awakecoding

function Invoke-PortKnock
{
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true,Position=0)]
        [string] $HostName,
        [Parameter(Mandatory=$true,Position=1)]
        [Int32[]] $Sequence,
        [Parameter(Mandatory=$false,Position=2)]
        [Int32] $Delay = 500

awakecoding

namespace UrlMon.InternetSecurityZones
{
    using System;
    using System.Runtime.InteropServices;

    /*
     * About URL Security Zones
     * https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537183(v=vs.85)
     * 
     * CoInternetCreateSecurityManager function

awakecoding

# Enumerate RDP USB devices like mstsc does

$RdpUsbDeviceExcludedClassGuids = @(
    '{4d36e96b-e325-11ce-bfc1-08002be10318}', # Keyboard
    '{4d36e972-e325-11ce-bfc1-08002be10318}', # Net
    '{4d36e968-e325-11ce-bfc1-08002be10318}', # Display
    '{4d36e967-e325-11ce-bfc1-08002be10318}', # DiskDrive
    '{4d36e965-e325-11ce-bfc1-08002be10318}', # CDROM
    '{e0cbf06c-cd8b-4647-bb8a-263b43f0f974}', # Bluetooth
    '{745a17a0-74d3-11d0-b6fe-00a0c90f57da}', # HIDClass

awakecoding

function Get-RdpLogonEvent
{
    [CmdletBinding()]
    param(
        [Int32] $Last = 10
    )

    $RdpInteractiveLogons = Get-WinEvent -FilterHashtable @{
        LogName='Security'
        ProviderName='Microsoft-Windows-Security-Auditing'

awakecoding

# Common variables

$CAFullName = "IT Help Ninja"
$CAFilePrefix = "it-help"
$CADnsSuffix = "ad.it-help.ninja"
$CertsPath = "~\Documents\certs"
New-Item -Path $CertsPath -ItemType Directory -ErrorAction SilentlyContinue | Out-Null

# Offline Root CA

awakecoding

$ConfigurationDN = $([ADSI]"LDAP://RootDSE").ConfigurationNamingContext;
$SearchRoot = "LDAP://CN=Enrollment Services,CN=Public Key Services,CN=Services,$ConfigurationDN"
$SearchFilter = "(objectCategory=pkiEnrollmentService)"
$EnrollmentServices = @()
(New-Object adsiSearcher([ADSI]$SearchRoot,$SearchFilter)).FindAll() | ForEach-Object {
    $EnrollmentServices += [PSCustomObject] [hashtable] $_.Properties
}

awakecoding

Certificate  ::=  SEQUENCE  {
     tbsCertificate       TBSCertificate,
     signatureAlgorithm   AlgorithmIdentifier,
     signature            BIT STRING  }
​
TBSCertificate  ::=  SEQUENCE  {
     version         [0]  Version DEFAULT v1,
     serialNumber         CertificateSerialNumber,
     signature            AlgorithmIdentifier,
     issuer               Name,

awakecoding

function ConvertTo-PascalCase
{
    [OutputType('System.String')]
    param(
        [Parameter(Position=0)]
        [string] $Value
    )

    # https://devblogs.microsoft.com/oldnewthing/20190909-00/?p=102844

awakecoding

CoreProperties(234):
ServerName (String)
ServerNetBiosName (String)
ServerFqdn (String)
ServerAddressesToConnect (IUnknown)
UserSpecifiedServerName (String)
UserName (String)
Domain (String)
Password (SecureString)
AlternateShell (String)

awakecoding

$ErrorActionPreference = "Stop"

function Test-RDMGroup
{
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true,Position=0)]
        [string] $Name
    )