Hello, welcome to the Monday, October 11th, 2021 edition of the Sandtonet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

He took a closer look at some of the recent exploit attempts against older Oracle WebLogic vulnerabilities. Back when these

vulnerabilities were originally discovered, and some of them go back to 2017, but there are also

some from 2019 that are still being exploited. It was, of course, a big deal given the importance of many of these

web logic systems. By now I question a little bit how successful these exploit attempts really are,

and there's really a lot of rehashing of old work here. Some of them attempt to do some obfuscation, probably in order to throw off some basic

signatures. For example, they're inserting long strings into the exploit string. This is sometimes

also done to make analysis more difficult, where, for example, a request for the next stage,

which is typically a shell script, has to come from a particular IP address, and that intermediate directory, what it looks like in the URL to retrieve the string, is specific for the particular source IP or may only exist for a very short amount of time in order to prevent the analysts from later downloading these scripts.

But regardless, most likely you're just going to get another crypto coin miner in many of these exploits.

And well, this weekend Rob also wrote up a quick lesson on sorting on the command

line in Unix, so basically your sort commands and how to use them properly, in particular

with IP addresses.

I always see people use, for example, the dash n option with IP addresses.

Shouldn't really do that. Use capital V, which works much better. Also, I came recently across

a little adventure, text adventure game that's supposed to teach you some of these basic bash commands.

Real neatly done, it's actually very simply done too, but certainly educational and

also somewhat entertaining. If you're sort of into the old style text adventure games,

I'll add a link to that in the show notes as well.

And apparently Telegram still has problems getting auto-delete to work properly.

The idea of auto-delete is that messages are automatically deleted for all chat participants

...