jermdw jermdw

Quick Setup for Windows Powershell Prompt

Set your PowerShell execution policy

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force

Install Chocolatey

Windows Keyboard Shortcuts

Keyboard shortcut	Action
Windows key	Open or close Start Menu.
Windows key + A	Open Action center.
Windows key + C	Open Cortana in listening mode.
Windows key + D	Display and hide the desktop.
Windows key + E	Open File Explorer.
Windows key + G	Open Game bar when a game is ope

Nix-One-Liners

SOCKS Tunnel

ssh -D 8123 -f -C -q -N [email protected]

Reference

Tabs and Windows

Function	Shortcut
Fullscreen	`⌘`+ `Enter`
Previous Tab	`⌘`+ `Left Arrow`
Next Tab	`⌘`+ `Right Arrow`
Go to Tab	`⌘` + `Number`
Go to Window	`⌘` + `Option` + `Number`
Go to Split Pane by Direction	`⌘` + `Option` + `Arrow`

Winblowz Quickies

Elevate to System using PSEXEC

Reference

Elevate

PSEXEC -i -s -d CMD

Verify

Tanium Hunting Questions

Initial Infection

New Scripts in Webroot Paths

Get "Trace File Operations[unlimited, 1488479715768|1488483314768, 1, 0, 0, 10, .*\\wwwroot\\.*\.(asp|aspx|cfm|jsp|php), CreateNewFile, , , ]" from all machines

	# Enable syn flood protection
	net.ipv4.tcp_syncookies = 1

	# Ignore source-routed packets
	net.ipv4.conf.all.accept_source_route = 0

	# Ignore source-routed packets
	net.ipv4.conf.default.accept_source_route = 0

	# Ignore ICMP redirects

	#!/bin/bash

	# update apt-get
	export DEBIAN_FRONTEND="noninteractive"
	sudo apt-get update

	# remove previously installed Docker
	sudo apt-get remove docker docker-engine docker.io* lxc-docker*

	# install dependencies 4 cert

	# Reference - http://community.idera.com/powershell/powertips/b/tips/posts/allowing-powershell-script-execution---no-matter-what

	$context = $executioncontext.gettype().getfield('_context','nonpublic,instance').getvalue($executioncontext); $field = $context.gettype().getfield('_authorizationManager','nonpublic,instance'); $field.setvalue($context,(New-Object management.automation.authorizationmanager 'Microsoft.PowerShell'))

	iwr -Method GET -Uri https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts -OutFile "C:\Windows\System32\drivers\etc\hosts"

	ipconfig /flushdns