jborean93

<#
NOTE: Must be run in Windows PowerShell (5.1), PowerShell (7+) cannot create standalone exes.

This is designed to create a simple exe that can be used to spawn any console
application with a hidden Window. As NoGui.exe is a GUI executable it won't
spawn with an associated console window and can be used to then create a new
process with a hidden console window with the arguments it was created with.


By default, NoGui will spawn the child process with same stdio handles as

jborean93

# Copyright: (c) 2023, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Module Ctypes

Function New-S4UAccessToken {
    <#
    .SYNOPSIS
    Generates an S4U access token.

jborean93

# Copyright: (c) 2023, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

class EncodingTransformAttribute : System.Management.Automation.ArgumentTransformationAttribute {
    [object] Transform([System.Management.Automation.EngineIntrinsics]$engineIntrinsics, [object]$InputData) {
        $result = switch ($InputData) {
            { $_ -is [System.Text.Encoding] } { $_ }

            { $_ -is [string] } {
                switch ($_) {

jborean93

#include<stdio.h>

// gcc print_argv.c -o print_argv

int main(int argc, char *argv[])
{
    int i;
    for(i = 1;i < argc;i++)
    {
        printf("[%d] %s\n", i, argv[i]);

jborean93

Function ConvertTo-EncryptedVNCPassword {
    [OutputType([byte[]])]
    [CmdletBinding()]
    param (
        [Parameter(Mandatory)]
        [SecureString]
        $Password
    )
    
    # This is hardcoded in VNC applications like TightVNC.

jborean93

This is to document some issues with trying to install KB2267602 on Windows Server 2016 using the Windows Updates API (WUA). The ansible.windows.win_updates.log shows the installation of KB2267602 and it's first failure when installed by the Ansible module, the manual MpCmdRun.exe workaround on this failure, then subsequent update runs that show the update no longer being required. The MpSigStub.log file shows the contents of that log file for the first failed install using WUA and then the subsequent working entries when using MpCmdRun.exe.

The update KB is the security intelligence updates for Microsoft Defender Antivirus and can be updated many times in one day. From what I can see it typically installs just fine but there is a chance where Windows Updates pulls down a new version before it is ready to be installed. For example the logs during a failed run indicates that the following update tried to be installed and resulted in the following error:

4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a:

jborean93

using System;
using System.Collections.Concurrent;
using System.Management.Automation;
using System.Threading;
using System.Threading.Tasks;

public abstract class AsyncPSCmdlet : PSCmdlet, IDisposable
{
    private enum PipelineType
    {

jborean93

# Copyright: (c) 2023, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Get-SqlServerTlsCertificate {
    <#
    .SYNOPSIS
    Gets the MS SQL X509 Certificate.

    .DESCRIPTION
    Gets the X509 Certificate that is being used by a remote MS SQL Server.

jborean93

#Requires -Module Ctypes
#Requires -Module PSPrivilege

Function Get-FileSDDL {
    [CmdletBinding()]
    param ($Path)

    $a32 = New-CtypesLib Advapi32.dll
    $allSecurityInformation = 0xF00000FF

jborean93

#Requires -Module Ctypes

$advapi32 = New-CtypesLib Advapi32.dll
$kernel32 = New-CtypesLib Kernel32.dll

$advapi32.Returns([bool]).ImpersonateLoggedOnUser = @([IntPtr])
$advapi32.Returns([bool]).RevertToSelf = @()
$kernel32.Returns([void]).CloseHandle = @([IntPtr])

# This is a quick and dirty way to impersonate SYSTEM