Discover gists

## lsarlookupsids3_aes.py
from impacket.dcerpc.v5 import epm, lsad, rpcrt, transport, lsat, ndr, nrpc
from impacket.uuid import bin_to_uuidtup
from binascii import unhexlify
from random import randbytes
import sys

# Perform a lsarlookupsids3 with a trust account, it uses netlogon as SSP (see [MS-NRPC] 3.3)
# Pure TCP RPC is used (ncacn_ip_tcp option)
# AES is used, so you need impacket #1848 (https://github.com/fortra/impacket/pull/1848)
# Tested with impacket 0.12.0 on GOAD

## api_etl_w_pyspark.ipynb

      
              1 file
            
          
              0 forks
            
          
                0 comments
              
            
              0 stars
            
          
                jrhumberto
                / api_etl_w_pyspark.ipynb
            
            
              Created
              February 6, 2025 22:16
                — forked from calilisantos/api_etl_w_pyspark.ipynb
            
              
                API ETL with Pyspark
              
          
      Loading

      Sorry, something went wrong. Reload?
      Sorry, we cannot display this file.
      Sorry, this file is invalid so it cannot be displayed.
      
          Viewer requires iframe.
      
    
## gist:22c50617e815ac67400853556d88998b
<!DOCTYPE html>
<html>
<head>
    <title>テキストファイル置換ツール</title>
</head>
<body>
    <input type="file" id="fileInput">
    <div id="replacements"></div>
    <button onclick="replaceAndDownload()">置換してダウンロード</button>

## readme.txt
Play this game by pasting the script in http://www.puzzlescript.net/editor.html

## PostShutdownFullLog.txt
	-- AH POST-SERVER LOGS --
	-- ServerID: 944d925d-e257-4f7d-9a35-1f4ff2429116
	-- Server started: February 06, 2025 10:12 PM UTC | Server uptime: 177 seconds


	------------------ LOADB LOGS ------------------

	{
}

## PostShutdownFullLog.txt
	-- AH POST-SERVER LOGS --
	-- ServerID: f55d076c-adfc-404a-a3e4-9ec2c29ec8d7
	-- Server started: February 06, 2025 10:15 PM UTC | Server uptime: 4 seconds


	------------------ LOADB LOGS ------------------

	{
}

## windows event logs cheat sheet
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# PS : ChatGPT makes mistakes, consider "trust but verify" principle
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
#Events to Monitor
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
#run
eventvwr.msc            Event viewer
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Event Viewer(Local)-Windows Logs (shutdown / restart )

## 1.RegistrySnapshot.xml
<?xml version="1.0" encoding="utf-8"?>
<registrySnapshot xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <user>S-1-5-21-1596741959-743918983-2523237570-1000</user>
  <keys>
    <key installerType="Custom" displayName="Moonshine" displayVersion="3.3.2">
      <RegistryView>Registry32</RegistryView>
      <KeyPath>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\com.moonshine-ide</KeyPath>
      <DefaultValue />
      <InstallLocation><![CDATA[]]></InstallLocation>
      <UninstallString><![CDATA["C:\Program Files\Moonshine\uninstall.exe" /S]]></UninstallString>

## cleanup-ton-proxy-logs.sh
#!/bin/bash

# Define patterns to search for
PATTERN1="DHT ADNL address record for TON Site was refreshed successfully on"
PATTERN2="no processor for ADNL packet from"
PATTERN3="Host:"
PATTERN4="Accept:"
PATTERN5="Accept-Encoding:"
PATTERN6="Accept-Language:"
PATTERN7="Connection:"

## PostShutdownFullLog.txt
	-- AH POST-SERVER LOGS --
	-- ServerID: d1332162-e6f8-4a3a-9db2-3f4a98ec70fe
	-- Server started: February 06, 2025 10:05 PM UTC | Server uptime: 520 seconds


	------------------ LOADB LOGS ------------------

	{
}
	from impacket.dcerpc.v5 import epm, lsad, rpcrt, transport, lsat, ndr, nrpc
	from impacket.uuid import bin_to_uuidtup
	from binascii import unhexlify
	from random import randbytes
	import sys

	# Perform a lsarlookupsids3 with a trust account, it uses netlogon as SSP (see [MS-NRPC] 3.3)
	# Pure TCP RPC is used (ncacn_ip_tcp option)
	# AES is used, so you need impacket #1848 (https://github.com/fortra/impacket/pull/1848)
	# Tested with impacket 0.12.0 on GOAD
	<!DOCTYPE html>
	<html>
	<head>
	<title>テキストファイル置換ツール</title>
	</head>
	<body>
	<input type="file" id="fileInput">
	<div id="replacements"></div>
	<button onclick="replaceAndDownload()">置換してダウンロード</button>
	-- AH POST-SERVER LOGS --
	-- ServerID: 944d925d-e257-4f7d-9a35-1f4ff2429116
	-- Server started: February 06, 2025 10:12 PM UTC \| Server uptime: 177 seconds



	------------------ LOADB LOGS ------------------

	{
	}
	-- AH POST-SERVER LOGS --
	-- ServerID: f55d076c-adfc-404a-a3e4-9ec2c29ec8d7
	-- Server started: February 06, 2025 10:15 PM UTC \| Server uptime: 4 seconds



	------------------ LOADB LOGS ------------------

	{
	}
	------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
	# PS : ChatGPT makes mistakes, consider "trust but verify" principle
	------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
	#Events to Monitor
	https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
	------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
	#run
	eventvwr.msc Event viewer
	------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
	Event Viewer(Local)-Windows Logs (shutdown / restart )
	<?xml version="1.0" encoding="utf-8"?>
	<registrySnapshot xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
	<user>S-1-5-21-1596741959-743918983-2523237570-1000</user>
	<keys>
	<key installerType="Custom" displayName="Moonshine" displayVersion="3.3.2">
	<RegistryView>Registry32</RegistryView>
	<KeyPath>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\com.moonshine-ide</KeyPath>
	<DefaultValue />
	<InstallLocation><![CDATA[]]></InstallLocation>
	<UninstallString><![CDATA["C:\Program Files\Moonshine\uninstall.exe" /S]]></UninstallString>
	#!/bin/bash

	# Define patterns to search for
	PATTERN1="DHT ADNL address record for TON Site was refreshed successfully on"
	PATTERN2="no processor for ADNL packet from"
	PATTERN3="Host:"
	PATTERN4="Accept:"
	PATTERN5="Accept-Encoding:"
	PATTERN6="Accept-Language:"
	PATTERN7="Connection:"
	-- AH POST-SERVER LOGS --
	-- ServerID: d1332162-e6f8-4a3a-9db2-3f4a98ec70fe
	-- Server started: February 06, 2025 10:05 PM UTC \| Server uptime: 520 seconds



	------------------ LOADB LOGS ------------------

	{
	}