Skip to content

Instantly share code, notes, and snippets.

@truekonrads
truekonrads / manage-osqueryd.ps1
Created June 11, 2017 13:43
bugfixes for manage-osqueryd.ps1
# Copyright (c) 2014-present, Facebook, Inc.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree. An additional grant
# of patent rights can be found in the PATENTS file in the same directory.
param(
[string] $args = "",
[switch] $install = $false,
#!/bin/sh
showmount -e $1|perl -wne 'chomp; $root=$1 if m!Export list for ([^:]+):!; if (defined($root) and m!^(/.+?)\s+(\*|\([^)]+\))$!){ $dir="/mnt/nfs/$root/$1"; print "mkdir -p \"$dir\"\n";print "mount -o vers=3,nolock \"$root:$1\" \"$dir\"\n";}'|sh
@truekonrads
truekonrads / bulk_remove_excel_sheet_prot.sh
Created February 10, 2017 18:51
Bulk remove sheet protection from xlsx
C=`pwd`;for i in *.xlsx; do cd $C; b=$(basename "$i" .xlsx); rm -rf "$b"; mkdir "$b"; unzip -d "$b" "$i"; find "$b" -name sheet*.xml -print0 | xargs -0 perl -p -i -e 's!<sheetProtect\w+ .+?/>!!g' ; find "$b" -name \*.bak -exec rm {} \; ; cd "$b"; zip -r "../done/$b - unprotected.xlsx" .; cd "$C"; rm -rf "$b"; done
@truekonrads
truekonrads / dchplogs2timeline.py
Last active May 4, 2016 15:31
Parse Microsoft DHCP logs into a timeline
#!/usr/bin/env python
# Parse Windows DHCP logs and turn them into a timeline
# By Konrads Smelkovs (c) 2016
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
@truekonrads
truekonrads / wtmpcarver.py
Last active August 22, 2020 01:03
A quick and dirty Linux utmp record carver
#!/usr/bin/python
# Copyright 2015 Konrads Smelkovs <[email protected]> KPMG LLP
# All liability disclaimed. Use at your own risk.
"""
A quick and dirty Linux utmp record carver
"""
import re,struct,sys,ipaddress, binascii
from datetime import datetime
wtmp=file(sys.argv[1],"rb")
#!/usr/bin/env python
# Poll an XML RPC server about its methods
import xmlrpclib, sys
SERVER=None
def discover():
print "Capabilities:"
print SERVER.system.capabilities()
print SERVER.system.getCapabilities()
print "Methods:"
@truekonrads
truekonrads / fortinetips.py
Created August 4, 2015 18:54
Extract interface IPs from a directory full of fortinet configs
#!/usr/bin/python
# Extract known ranges from Fortinet configs and present them as CSV
import os,csv,sys,re,ipaddress
csvwriter=csv.DictWriter(sys.stdout,"filename name vdom ip mask cidr".split(" "))
if len(sys.argv)<2:
print "Usage %s <directory>" % sys.argv[0]
sys.exit(-1)
csvwriter.writeheader()
for root, dirs, files in os.walk(sys.argv[1]):

Keybase proof

I hereby claim:

  • I am truekonrads on github.
  • I am truekonrads (https://keybase.io/truekonrads) on keybase.
  • I have a public key whose fingerprint is 8573 98C7 B61D 7FB8 68CB 93B5 B834 2F98 CD32 71C9

To claim this, I am signing this object:

@truekonrads
truekonrads / nettcpsprobe.py
Last active August 29, 2015 14:24
net.tcp prober
import socket,struct,sys
if len(sys.argv)<3:
print "Usage %s <host> <port> [Service]" % sys.argv[0]
exit(-1)
DEBUG=0
if len(sys.argv)==4:
svcname=sys.argv[3]
else:
svcname="service-probe:8080/nonexistant"
svcname="net.tcp://"+svcname

Keybase proof

I hereby claim:

  • I am truekonrads on github.
  • I am truekonrads (https://keybase.io/truekonrads) on keybase.
  • I have a public key whose fingerprint is 65EF 5B2A 1F2F 012D 9466 A688 1ED2 3A6F 1125 49FF

To claim this, I am signing this object: