awakecoding

#!/usr/bin/env pwsh

param(
    [Parameter(Position = 0, Mandatory = $true)]
    [string] $ZipFilePath,

    [Parameter(Position = 1, Mandatory = $true)]
    [string] $FilePattern,

    [Parameter(Position = 2, Mandatory = $true)]

awakecoding

function Install-WinDbg {
    param(
        [switch] $Start
    )

    # Change default progress preference (faster downloads)
    $DefaultProgressPreference = $ProgressPreference
    $ProgressPreference = 'SilentlyContinue'

    Write-Host "Downloading windbg.appinstaller (XML manifest file)"

awakecoding

function Install-DbgHelp {
    param (
        [Parameter(Mandatory=$true, Position=0)]
        [string] $DbgHelpBaseDir,

        [Parameter()]
        [string[]] $DbgHelpFiles = @('dbghelp.dll','symsrv.dll','srcsrv.dll'),

        [Parameter()]
        [switch] $Cleanup

awakecoding

Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;

namespace WinCred
{
    public enum CRED_MARSHAL_TYPE
    {
        CertCredential = 1,
        UsernameTargetCredential,

awakecoding

Add-Type -TypeDefinition @'
using System;
using System.Runtime.InteropServices;
using System.Security.Cryptography.X509Certificates;

public enum DSREG_JOIN_TYPE {
    DSREG_UNKNOWN_JOIN = 0,
    DSREG_DEVICE_JOIN = 1,
    DSREG_WORKPLACE_JOIN = 2
}

awakecoding

__int64 KdcInitializeCerts(void)
{
  unsigned __int8 v0; // cl
  int v1; // r12d
  HANDLE EventW; // rax
  unsigned int v3; // r14d
  char *Heap; // rax
  char *v5; // r15
  const char *v6; // r9
  const char *v7; // rdi

awakecoding

# script to duplicate and edit the smartcard logon certificate template for easy testing

$certca = @"
using System;
using System.Runtime.InteropServices;

public class CertCA
{
    public const uint CA_FLAG_ENUM_ALL_TYPES = 0x00000004;
    public const uint CT_FIND_LOCAL_SYSTEM = 0x00000002;

awakecoding

function Invoke-PortKnock
{
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true,Position=0)]
        [string] $HostName,
        [Parameter(Mandatory=$true,Position=1)]
        [Int32[]] $Sequence,
        [Parameter(Mandatory=$false,Position=2)]
        [Int32] $Delay = 500

awakecoding

namespace UrlMon.InternetSecurityZones
{
    using System;
    using System.Runtime.InteropServices;

    /*
     * About URL Security Zones
     * https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537183(v=vs.85)
     * 
     * CoInternetCreateSecurityManager function

awakecoding

# Enumerate RDP USB devices like mstsc does

$RdpUsbDeviceExcludedClassGuids = @(
    '{4d36e96b-e325-11ce-bfc1-08002be10318}', # Keyboard
    '{4d36e972-e325-11ce-bfc1-08002be10318}', # Net
    '{4d36e968-e325-11ce-bfc1-08002be10318}', # Display
    '{4d36e967-e325-11ce-bfc1-08002be10318}', # DiskDrive
    '{4d36e965-e325-11ce-bfc1-08002be10318}', # CDROM
    '{e0cbf06c-cd8b-4647-bb8a-263b43f0f974}', # Bluetooth
    '{745a17a0-74d3-11d0-b6fe-00a0c90f57da}', # HIDClass