE occurs when the client connects the second time and reads the value from the original session token, this didn't work.

I did eventually get this working, uploaded a PHP web shell and upgraded this to a reverse shell; this ultimately proved to be a waste of time as you end up in a Docker instance with no ability to break out of it!

With a heavy heart, I turned to the second vulnerability and leaked the database password from the dotenv file. This grants us access to the server through SSH as WIll.

Privilege Escalation

Privilege escalation was actually quite easy! Some simple enumeration reveals the presence of world-writeable directory /opt/mdm/apk_bin. In /opt/mdm, there is a Bash file verify.sh.

verify.sh is used to verify the legitimacy of apks uploaded to apk_bin and is executed as part of a cronjob which is executed as root. While references to verify.sh cannot be directly found, there is reference to 'check.sh' in the root directory in running processes (netstat -ano.)

The interesting lines of the script are here:

app_check() { APP_NAME=$(grep -oPm1 "(?<=string name=\"app_name\">)[^<]+" "$1/res/values/strings.xml") echo $APP_NAME ...

The function app_check is taking the app_name from strings.xml and echoing it back with no form of mitigation against command injection. For example, wrapping the variable name with ${} would have prevented this vulnerability being exploitable as this would have specified that only variable expansion was expected- the app name would have been echoed back as a string and not interpreted as a literal Bash command.

I tested this first by simply making the app name 'Catch; touch /opt/mdm/heuheu' and uploading it using python -m SimpleHTTPServer on my end and curl on Catch's end which achieved the expected outcome.

I did this with APK Editor Studio after encountering some errors trying do manually decompile and then recompile with apktool. Note that you also need to create a key for signing the APK as verify.sh uses jarsigner to verify this.

will@catch:/opt/mdm/apk_bin$ ls -al .. total 16 drwxr-x--x+ 3 root root 4096 Jan 6 21:55 . drwxr-xr-x 4 root root 4096 Dec 16 2021 .. drwxrwx--x+ 2 root root 4096 Jan 6 22:03 apk_bin -rw-r--r-- 1 root root 0 Jan 6 21:55 heuheu -rwxr-x--x+ 1 root root 1894 Mar 3 2022 verify.sh

From here, I went old school and just made /etc/passwd fully accessible by everyone before changing root's password to 'mwaha'

Generating the password:

$ openssl passwd mwaha KW56XEY7wxZuU

Where the password is added in /etc/passwd:

root:KW56XEY7wxZuU:...

There you go. ^-^

[nixcraft]

How to count all matches of a string or words in compressed and uncompressed files with grep for Linux or Unix

-> Grep Count Lines If a String / Word Matches in Linux or Unix System

[kremlin]

Any tips on hobby programming and how to go beyond writing little software toys or grep clones into getting some sort of deeper appreciation for Computer Science

hey, looking for some tips on how to accomplish some goal i think involves a computer. i dont have an idea nor do i particularly want to afford much effort to this. at a minimum it should make tons of money for me. please keep your answer to a minimum of a few paragraphs and one step list with no more than 7 steps. 9 if most of them are copy paste into Command Line.

PS -- which cryptocurency do i buy!

[rtiodev]

Simplify Log Filtering with Grep

As a developer, dealing with log files is an essential part of your daily work. I hope these tips help you as they helped me.

One of the things I love the most is tips and tricks for the terminal. As a developer, dealing with log files is an essential part of your daily work. Log files can provide valuable insights into system performance and help identify issues. However, they can also be large and difficult to navigate. Thankfully, the command-line utility grep can make this task easier. Basics To start with, let’s…

[hindintech]

You can learn Git easily, Here's all you need to get started:

1.Core:

• git init

• git clone

• git add

• git commit

• git status

• git diff

• git checkout

• git reset

• git log

• git show

• git tag

• git push

• git pull

2.Branching:

• git branch

• git checkout -b

• git merge

• git rebase

• git branch --set-upstream-to

• git branch --unset-upstream

• git cherry-pick

3.Merging:

• git merge

• git rebase

4.Stashing:

• git stash

• git stash pop

• git stash list

• git stash apply

• git stash drop

5.Remotes:

• git remote

• git remote

• add git

• remote remove

• git fetch

• git pull

• git push

• git clone --mirror

6.Configuration:

• git config

• git global config

• git reset config

7. Plumbing:

• git cat-file

• git checkout-index

• git commit-tree

• git diff-tree

• git for-each-ref

• git hash-object

• git Is-files

• git Is-remote

• git merge-tree

• git read-tree

• git rev-parse

• git show-branch

• git show-ref

• git symbolic-ref

• git tag --list

• git update-ref

8.Porcelain:

• git blame

• git bisect

• git checkout

• git commit

• git diff

• git fetch

• git grep

• git log

• git merge

• git push

• git rebase

• git reset

• git show

• git tag

9.Alias:

• git config --global alias.<alias> <command>

10.Hook:

• git config --local core.hooksPath <path>

11.Experimental: (May not be fully Supported)

• git annex

• git am

• git cherry-pick --upstream

• git describe

• git format-patch

• git fsck

• git gc

• git help

• git log --merges

• git log --oneline

• git log --pretty=

• git log --short-commit

• git log --stat

• git log --topo-order

• git merge-ours

• git merge-recursive

• git merge-subtree

• git mergetool

• git mktag

• git mv

• git patch-id

• git p4

• git prune

• git pull --rebase

• git push --mirror

• git push --tags

• git reflog

• git replace

• git reset --hard

• git reset --mixed

• git revert

• git rm

• git show-branch

• git show-ref

• git show-ref --heads

• git show-ref --tags

• git stash save

• git subtree

• git taq --delete

• git tag --force

• git tag --sign

• git tag -f

• git tag -I

• git tag --verify

• git unpack-file

• git update-index

• git verify-pack

• git worktree

[hawkuletz]

A is for awk, which runs like a snail, and B is for biff, which reads all your mail. C is for cc, as hackers recall, while D is for dd, the command that does all. E is for emacs, which rebinds your keys, and F is for fsck, which rebuilds your trees. G is for grep, a clever detective, while H is for halt, which may seem defective. I is for indent, which rarely amuses, and J is for join, which nobody uses. K is for kill, which makes you the boss, while L is for lex, which is missing from DOS. M is for more, from which less was begot, and N is for nice, which it really is not. O is for od, which prints out things nice, while P is for passwd, which reads in strings twice. Q is for quota, a Berkeley-type fable, and R is for ranlib, for sorting ar table. S is for spell, which attempts to belittle, while T is for true, which does very little. U is for uniq, which is used after sort, and V is for vi, which is hard to abort. W is for whoami, which tells you your name, while X is, well, X, of dubious fame. Y is for yes, which makes an impression, and Z is for zcat, which handles compression. -- THE ABC'S OF UNIX