danzek

// GoogleAnalyticsDomainHashCalculator.cpp
//
// NOTE: I turned this into a robust CLI tool: https://github.com/danzek/gadhash
//
// Calculates Google Analytics Domain Hash given domain name
// =========================================================
// This corresponds to the first value after "utma=" up until the first dot ('.')
// e.g. in "utma=173272373.nnnnnnn", the domain hash is 173272373 ("google.com")
// do not include the protocol in url (e.g., "http://")
//

danzek

<# Public Domain. Use this however you wish!

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
   WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
   COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#>

$files = Get-Content "file_path_on_each_line.txt"
Write-Output "File Path,MD5 Hash"

danzek

# use shell::: with CLSID to launch location from run dialog
# e.g., shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}
#
# retrieved 20170719 from http://krypsec.com/all-clsid-for-windows-to-used-in-ethical-hacking-and-batch-programming/
#
# see also:
# https://www.sysnative.com/forums/windows-8-windows-rt-tutorials/12157-shells-shortcuts-clsid-listing-windows-10-8-1-8-7-a.html
# http://www.geoffchappell.com/studies/windows/shell/explorer/cmdline.htm

CLSID_ControlPanel                {21EC2020-3AEA-1069-A2DD-08002B30309D}

danzek

Important articles about Windows/NTFS

This also contains quotes from the articles in case they are moved/deleted/etc.

• File Times: https://msdn.microsoft.com/en-us/library/windows/desktop/ms724290

A file time is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 A.M. January 1, 1601 Coordinated Universal Time (UTC). The system records file times when applications create, access, and write to files.

The NTFS file system stores time values in UTC format, so they are not affected by changes in time zone or daylight saving time. The FAT file system stores time values based on the local time of the computer. For example, a file that is saved at 3:00pm PST in Washington is seen as 6:00pm EST in New York on an NTFS volume, but it is seen as 3:00pm EST in New York on a FAT volume.

danzek

/*
 * LsaRetrievePrivateData User Credential Theft on Windows XP-7
 * ============================================================
 *
 * Requires admin privileges to run effectively (use privilege escalation 
 * exploit first then use this to get password so you are no longer dependent 
 * on the exploit)
 *
 * Seen on reddit: https://www.reddit.com/r/Malware/comments/779v21/til_you_can_maintain_administrative_access/
 * Code from pastebin dump: https://pastebin.com/u992uP5e

danzek

// Get list of indices from Elasticsearch.

// Yes, I know this boils down to `curl http://localhost:9200/_cat/indices` and shows less information.
// I did this as a personal exercise while learning Go.

/*
Public Domain. Use this however you wish!

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR

danzek

// Get list of indices from Elasticsearch and delete any with filebeat as prefix
// this is ugly and there should be more functions instead of all this crap in main but it's a one-off script

/*
Public Domain. Use this however you wish!

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

danzek

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
@="AtomicRedTeam"
[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
@="{00000001-0000-0000-0000-0000FEEDACDC}"
[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
@="AtomicRedTeam"
[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
@="{00000001-0000-0000-0000-0000FEEDACDC}"
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

danzek

#!/usr/bin/env python
"""
Module containing class to parse and return formatted SID string given list of integers containing SID from byte array

This was made for formatting the CreatorSID from the Microsoft Windows CIM (WMI) repository database in the standard 
Windows SID format ("S-1-5-21-<RID>-<RID>...). For instance, if using a script such as [`python-cim`](https://github.com/fireeye/flare-wmi/tree/master/python-cim) 
[filter-to-consumer bindings](https://github.com/fireeye/flare-wmi/blob/master/python-cim/samples/show_filtertoconsumerbindings.py), 
to extract CreatorSID using that script, you would add `'CreatorSID'` to the filter or consumer properties like so:

    filter_sid = filter.properties["CreatorSID"].value

danzek

<# 
.SYNOPSIS   :  PowerShell script to set Ethernet connection as metered or not metered

.AUTHOR     :  Michael Pietroforte

.SITE       :  https://4sysops.com
#>

# Retrieved from https://4sysops.com/archives/set-windows-10-ethernet-connection-to-metered-with-powershell/