Skip to content

Instantly share code, notes, and snippets.

@thesamesam
thesamesam / xz-backdoor.md
Last active April 25, 2024 13:26
xz-utils backdoor situation (CVE-2024-3094)

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

@andrebrait
andrebrait / keychron_linux.md
Last active April 25, 2024 13:24
Keychron keyboards on Linux + Bluetooth fixes

Here is the best setup (I think so :D) for K-series Keychron keyboards on Linux.

Note: many newer Keychron keyboards use QMK as firmware and most tips here do not apply to them. Maybe the ones related to Bluetooth can be useful, but everything related to Apple's keyboard module (hid_apple) on Linux, won't work. As far as I know, all QMK-based boards use the hid_generic module instead. Examples of QMK-based boards are: Q, Q-Pro, V, K-Pro, etc.

Most of these commands have been tested on Ubuntu 20.04 and should also work on most Debian-based distributions. If a command happens not to work for you, take a look in the comment section.

Make Fn + F-keys work (NOT FOR QMK-BASED BOARDS)

Older Keychron keyboards (those not based on QMK) use the hid_apple driver on Linux, even in the Windows/Android mode, both in Bluetooth and Wired modes.

@gladiatx0r
gladiatx0r / Workstation-Takeover.md
Last active April 25, 2024 13:23
From RPC to RCE - Workstation Takeover via RBCD and MS-RPChoose-Your-Own-Adventure

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

  • Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
  • Relaying that machine authentication to LDAPS for configuring RBCD
  • RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

@fevangelou
fevangelou / my.cnf
Last active April 25, 2024 13:22
Optimized my.cnf configuration for MySQL/MariaDB (on Ubuntu, CentOS, Almalinux etc. servers)
# === Optimized my.cnf configuration for MySQL/MariaDB (on Ubuntu, CentOS, Almalinux etc. servers) ===
#
# by Fotis Evangelou, developer of Engintron (engintron.com)
#
# ~ Updated December 2021 ~
#
#
# The settings provided below are a starting point for a 8-16 GB RAM server with 4-8 CPU cores.
# If you have different resources available you should adjust accordingly to save CPU, RAM & disk I/O usage.
#
@ThioJoe
ThioJoe / whisper-script.py
Last active April 25, 2024 13:21
Basic Whisper Transcription Script
# Basic script for using the OpenAI Whisper model to transcribe a video file. You can uncomment whichever model you want to use.
# Author: ThioJoe ( https://github.com/ThioJoe )
# Required third party packages: whisper
# See instructions for setup here: https://github.com/openai/whisper#setup
# - You can use the below command to pull the repo and install dependencies, then just put this script in the repo directory:
# pip install git+https://github.com/openai/whisper.git
import whisper
import io
@raecoo
raecoo / console.save.js
Last active April 25, 2024 13:19
Save JSON object to file in Chrome Devtool
// e.g. console.save({hello: 'world'})
(function(console){
console.save = function(data, filename){
if(!data) {
console.error('Console.save: No data')
return;
}
if(!filename) filename = 'console.json'
if(typeof data === "object"){
data = JSON.stringify(data, undefined, 4)
@PlugFox
PlugFox / example.dart
Last active April 25, 2024 13:17
Flutter get screenshot from canvas layer
import 'dart:async';
import 'dart:io';
import 'dart:typed_data';
import 'package:flutter/material.dart';
import 'package:gallery_saver/gallery_saver.dart';
import 'package:path/path.dart';
import 'package:path_provider/path_provider.dart';
import 'screenshot.dart';
@GeorgDangl
GeorgDangl / AccountController.cs
Created December 24, 2017 12:39
Appending custom claims when logging in via cookie with Asp.Net Core Identity
public class AccountController : Controller
{
[HttpPost("login")]
[AllowAnonymous]
[ProducesResponseType(204)]
[ProducesResponseType(400)]
public async Task<IActionResult> Login([FromBody] LoginPost model)
{
var user = await _userManager.FindByEmailAsync(model.Identifier)
?? await _userManager.FindByNameAsync(model.Identifier);
@khushal87
khushal87 / blog3.md
Last active April 25, 2024 13:13
Linking a custom domain from Google domains to Vercel app

Linking a custom domain to a deployed application is confusing and at times you don't get a route on how to link the domain with the website. 😫

In this article, I will be explaining how to link a Custom domain brought in Google Domains service to an application hosted on Vercel.

Perks of using vercel is that it allows adding domain without any verification unlike Heroku/Netlify, which means you don't have to add your billing details to add a domain to your application. Moreover, it is fast, efficient, and easy to use.😁

What is Vercel?

​Vercel is a deployment and collaboration platform for frontend developers. ​Vercel enables developers to host websites and web services that deploy instantly and scale automatically – all without any configuration. Source - Official Docs

@metux
metux / totp-token.py
Created September 21, 2023 10:53
simple TOTP token generator w/ qrcode image decoding
#!/usr/bin/env python3
# deps: zbar-tools, oathtool
#
# call it as toptp-token.py <qrimage-filename>
#
# 1. decodes the qrcode image via zbar-img
# 2. parses totp url and extracts parameters (secret, stepping, algo, ...)
# 3. calls oathtool to generate the current token
import subprocess