Updated 2018-03-23 Version 1802 (Build 16.0.9029.2167)
==========================================
Updated 2018-03-23 Version 1802 (Build 16.0.9029.2167)
==========================================
Write-Host "Checking for Administrator permission..." | |
if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) { | |
Write-Warning "Insufficient permissions to run this script. Open the PowerShell console as administrator and run this script again." | |
Break | |
} else { | |
Write-Host "Running as administrator — continuing execution..." -ForegroundColor Green | |
} | |
$patchfile = $args[0] | |
function Copy-AuthenticodeSignedFile { | |
<# | |
.SYNOPSIS | |
Creates a copy of an Authenticode-signed PowerShell file that has a unique file hash but retains its valid signature. | |
.DESCRIPTION | |
Copy-AuthenticodeSignedFile creates a copy of an Authenticode-signed PowerShell file that has a unique file hash but retains its valid signature. This is used to bypass application whitelisting hash-based blacklist rules. |
Via https://ubuntu.com/esm#faq
"We're mirroring the repository on our internal Landscape server. Can we still get Ubuntu ESM if using Landscape? ESM is just a regular Ubuntu archive, but authenticated and served over HTTPS. Archive mirroring is already available in Landscape and is the only supported mechanism for mirroring the ESM archive."
#!/bin/bash | |
# Installs missing dependencies from Debian 9 (stretch) for Powershell on Debian 10 (buster) and higher (including Kali Linux) | |
mkdir /tmp/pwshtmp | |
cd /tmp/pwshtmp | |
wget http://http.us.debian.org/debian/pool/main/i/icu/libicu57_57.1-6+deb9u3_amd64.deb | |
wget http://http.us.debian.org/debian/pool/main/i/icu/icu-devtools_57.1-6+deb9u3_amd64.deb | |
wget http://http.us.debian.org/debian/pool/main/u/ust/liblttng-ust0_2.9.0-2+deb9u1_amd64.deb | |
wget http://http.us.debian.org/debian/pool/main/libu/liburcu/liburcu4_0.9.3-1_amd64.deb |
Below is the cell phone agreement I have with my kids. It was largely inspired by this contract which had some excellent ideas.
I will silence and put away or turn off my phone:
In episode #341 of the 7 Minute Security podcast I talked about how to identify - and remediate - the unquoted service path vulnerabilities you might see pop up on a vulnerability scan. Here's the breakdown of resources that will help you understand and fix this pesky vuln:
Here's a great article describing unquoted service paths and why they're a risk to your enterprise.
If you want to create a fake service with unquoted service paths so you can then test fixing it, check out this gist which has you run something like the following:
New-Service -Name 'TotesFakeService' -BinaryPathName 'C:\program files\system32\something.exe' -DisplayName 'Totes Fake Dude' -StartupType Manual
curl -s https://api.github.com/users/milanboers/repos | grep \"clone_url\" | awk '{print $2}' | sed -e 's/"//g' -e 's/,//g' | xargs -n1 git clone |