jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Invoke-AsScheduledJob {
    <#
    .SYNOPSIS
    Runs a scriptblock as a scheduled job.

    .DESCRIPTION
    This is a helper function to run PowerShell code as a scheduled task.

jborean93

#!/usr/bin/env python3
# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
# PYTHON_ARGCOMPLETE_OK

# Big thanks to pysmb for help with the RPC structures
# https://github.com/miketeo/pysmb

from __future__ import annotations

jborean93

#!/usr/bin/env python3

# /// script
# dependencies = [
#   "bcrypt",
#   "cryptography >= 43.0.0",
#   "pyyaml",
# ]
# ///

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Module Ctypes

Function Split-ExeArgument {
    [OutputType([string])]
    [CmdletBinding()]
    param (
        [Parameter(Mandatory, ValueFromPipeline)]

jborean93

#!/usr/bin/python

import os.path
import subprocess
import sys
import xml.etree.ElementTree as ET

def main():
    iface = sys.argv[1]
    hook_case = sys.argv[2]

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Module Ctypes
#Requires -Version 7.3

Function Get-FileProcess {
    <#
    .SYNOPSIS
    Get the process that has opened the requested file.

jborean93

ctypes_struct WINTRUST_DATA {
    [int]$cbStruct
    [IntPtr]$pPolicyCallbackData
    [IntPtr]$pSIPClientData
    [int]$dwUIChoice
    [int]$fdwRevocationChecks
    [int]$dwUnionChoice
    [IntPtr]$pCatalog
    [int]$dwStateAction
    [IntPtr]$hWVTStateData

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Modules Ctypes
#Requires -Version 7.3

Function Get-SignedCatalogFile {
    <#
    .SYNOPSIS
    Gets the .cat file for the specified file.

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

"""POC for running exe's over RDP

This is a very rough attempt at trying to run an exe using a headless RDP
connection. It aims to be able to provide an interactive console session as
well as a headless one.

Requires aardwolf - https://github.com/skelsec/aardwolf as a Python dependency.

jborean93

# Copyright (c) 2024 Jordan Borean
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)

from __future__ import annotations

DOCUMENTATION = """
name: kinit
type: aggregate
short_description: POC to run kinit on a playbook run.
description: