jymcheong

::
::#######################################################################
::
:: Change file associations to protect against common ransomware attacks
:: Note that if you legitimately use these extensions, like .bat, you will now need to execute them manually from cmd or powershell
:: Alternatively, you can right-click on them and hit 'Run as Administrator' but ensure it's a script you want to run :) 
:: ---------------------
ftype htafile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
ftype WSHFile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
ftype batfile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"

jymcheong

# Author: Matthew Graeber (@mattifestation)

$Epoch = Get-Date '01/01/1970'

# Conversion trick taken from https://blogs.technet.microsoft.com/heyscriptingguy/2017/02/01/powertip-convert-from-utc-to-my-local-time-zone/
$StrCurrentTimeZone = (Get-WmiObject Win32_timezone).StandardName
$TZ = [TimeZoneInfo]::FindSystemTimeZoneById($StrCurrentTimeZone)

# Parse out all the LogonGUID fields for sysmon ProcessCreate events
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Sysmon/Operational'; Id = 1 } | ForEach-Object {

jymcheong

#!/bin/bash
#
# autosshd This script starts and stops the autossh daemon
#
# chkconfig: 2345 95 15
# processname: autosshd
# description: autosshd is the autossh daemon.

# Source function library.
. /etc/rc.d/init.d/functions

jymcheong

autosshd

Install

git clone https://gist.github.com/6322759.git autosshd
cd autosshd
sudo ./install

jymcheong

filter Get-PEFeature {
<#
.SYNOPSIS

Retrieves key features from PE files that can be used to build detections.

.DESCRIPTION

Get-PEFeature extracts key features of PE files that are relevant to building detections.

jymcheong

# Example of how to use Invoke-RestMethod with headers and cookies

$Credential = Get-Credential # Your credential goes here

[System.Uri]$Uri = "http://server01.example.com/api/pizza/1" # Add the Uri
$ContentType = "application/json" # Add the content type
$Method = 'PUT' # Add the method type
$Body = '{ "id" = 1, "Name" = "Peperoni" }' # Add the body for the request

$Cookie = New-Object System.Net.Cookie

jymcheong

$Domain = [AppDomain]::CurrentDomain
$DynAssembly = New-Object System.Reflection.AssemblyName('TempAssembly')
$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('TempModule')
# Create a stub module that the in-memory module (i.e. this mimics the loading of a netmodule at runtime) will be loaded into.
$ModuleBuilder2 = $AssemblyBuilder.DefineDynamicModule('hello.dll')
$TypeBuilder = $ModuleBuilder.DefineType('TempClass', [Reflection.TypeAttributes]::Public)
$TypeBuilder.CreateType()
$HelloDllBytes = [Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAJNPvloAAAAAAAAAAOAAAiELAQsAAAQAAAAGAAAAAAAAPiMAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAOQiAABXAAAAAEAAAJgCAAAAAAAAAAAAAAAAAAA

jymcheong

=========================
# /etc/nginx/nginx.conf
=========================

user www-data;
worker_processes 4;
pid /var/run/nginx.pid;

events {
  worker_connections 768;

jymcheong

var distance = function(s1, s2) {
  var m = 0;

  // Exit early if either are empty.
  if ( s1.length === 0 || s2.length === 0 ) {
    return 0;
  }

  // Exit early if they're an exact match.
  if ( s1 === s2 ) {

jymcheong

// Credits: John Stewien
// From: http://code.cheesydesign.com/?p=572

/*
Reading the Portable Executable (PE) header in C#
My job consists of writing fully custom applications for groups of people. The time pressure of these projects is quite high, so generally people start using the application while I’m still writing it, which means I write it modularly and add features as I go along. I also fix bugs as they are discovered. My clients are 2 tiered where expert users get a new build first, they test if for a while, and if they think it’s acceptable they then pass it on to others.

This method of distribution is quite ad-hoc so when a client rings me up and asks me to view their screen to look at something, it’s useful to know what build they are running. To facillitate this I print the link date in the main Window Title so I instantly have an idea about how old the version is that I am looking at. This date is calculated at run time. To do this requires reading in the Portable Executable (PE) header from th