JL jlawhon

## Get-ADUserAudit.ps1
#requires -version 5.1
#requires -module ActiveDirectory

#you might need to increase the size of the Security eventlog
# limit-eventlog -LogName security -ComputerName dom2,dom1 -MaximumSize 1024MB

Function Get-ADUserAudit {
    [cmdletbinding()]
    Param(
        [Parameter(Position=0,HelpMessage = "Specify one or more domain controllers to query.")]

## 20211210-TLP-WHITE_LOG4J.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                jlawhon
                / 20211210-TLP-WHITE_LOG4J.md
            
            
              Created
              December 13, 2021 02:30
                — forked from SwitHak/20211210-TLP-WHITE_LOG4J.md
            
              
                BlueTeam CheatSheet * Log4Shell* | Last updated: 2021-12-12 2204 UTC
              
          
    Security Advisories / Bulletins linked to Log4Shell (CVE-2021-44228)
Errors, typos, something to say ?


If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great ressources


Royce Williams list is different, listed by vendors responses:
https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/
TBD


## download-latest-release.ps1
# Download latest dotnet/codeformatter release from github

$repo = "dotnet/codeformatter"
$file = "CodeFormatter.zip"

$releases = "https://api.github.com/repos/$repo/releases"

Write-Host Determining latest release
$tag = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].tag_name

## apk_relative_links.txt
../wiki/ImageDatabaseSummary.md
./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
/..
/...
/../
/.DS_Store
/.codepushrelease
/0-.
/10000000
/3-

## macOS-IR-Forensics.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                jlawhon
                / macOS-IR-Forensics.md
            
            
              Created
              August 3, 2021 07:25
                — forked from 0xmachos/macOS-IR-Forensics.md
            
              
                If someone wants to learn MacOS IR/forensics what’s the best resource for that?
              
          
Sarah Edwards (@iamevltwin)

mac4n6.com
SANS FOR518: Mac and iOS Forensic Analysis and Incident Response
Apple Pattern of Life Lazy Output'er


Unified Log

Howard Oakley @howardnoakley

Unified log: 1 why, what and how
Unified log: 2 content and extraction


Unified log: 3 finding your way


## Find-VulnerableSchemas.ps1
# Dictionary to hold superclass names
$superClass = @{}

# List to hold class names that inherit from container and are allowed to live under computer object
$vulnerableSchemas = [System.Collections.Generic.List[string]]::new()

# Resolve schema naming context
$schemaNC = (Get-ADRootDSE).schemaNamingContext

# Enumerate all class schemas

## Workstation-Takeover.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                jlawhon
                / Workstation-Takeover.md
            
            
              Created
              July 25, 2021 23:42
                — forked from gladiatx0r/Workstation-Takeover.md
            
              
                From RPC to RCE - Workstation Takeover via RBCD and MS-RPChoose-Your-Own-Adventure
              
          
    Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

  
## JavascriptRecon.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                jlawhon
                / JavascriptRecon.md
            
            
              Created
              July 25, 2021 23:42
            
              
                My Javascript Recon Process - BugBounty
              
          
    Description

This is a simple guide to perform javascript recon in the bugbounty
Steps


The first step is to collect possibly several javascript files (more files = more paths,parameters -> more vulns)


## offsec.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                jlawhon
                / offsec.md
            
            
              Created
              May 17, 2020 07:56
                — forked from jivoi/offsec.md
            
              
                Penetrating Testing/Assessment Workflow
              
          
    Penetrating Testing/Assessment Workflow & other fun infosec stuff
https://github.com/jivoi/pentest
My feeble attempt to organize (in a somewhat logical fashion) the vast amount of information, tools, resources, tip and tricks surrounding penetration testing, vulnerability assessment, and information security as a whole*

Reconnaissance

Passive/Semi-Passive

Tools


Discover - https://github.com/leebaird/discover


## Invoke-Procdump.ps1
$Source = @"
using System;
using System.Runtime.InteropServices;

namespace ProcDump {
    public static class DbgHelp {
        [DllImport("Dbghelp.dll")]
        public static extern bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, IntPtr hFile, IntPtr DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
    }
}
	#requires -version 5.1
	#requires -module ActiveDirectory

	#you might need to increase the size of the Security eventlog
	# limit-eventlog -LogName security -ComputerName dom2,dom1 -MaximumSize 1024MB

	Function Get-ADUserAudit {
	[cmdletbinding()]
	Param(
	[Parameter(Position=0,HelpMessage = "Specify one or more domain controllers to query.")]
	# Download latest dotnet/codeformatter release from github

	$repo = "dotnet/codeformatter"
	$file = "CodeFormatter.zip"

	$releases = "https://api.github.com/repos/$repo/releases"

	Write-Host Determining latest release
	$tag = (Invoke-WebRequest $releases \| ConvertFrom-Json)[0].tag_name
	../wiki/ImageDatabaseSummary.md
	./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
	/..
	/...
	/../
	/.DS_Store
	/.codepushrelease
	/0-.
	/10000000
	/3-
	# Dictionary to hold superclass names
	$superClass = @{}

	# List to hold class names that inherit from container and are allowed to live under computer object
	$vulnerableSchemas = [System.Collections.Generic.List[string]]::new()

	# Resolve schema naming context
	$schemaNC = (Get-ADRootDSE).schemaNamingContext

	# Enumerate all class schemas
	$Source = @"
	using System;
	using System.Runtime.InteropServices;

	namespace ProcDump {
	public static class DbgHelp {
	[DllImport("Dbghelp.dll")]
	public static extern bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, IntPtr hFile, IntPtr DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
	}
	}