Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

View andyrobbins's full-sized avatar

Andy Robbins andyrobbins

188 followers · 20 following
View GitHub Profile
@andyrobbins
andyrobbins / sessionsPercentage.py
Last active May 22, 2017 21:22
from neo4j.v1 import GraphDatabase, basic_auth
driver = GraphDatabase.driver("bolt://localhost", auth=basic_auth("neo4j", "neo4jj"))
session = driver.session()
for result in session.run("""
MATCH (u:User)
RETURN COUNT(u)
"""):
TotalUserCount = int(result._values[0])
@andyrobbins
andyrobbins / hello world
Created August 8, 2017 21:05
hello world
@andyrobbins
andyrobbins / origins-and-targets.csv
Created June 8, 2021 05:16
BH vs Ransomware Table
Origin Target
Domain Users Domain Admins
Authenticated Users Administrators
Everyone Enterprise Admins
Domain Computers Domain Controllers
@andyrobbins
andyrobbins / audit-targets.csv
Created June 8, 2021 05:25
Audit targets
We can make this file beautiful and searchable if this error is corrected: No commas found in this CSV file in line 0.
Targets
Domain Admins
Enterprise Admins
Schema Admins
DNS Admins
Print Operators
Server Operators
Account Operators
The domain head object
@andyrobbins
andyrobbins / targets.csv
Created June 8, 2021 05:26
Audit Targets
Target Principals
Domain Admins
Enterprise Admins
Schema Admins
DNS Admins
Print Operators
Server Operators
Account Operators
The domain head object
@andyrobbins
andyrobbins / security-groups.csv
Created June 8, 2021 05:27
Sensitive Security Groups
Groups
Domain Admins
Enterprise Admins
Schema Admins
DNS Admins
Print Operators
Server Operators
Account Operators
@andyrobbins
andyrobbins / computer-security-groups.csv
Created June 8, 2021 05:29
Sensitive Computer Security Groups
Groups
Domain Controllers
Read-Only Domain Controllers
Enterprise Domain Controllers
Cloneable Domain Controllers
@andyrobbins
andyrobbins / AuditAppRoles.ps1
Created November 16, 2021 22:39
Audit app roles
## Find dangerous API permissions as a user
$AzureTenantID = '<Your tenant ID>'
$AccountName = '<Username>@<Domain.com>'
$Password = ConvertTo-SecureString '<Your password>' -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential($AccountName, $Password)
Connect-AzAccount -Credential $Credential -TenantID $AzureTenantID
function Get-AzureGraphToken
{
@andyrobbins
andyrobbins / API Abuse to GA.ps1
Created December 6, 2021 05:58
## Granting Global Admin rights by chaining AppRoleAssignment.ReadWrite.All into RoleManagement.ReadWrite.Directory
# Helper function to let us parse Azure JWTs:
function Parse-JWTtoken {
<#
.DESCRIPTION
Decodes a JWT token. This was taken from link below. Thanks to Vasil Michev.
.LINK
https://www.michev.info/Blog/Post/2140/decode-jwt-access-and-id-tokens-via-powershell
#>
@andyrobbins
andyrobbins / psversiontable.ps1
Created March 14, 2022 21:12
Print psversiontable
$psversiontable