SPLUNK install on CentOS7

Today we are installing SPLUNK 7.2 on CentOS 7. Lets get started

I am not going into installing CentOS 7, you can figure that out, I am running CentOS 7. with cinnamon desktop installed.

Create a Splunk User

[root@server1 tmp]# groupadd splunk
[root@server1 tmp]# useradd -d /opt/splunk -m -g splunk splunk
[root@server1 tmp]# su - splunk
[splunk@server1 ~]$ id
uid=1001(splunk) gid=1001(splunk) groups=1001(splunk)

Confirm the server architecture

[splunk@server1 ~]$ getconf LONG_BIT
64

Download and extract the Splunk Enterprise version

Extract the tar file and copy the files to the Splunk application folder namely /opt/splunk created

root@server1 tmp]# tar -xvf splunk-6.4.0-f2c836328108-Linux-x86_64.tgz
[root@server1 tmp]# cp -rp splunk/* /opt/splunk/
[root@server1 tmp]# chown -R splunk: /opt/splunk/

Splunk Installation

root@server1 tmp]# su - splunk
Last login: Fri Apr 29 08:14:12 UTC 2016 on pts/0

[splunk@server1 ~]$ cd bin/
[splunk@server1 bin]$ ./splunk start --accept-license

A bunch of text will display but if all is good, you will see the below message

Waiting for web server at http://127.0.0.1:8000 to be available.... Done

I test the Splunk on the host first, open a browser and type http://localhost:8000

if you get the Plunk Enterprise logon screen, you are in business.

Now you may want to connect to the Splunk from another system, you will need to make sure you have port 8000 open on your CentOS 7 system.

Heres how I did it on my system

firewall-cmd --get-active-zones

you should see a zone, mine retuned public.

firewall-cmd --zone=public --add-port=8000/tcp --permanent

firewall-cmd --reload

now check your remote system, you should be good to go...

if anything in this instruction doesn't work, let me know.

Raise USB port limit for 10.14 and 10.13.6

Now here's the steps to add a specific patch for the version of macOS you're using and you only need to add one patch:

1. Mount EFI Partition with Clover Configurator
2. Navigate to /Volumes/EFI/Clover/kexts/Other
3. Verify that USBInjectAll.kext exists
   1. Download USBInjectAll.kext and place it in /EFI/Clover/kexts/Other if you're missing it
4. If you have a Kaby Lake (200 series B250/H270/2370) / Coffee Lake (300 series B360/H370/Z370) or X99 (X99/X299 motherboard you will likely need an XHCI injector kext:
   1. Download OS-X-USB-Inject-All folder
   2. Unzip OS-X-USB-Inject-All copy appropriate injector kext into /Volumes/EFI/Clover/kexts/Other
      1. Tip: Use XHCI-200-series-injector.kext for B250/H270/Z270 motherboards or XHCI-200-series-injector.kext for B360/H370/Z370 motherboards or XHCI-x99-injector.kext for X99/X299 motherboards.
5. Navigate to /Volumes/EFI/EFI/Clover/
6. Right-click open config.plist with Clover Configurator
7. Click Kernel and Kext Patches under SECTIONS of Clover Configurator
8. Click the “+” button near the bottom to add a patch:
   • Mojave 10.14 (Beta):
     • Name*: com.apple.driver.usb.AppleUSBXHCI
     • Find* [Hex]: 83FB0F0F 83030500 00
     • Replace* [Hex] : 83FB0F90 90909090 90
     • Comment: USB 10.13.4+ by PMHeart
     • MatchOS:
   • High Sierra 10.13.6:
     • Name*: com.apple.driver.usb.AppleUSBXHCI
     • Find* [HEX]: 837D880F 0F83A704 0000
     • Replace* [HEX]: 837D880F 90909090 9090
     • Comment: USB 10.13.6+ by PMHeart
     • MatchOS: 10.13.x

HP 840 G3 notes

I will be posting my experience of loading Mojave on my HP 840 G2 i7

to get sleep to work I did this in terminal

sudo pmset -a standby 0 && sudo pmset -a autopoweroff 0

I still cannot get it to stop resetting bios on restart.

Remove water mark from Windows 10

Regedit


Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc

Modify Start Value data: to 4

OK

restart

8""""8               8""""8                              
8    8   eeeee eeeee 8      eeee eeee eeeee eeeee eeeee  
8eeee8ee 8   8 8   8 8eeeee 8    8  8   8   8  88 8   8  
88     8 8eee8 8e  8     88 8eee 8e     8e  8   8 8eee8e 
88     8 88  8 88  8 e   88 88   88     88  8   8 88   8 
88eeeee8 88  8 88ee8 8eee88 88ee 88e8   88  8eee8 88   8 

██╗    ██╗ █████╗ ███████╗    ██╗  ██╗███████╗██████╗ ███████╗
██║    ██║██╔══██╗██╔════╝    ██║  ██║██╔════╝██╔══██╗██╔════╝
██║ █╗ ██║███████║███████╗    ███████║█████╗  ██████╔╝█████╗  
██║███╗██║██╔══██║╚════██║    ██╔══██║██╔══╝  ██╔══██╗██╔══╝  
╚███╔███╔╝██║  ██║███████║    ██║  ██║███████╗██║  ██║███████╗
 ╚══╝╚══╝ ╚═╝  ╚═╝╚══════╝    ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝╚══════╝

Life Hack, How I got access to the back office

Today I was visiting an office and waiting for an "appointment" wink wink. Doing what I normally do, I watched the security guards checking badges and listening to them complain. The key to this hack is to listen to guards and pay attention to what they are saying, in this conversation they where talking about not having enough time to get lunch and all they had on site was a vending machine. One of the guards was asking the other what they would like for lunch, the other said "Man, at this point I would eat anything". 

Hearing this and wanting to get to the back office for my "Meeting" of course, (wink wink). I went to Taco Bell and bought two bean and cheese burrito's and two super taco's. Knowing that the bean and cheese burritos could be weaponized, I wanted to make sure the effect was complete with the super taco. 

I returned to the office and said "Hey guys, I was in the waiting room and over heard your conversation, I wanted to be a NICE GUY (<- this is important) and get you two some lunch. They both where very happy and ate all the food.

This is where the hack comes in, knowing that Taco Bell takes about 30 minutes to take affect, I set my iPhone stop watch. Sure enough, at 31 minutes both guards went running for the bathroom. I was able to walk into the back office and OWN all the things.

-----  BadSector

Windows 10 Wireshark no interfaces version1803

So, you are getting ready for DEFCON 26 and you are heading to Packet Hacking Village, you got your laptop all ready to go, reloaded Windows 10 and made sure you have no saved passwords and personal data. You start installing the apps you will need and boom, you start Wireshark and it finds no interfaces. No fear, BADSECTOR is here.

1. start CMD with Run as administrator 
2. in the command line type sc start npf
3. start Wireshark
4. winning