sunnyc7

Context

• Generate PDF of Zed docs for offline reading.
• UR: https://zed.brimdata.io/docs

Issue

• Zed PDF docs doesn't exist / couldn't find after 10mins of searching.

Solution

• Run the following in cmd.exe

sunnyc7

Chat GPT "DAN" (and other "Jailbreaks")

• https://chat.openai.com/
• Is ChatGPT "DAN" Real? Gonna find out [Part 1]
  (https://www.youtube.com/watch?v=-q8woRG9FrI)
• Part 2: I thought ChatGPT DAN was a hoax, but...
  (https://www.youtube.com/watch?v=rHZRrDu3A2U&lc=UgxfrxX8aK7gnCzkend4AaABAg)

sunnyc7

<#
Machine Name	Policy Target	Subcategory	Subcategory GUID	Inclusion Setting
DESKTOP02	System	IPsec Driver	{0CCE9213-69AE-11D9-BED3-505054503030}	No Auditing
DESKTOP02	System	Removable Storage	{0CCE9245-69AE-11D9-BED3-505054503030}	No Auditing
DESKTOP02	System	Other Object Access Events	{0CCE9227-69AE-11D9-BED3-505054503030}	No Auditing
DESKTOP02	System	Filtering Platform Connection	{0CCE9226-69AE-11D9-BED3-505054503030}	No Auditing
DESKTOP02	System	Filtering Platform Packet Drop	{0CCE9225-69AE-11D9-BED3-505054503030}	No Auditing
DESKTOP02	System	Certification Services	{0CCE9221-69AE-11D9-BED3-505054503030}	No Auditing
DESKTOP02	System	SAM	{0CCE9220-69AE-11D9-BED3-505054503030}	No Auditing

sunnyc7

//
// Jacky Qwerty/29A compression algorithm, by Matt Mahoney
// modified by odzhan
// 2019-12-07
//
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <time.h>

sunnyc7

function New-ActiveScriptEventConsumerClass {
<#
.SYNOPSIS

Creates an ActiveScriptEventConsumer WMI class in the namespace of your choosing.

.DESCRIPTION

New-ActiveScriptEventConsumerClass creates a clone of the ActiveScriptEventConsumer WMI event consumer class using the class name and namespace name of your choosing.

sunnyc7

# Author: Matthew Graeber (@mattifestation)

$Epoch = Get-Date '01/01/1970'

# Conversion trick taken from https://blogs.technet.microsoft.com/heyscriptingguy/2017/02/01/powertip-convert-from-utc-to-my-local-time-zone/
$StrCurrentTimeZone = (Get-WmiObject Win32_timezone).StandardName
$TZ = [TimeZoneInfo]::FindSystemTimeZoneById($StrCurrentTimeZone)

# Parse out all the LogonGUID fields for sysmon ProcessCreate events
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Sysmon/Operational'; Id = 1 } | ForEach-Object {

sunnyc7

# If you like reading NT Insider but don't like clicking.

$savePDFTo = "$env:TEMP\NTInsider"
$uri = "https://www.google.com/search?q=site:insider.osr.com+filetype:pdf+inurl:pdf&sca_esv=579237292&rlz=1C1CHBF_enUS1055US1055&sxsrf=AM9HkKlzAaBYLDpNc_IsOEqzno14_5ICyw:1699043261820&filter=0&biw=2327&bih=1210&dpr=1.1"

$res = Invoke-WebRequest -UseBasicParsing -Uri $uri
$pdf = $res.Links | where {$_ -match "PDF" -and $_ -match "insider.osr.com"}
foreach ($f in $pdf) {
    $filtered = $f.href | where {$_ -match 'http://insider.osr.com/'}
    $pdfURL = (($filtered -split '&')[0] -split '=')[1]

sunnyc7

#include <stdio.h>

void DumpHex(const void* data, size_t size) {
	char ascii[17];
	size_t i, j;
	ascii[16] = '\0';
	for (i = 0; i < size; ++i) {
		printf("%02X ", ((unsigned char*)data)[i]);
		if (((unsigned char*)data)[i] >= ' ' && ((unsigned char*)data)[i] <= '~') {
			ascii[i % 16] = ((unsigned char*)data)[i];

sunnyc7

// A very rough x64 POC for spoofing environment variables similar to argument spoofing with a focus on
// setting the COMPlus_ETWEnabled=0 var for disabling ETW in .NET.
//
// Works by launching the target process suspended, reading PEB, updates the ptr used to store environment variables,
// and then resuming the process.
//
// (https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/)

#define INJECT_PARAM L"COMPlus_ETWEnabled=0\0\0\0"
#define INJECT_PARAM_LEN 43

sunnyc7

'''checkaslrfiles.py: Check for files that opt into ASLR with /DYNAMICBASE,
but do not have a relocation table to allow ASLR to function.

usage: checkaslrfiles.py <dir>
ex: checkaslr.py "C:\Program Files\"

requires: pefile <https://github.com/erocarrera/pefile>, which should be
installable via: pip install pefile
'''