Skip to content

Instantly share code, notes, and snippets.

View IISResetMe's full-sized avatar

Mathias R. Jessen IISResetMe

  • Booking.com
  • Netherlands
View GitHub Profile
@IISResetMe
IISResetMe / Find-VulnerableSchemas.ps1
Last active April 10, 2024 06:30
Find-VulnerableSchemas.ps1
# Dictionary to hold superclass names
$superClass = @{}
# List to hold class names that inherit from container and are allowed to live under computer object
$vulnerableSchemas = [System.Collections.Generic.List[string]]::new()
# Resolve schema naming context
$schemaNC = (Get-ADRootDSE).schemaNamingContext
# Enumerate all class schemas
@IISResetMe
IISResetMe / Invoke-ScreenGrabber.ps1
Last active December 18, 2023 15:15
Quick and dirty powershell screenshot function
function Invoke-ScreenGrabber
{
param(
[switch]$HideWindow,
[switch]$PassThru
)
# Ensure Windows Forms assembly is available
$null = Add-Type -AssemblyName System.Windows.Forms -ErrorAction SilentlyContinue
@IISResetMe
IISResetMe / ConvertFrom-EventLogRecord.ps1
Last active December 4, 2023 04:00
Convert EventData fields from windows event log records to objects
function ConvertFrom-EventLogRecord
{
param(
[Parameter(Mandatory=$true,ValueFromPipeline=$true)]
[System.Diagnostics.Eventing.Reader.EventLogRecord[]]
$InputEvent,
[Parameter(Mandatory=$true,Position=1)]
[ValidateNotNullOrEmpty()]
[string[]]
using namespace System.Net.Sockets
using namespace System.Net.Security
using namespace System.Security.Cryptography.X509Certificates
function ConvertFrom-X509Certificate {
param(
[Parameter(ValueFromPipeline)]
[X509Certificate2]$Certificate
)
function Get-AvailableLicenseTemplates {
[CmdletBinding()]
param ()
process {
Write-Host "`$PSScriptRoot:" $PSScriptRoot -ForegroundColor Green
# Define the parent directory containing the folders
$ParentDirectory = "$PSScriptRoot\..\Templates\LICENSE\"
# Get the list of folders
$Folders = Get-ChildItem -Path $ParentDirectory -Directory
@IISResetMe
IISResetMe / Scan-LOLDrivers.ps1
Created May 19, 2023 17:08 — forked from MHaggis/Scan-LOLDrivers.ps1
it works - but use with caution :) it's a bit noisy and I think it's broken
function Scan-LOLDrivers {
param(
[Parameter(Mandatory = $true)]
[string]$path
)
Add-Type -TypeDefinition @"
using System;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
@IISResetMe
IISResetMe / pingasync.ps1
Last active October 28, 2023 02:55
Task-based async Ping in PowerShell
# Define list of remote hosts (can be host names or IPs)
$RemoteHosts = @('www.google.com')
# Initiate a Ping asynchronously per remote host, pick up the result task objects
$Tasks = foreach($ComputerName in $RemoteHosts) {
(New-Object System.Net.NetworkInformation.Ping).SendPingAsync($ComputerName)
}
# Wait for all tasks to finish
[System.Threading.Tasks.Task]::WaitAll($Tasks)
@IISResetMe
IISResetMe / ConvertTo-Object.ps1
Last active July 25, 2023 23:12
Quick and dirty regex-based text-to-object parsing using named expressions groups and $Matches
function ConvertTo-Object {
param(
[Parameter(Mandatory=$true,ValueFromPipeline=$true)]
[AllowEmptyString()]
[string[]]$InputString,
[Parameter(Mandatory=$true,ValueFromRemainingArguments=$true)]
[string[]]$Pattern
)
@IISResetMe
IISResetMe / Get-MachineSID.ps1
Created December 30, 2014 15:40
PsGetSid local machine SID implementation in PowerShell
function Get-MachineSID
{
param(
[switch]
$DomainSID
)
# Retrieve the Win32_ComputerSystem class and determine if machine is a Domain Controller
$WmiComputerSystem = Get-WmiObject -Class Win32_ComputerSystem
$IsDomainController = $WmiComputerSystem.DomainRole -ge 4
function Get-XmlFileTreeAppend
{
param(
[Parameter(ParameterSetName='Path', Mandatory=$true, Position=0, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
[string[]]
${Path},
[Parameter(ParameterSetName='LiteralPath', Mandatory=$true, ValueFromPipelineByPropertyName=$true)]
[Alias('PSPath')]
[string[]]