gitgotgitgotit

LLM Wiki

A pattern for building personal knowledge bases using LLMs.

This is an idea file, it is designed to be copy pasted to your own LLM Agent (e.g. OpenAI Codex, Claude Code, OpenCode / Pi, or etc.). Its goal is to communicate the high level idea, but your agent will build out the specifics in collaboration with you.

The core idea

Most people's experience with LLMs and documents looks like RAG: you upload a collection of files, the LLM retrieves relevant chunks at query time, and generates an answer. This works, but the LLM is rediscovering knowledge from scratch on every question. There's no accumulation. Ask a subtle question that requires synthesizing five documents, and the LLM has to find and piece together the relevant fragments every time. Nothing is built up. NotebookLM, ChatGPT file uploads, and most RAG systems work this way.

Certighost (CVE-2026-54121)

Authors: @h0j3n, @aniqfakhrul
Date: July 24, 2026

Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The issue was addressed in the July 2026 security updates.

The vulnerable path is an AD CS enrollment fallback known as a chase during directory-object resolution. By supplying request attributes such as cdc, an attacker could cause the Certification Authority (CA) to ask an attacker-controlled host for identity data belonging to a Domain Controller. The CA then used that data while issuing a certificate.

	import sys
	import argparse
	import asyncio


	def ldap_url(auth_options):
	url_format = {
	"kerb_password": f"kerberos+password://{{domain}}\\{{username}}:{{password}}@{{fqdn}}/?dc={{dcip}}",
	"kerb_rc4": f"kerberos+rc4://{{domain}}\\{{username}}:{{nt}}@{{fqdn}}/?dc={{dcip}}",
	"kerb_aes": f"kerberos+aes://{{domain}}\\{{username}}:{{aeskey}}@{{fqdn}}/?dc={{dcip}}",

	f4bcdad0-1d62-44e0-892a-6c0f0f7fbd20
	This is from David’s personal LLM stack:

	⸻

	Below are two full, headless, zero-touch lab build solutions for BadSuccessor:
	• A. VirtualBox (on Windows or Linux) – Fully Automated with Packer & PowerShell remoting
	• B. AWS (EC2) – Terraform & Cloud-Init, Automated Domain Build & Exploit

	Both provide complete, reproducible AD domains, lab user, and exploit chain—no skipped steps or placeholders.

	// Revision 1 - originally developed by chatGPT for @irsdl
	// Revision 2 - improved by ChatGPT to be more efficient using Burp APIs!
	// Automatically updates the Cookie header in Burp Repeater requests using Set-Cookie values from responses. This Bambda CustomAction preserves all existing cookies and only updates or adds values when necessary — ensuring session continuity without overwriting unrelated cookies.

	// 1. Grab the request & response
	var request = requestResponse.request();
	var response = requestResponse.response();

	// 2. Pull any Set-Cookie cookies from the response
	var responseCookies = response.cookies();

	IF NOT EXISTS (
	select
	1
	from
	vSMS_SC_ClientComponent_PropertyLists
	where
	ID = 72057594037927956
	and Name = N 'Network Access User Names'
	) insert into vSMS_SC_ClientComponent_PropertyLists (ID, Value, Name)
	values

	# ms-block.ps1 - Windows telemetry/AI blocker (idempotent, no dupes)
	# Run as Administrator
	$hostsPath = "$env:windir\System32\drivers\etc\hosts"
	$marker = "# --- MS-BLOCK START ---"
	$endMarker = "# --- MS-BLOCK END ---"

	# Exclude hosts file from Defender
	Add-MpPreference -ExclusionPath $hostsPath -ErrorAction SilentlyContinue

	# Read current hosts, strip any previous MS-BLOCK section