jborean93

# Server 2025 fails to run Get-AppxPackage and other DISM module commands in
# a PSRemoting (psrp) session as it has a dependency on some dll's not present
# in the GAC and only in the powershell.exe directory. As PSRP runs through
# wsmprovhost.exe, it fails to find those dlls. This hack will manually load
# the 4 required dlls into the GAC. This is a hack and should be removed in the
# future if MS fix their bug on 2025.

Add-Type -AssemblyName "System.EnterpriseServices"
$publish = [System.EnterpriseServices.Internal.Publish]::new()

jborean93

Function Get-ValidatedScriptBlock {
    [OutputType([ScriptBlock])]
    param (
        [Parameter(Mandatory)]
        [string]
        $Name,

        [Parameter(Mandatory)]
        [string]
        $ScriptAsBase64

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function New-ScheduledTaskSession {
    <#
    .SYNOPSIS
    Creates a PSSession for a process running as a scheduled task.

    .DESCRIPTION
    Creates a PSSession that can be used to run code inside a scheduled task

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Invoke-AsScheduledJob {
    <#
    .SYNOPSIS
    Runs a scriptblock as a scheduled job.

    .DESCRIPTION
    This is a helper function to run PowerShell code as a scheduled task.

jborean93

#!/usr/bin/env python3
# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
# PYTHON_ARGCOMPLETE_OK

# Big thanks to pysmb for help with the RPC structures
# https://github.com/miketeo/pysmb

from __future__ import annotations

jborean93

#!/usr/bin/env python3

# /// script
# dependencies = [
#   "bcrypt",
#   "cryptography >= 43.0.0",
#   "pyyaml",
# ]
# ///

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Module Ctypes

Function Split-ExeArgument {
    [OutputType([string])]
    [CmdletBinding()]
    param (
        [Parameter(Mandatory, ValueFromPipeline)]

jborean93

#!/usr/bin/python

import os.path
import subprocess
import sys
import xml.etree.ElementTree as ET

def main():
    iface = sys.argv[1]
    hook_case = sys.argv[2]

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Module Ctypes
#Requires -Version 7.3

Function Get-FileProcess {
    <#
    .SYNOPSIS
    Get the process that has opened the requested file.

jborean93

ctypes_struct WINTRUST_DATA {
    [int]$cbStruct
    [IntPtr]$pPolicyCallbackData
    [IntPtr]$pSIPClientData
    [int]$dwUIChoice
    [int]$fdwRevocationChecks
    [int]$dwUnionChoice
    [IntPtr]$pCatalog
    [int]$dwStateAction
    [IntPtr]$hWVTStateData