Skip to content

Instantly share code, notes, and snippets.

@TomTer
TomTer / gist:016ece37d45ce04238e48e864242e70f
Created July 21, 2017 17:40 — forked from atcuno/gist:3425484ac5cce5298932
HowTo: Privacy & Security Conscious Browsing

The purpose of this document is to make recommendations on how to browse in a privacy and security conscious manner. This information is compiled from a number of sources, which are referenced throughout the document, as well as my own experiences with the described technologies.

I welcome contributions and comments on the information contained. Please see the How to Contribute section for information on contributing your own knowledge.

Table of Contents

@TomTer
TomTer / setuid-root-backdoor.md
Created April 3, 2017 16:34 — forked from dergachev/setuid-root-backdoor.md
How to use setuid to install a root backdoor.

Why You Can't Un-Root a Compromised Machine

Let's say somebody temporarily got root access to your system, whether because you "temporarily" gave them sudo rights, they guessed your password, or any other way. Even if you can disable their original method of accessing root, there's an infinite number of dirty tricks they can use to easily get it back in the future.

While the obvious tricks are easy to spot, like adding an entry to /root/.ssh/authorized_keys, or creating a new user, potentially via running malware, or via a cron job. I recently came across a rather subtle one that doesn't require changing any code, but instead exploits a standard feature of Linux user permissions system called setuid to subtly allow them to execute a root shell from any user account from the system (including www-data, which you might not even know if compromised).

If the "setuid bit" (or flag, or permission mode) is set for executable, the operating system will run not as the cur

@TomTer
TomTer / fresh_windows_install.md
Last active June 24, 2016 19:07
Windows install
@powershell -NoProfile -ExecutionPolicy Bypass -Command "iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'))" && SET PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin
choco feature enable -n allowGlobalConfirmation

# This is for different programs to be able to sign in (free OneNote for example)
choco install ie11
choco install altdrag flashplayerplugin chromium notepadplusplus.install git.install firefox javaruntime adobereader vlc ccleaner sysinternals skype dropbox python pip teamviewer windirstat virtualclonedrive sublimetext3 keepass thunderbird
choco install dotnet4.5 putty conemu procexp curl wget vcredist2010 vcredist2013 vcredist2015 autoit autohotkey
@TomTer
TomTer / 1_apache_install.sh
Last active February 9, 2016 13:50
Server Conf
#!/bin/bash
# Guide: https://wiki.debian.org/ru/LaMp
useradd apache_server
mkdir /home/apache_server
mkdir /home/apache_server/public_html
chown apache_server:users /home/apache_server
apt-get -y update && apt-get upgrade
@TomTer
TomTer / switch-to-vim-for-good.md
Last active February 9, 2016 13:40 — forked from bpierre/README.md
Switch To Vim For Good

Switch To Vim For Good

This guide is coming from an email I used to send to newcomers to Vim. It is not intended to be a complete guide, it is about how I did the switch.

Some background: my decision to switch to Vim has been made a long time ago. Coming from TextMate 1, I wanted to learn an editor that is Open Source (so I don’t lose my time learning a tool that can be killed), cross platform (so I can use it everywhere), and powerful enough (so I won’t regret TextMate). For these reasons, Vim has always been the editor I wanted to learn, but it took me several years before I did it in a way that works for me. I tried to switch progressively, using the Janus Vim distribution for a few months, then got back to using TextMate 2 for a time, waiting for the next attempt… here is what finally worked for me.

Non Optional

  1. Watch the Derek Wyatt videos in order (at least the “Novice” ones for now): http://derekwyatt.org/vim/tutorials/
  2. Read the first part of this Sta
@TomTer
TomTer / Editors, settings etc.md
Last active February 9, 2016 13:45
Editors, broswer, settings etc...

#Editors, broswer, settings etc...#

@TomTer
TomTer / magento-code-snippets.md
Last active February 9, 2016 13:45 — forked from arosenhagen/magento-code-snippets.md
Magento Code Snippets

Magento Code Snippets

Download extension manually using mage

./mage config-set preferred_state stable
./mage clear-cache
./mage sync
./mage download community Module_Name