sassdawe

filter ThrowStdOutErrors($messageFilter,[Parameter(ValueFromPipeline)]$obj) {
  if ($obj -is [Management.Automation.ErrorRecord]) {
    if ($obj -match $messageFilter) {
      throw $obj
    } else {
      Write-Error $obj
      return
    }
  }
  $obj

sassdawe

using namespace System.Management.Automation
using namespace Microsoft.PowerShell.Commands
function Write-FunctionError {
<#
.SYNOPSIS
Writes an error within the context of the containing CmdletBinding() function. Makes error displays prettier
.NOTES
ScriptStackTrace will still show Write-FunctionError, so its not completely transparent. There's no way to "edit" or "replace" this stacktrace that I can find.
.EXAMPLE
function test {

sassdawe

MS-MSDT 0-day Office RCE

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).

The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).

Here are the steps to build a Proof-of-Concept docx:

1. Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.

sassdawe

#requires -version 7
#You can load this script with $(iwr https://tinyurl.com/TraceAICommand | iex)
using namespace Microsoft.ApplicationInsights
using namespace Microsoft.ApplicationInsights.Extensibility
using namespace Microsoft.ApplicationInsights.DataContracts
using namespace System.Management.Automation
using namespace System.Collections.Generic
using namespace System.Net

#Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/app/console

sassdawe

# Taken from : https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/collection/WebcamRecorder.py
function Start-WebcamRecorder
{
  <#
  .SYNOPSIS
  This function utilizes the DirectX and DShowNET assemblies to record video from the host's webcam.
  Author: Chris Ross (@xorrior)
  License: BSD 3-Clause
  .DESCRIPTION
  This function will capture video output from the hosts webcamera. Note that if compression is available, there isn't 

sassdawe

using System;
using System.IO;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Runtime.InteropServices;

namespace ByteArrayExec
{

sassdawe

$WMI = @{
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'MSFT_MpPreference' AND TargetInstance.DisableRealtimeMonitoring=True"
    Action = {
	      #$Global:Data = $Event
        Write-Host "Defender Configuration change - DisableRealtimeMonitoring:"$Event.SourceEventArgs.NewEvent.TargetInstance.DisableRealtimeMonitoring"(Old Value:"$Event.SourceEventArgs.NewEvent.PreviousInstance.DisableRealtimeMonitoring")"
    }
	Namespace = 'root\microsoft\windows\defender'
    SourceIdentifier = "Defender.DisableRealtimeMonitoring"
}
$Null = Register-WMIEvent @WMI

sassdawe

Step By Step: Implement a Serverless Azure Logic App Contact Form

Pre-requisites

1. An Azure Account, there are free and paid options
2. A SendGrid account, there are free trial, free and paid options
3. Code from this post!
4. Approximately X time to implement and test
5. Optional: A custom domain for the contact form html and Azure function Application Program Interface (API)

**Securing your Azure and Sendgrid accounts with Two Factor Authentication (2FA) is recommended. 2FA will not have an effect on how the Azure function or Sendgrid API works.

sassdawe

function DeleteListItems{
   <#
   .SYNOPSIS
      Deletes SharePoint List Items in batch
      
   .DESCRIPTION
      Deleted SharePoint List items in batch and provide sleep between batch. By default, it will delete all List Items.
      You can delete List Items based on the CAML Query input parameter.
      
   .PARAMETER ListUrl

sassdawe

PowerShell has a problem with it's extra output streams. The actual content of the Warning, Verbose, Debug, Information, and even Error streams doesn't have the label text like "WARNING: " or "VERBOSE: " that we're used to seeing in the host. That label is actually added by the host (hopefully, in a culture-aware way). However, this means that when you attempt to redirect all of this output, for example by redirecting all output streams to stdout, with *>&1, you don't get labels on them at all, which is confusing, and can make the output difficult to comprehend.

Take for example a function that writes in a loop:

if ($i % 5 -eq 0) {
    Write-Output $i
} else {
    Write-Verbose $i
}