jymcheong

<#
  .SYNOPSIS
    Installs ZeroTier
  .DESCRIPTION
    Install ZeroTier and join/configure ZeroTier network
  .EXAMPLE
    ./ios-InstallZeroTier.ps1 
  .NOTES
    This script will install PowerShell 7 if it is not present.
    A UAC prompt will appear during install if -UI is used.

jymcheong

Anti-hype LLM reading list

Goals: Add links that are reasonable and good explanations of how stuff works. No hype and no vendor content if possible. Practical first-hand accounts and experience preferred (super rare at this point).

My own notes from a few months back.

Background

• Survey of LLMS
• Self-attention and transformer networks

jymcheong

' ASR rules bypass creating child processes
' https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction
' https://www.darkoperator.com/blog/2017/11/11/windows-defender-exploit-guard-asr-rules-for-office
' https://www.darkoperator.com/blog/2017/11/6/windows-defender-exploit-guard-asr-vbscriptjs-rule

Sub ASR_blocked()
    Dim WSHShell As Object
    Set WSHShell = CreateObject("Wscript.Shell")
    WSHShell.Run "cmd.exe"
End Sub

jymcheong

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace EtwpTest
{
    class Program
    {
        static void Main(string[] args)
        {

jymcheong

// Credits: John Stewien
// From: http://code.cheesydesign.com/?p=572

/*
Reading the Portable Executable (PE) header in C#
My job consists of writing fully custom applications for groups of people. The time pressure of these projects is quite high, so generally people start using the application while I’m still writing it, which means I write it modularly and add features as I go along. I also fix bugs as they are discovered. My clients are 2 tiered where expert users get a new build first, they test if for a while, and if they think it’s acceptable they then pass it on to others.

This method of distribution is quite ad-hoc so when a client rings me up and asks me to view their screen to look at something, it’s useful to know what build they are running. To facillitate this I print the link date in the main Window Title so I instantly have an idea about how old the version is that I am looking at. This date is calculated at run time. To do this requires reading in the Portable Executable (PE) header from th

jymcheong

var distance = function(s1, s2) {
  var m = 0;

  // Exit early if either are empty.
  if ( s1.length === 0 || s2.length === 0 ) {
    return 0;
  }

  // Exit early if they're an exact match.
  if ( s1 === s2 ) {

jymcheong

=========================
# /etc/nginx/nginx.conf
=========================

user www-data;
worker_processes 4;
pid /var/run/nginx.pid;

events {
  worker_connections 768;

jymcheong

$Domain = [AppDomain]::CurrentDomain
$DynAssembly = New-Object System.Reflection.AssemblyName('TempAssembly')
$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('TempModule')
# Create a stub module that the in-memory module (i.e. this mimics the loading of a netmodule at runtime) will be loaded into.
$ModuleBuilder2 = $AssemblyBuilder.DefineDynamicModule('hello.dll')
$TypeBuilder = $ModuleBuilder.DefineType('TempClass', [Reflection.TypeAttributes]::Public)
$TypeBuilder.CreateType()
$HelloDllBytes = [Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAJNPvloAAAAAAAAAAOAAAiELAQsAAAQAAAAGAAAAAAAAPiMAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAOQiAABXAAAAAEAAAJgCAAAAAAAAAAAAAAAAAAA

jymcheong

# Example of how to use Invoke-RestMethod with headers and cookies

$Credential = Get-Credential # Your credential goes here

[System.Uri]$Uri = "http://server01.example.com/api/pizza/1" # Add the Uri
$ContentType = "application/json" # Add the content type
$Method = 'PUT' # Add the method type
$Body = '{ "id" = 1, "Name" = "Peperoni" }' # Add the body for the request

$Cookie = New-Object System.Net.Cookie

jymcheong

filter Get-PEFeature {
<#
.SYNOPSIS

Retrieves key features from PE files that can be used to build detections.

.DESCRIPTION

Get-PEFeature extracts key features of PE files that are relevant to building detections.