Skip to content

Instantly share code, notes, and snippets.

@mdjx
mdjx / gist:2822c26977dea24d0baa3aaf7744c177
Last active March 23, 2020 03:00
Output Veeam Jobs with target repository and total backup size per job
Get-VBRJob | select Name, @{N="Repository";E={$_.GetTargetRepository().Name}}, @{N="TotalSize"; E={[Math]::Round(((Get-VBRBackup -Name $_.Name | Sort-Object {$_.LastPointCreationTime -As [DateTime]} -Descending | Select -First 1).GetAllStorages().Stats.BackupSize | Measure-Object -Sum).Sum / 1Gb,2)}}
$blocks = @()
$blockChain = @()
#$blocks += New-Object -TypeName psobject -Property @{c = [char]0x2597; s=@(0,0,0,1); w=3}
#$blocks += New-Object -TypeName psobject -Property @{c = [char]0x259d; s=@(0,1,0,0); w=2}
$blocks += New-Object -TypeName psobject -Property @{c = [char]0x2599; s=@(1,0,1,1); w=4}
$blocks += New-Object -TypeName psobject -Property @{c = [char]0x259b; s=@(1,1,1,0); w=3}
$blocks += New-Object -TypeName psobject -Property @{c = [char]0x259c; s=@(1,1,0,1); w=3}
$blocks += New-Object -TypeName psobject -Property @{c = [char]0x259f; s=@(0,1,1,1); w=3}
$blocks += New-Object -TypeName psobject -Property @{c = [char]0x258d; s=@(0,0,1,1); w=2}
// Dump all links on a page to a text file, may need to disable adblock temporarily
window.open("data:text/csv;charset=utf-8," + encodeURIComponent(Array.from(document.links).map(e=>e.href).join("\n")))
"https://mail.yourcompany.com" | % {try {iwr "$_/ecp/DDI/DDIService.svc/GetList?ActivityCorrelationID=X&schema=Antimalware&SecurityToken=Y" -UseBasicParsing} catch {$E=$_.ErrorDetails.Message; if (($E |sls "404.0 - Not Found" -Quiet) -and ($E | sls "Logon User(.*)Anonymous" -Quiet)) {Write-Output "Protected"} elseif (($E |sls "404.0 - Not Found" -Quiet) -and ($E | sls "Logon User" -Quiet)) {Write-Output "Vulnerable"} else {Write-Output "Unknown: Returned data does not contain expected values"}}}
@mdjx
mdjx / PNDetection.ps1
Created July 9, 2021 02:23
PrintNightmare Registry Settings
"UpdatePromptSettings","NoWarningNoElevationOnInstall" | % {if ((Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" -ErrorAction SilentlyContinue).$_ -match "1|2") { Write-Warning "Vulnerable via $_" }}
function PNValidate {
$Results = [PSCustomObject]@{
Spooler = $null
PatchInstalled = $false
RestrictDriverInstallationToAdministrators = $null
NoWarningNoElevationOnInstall = $null
UpdatePromptSettings = $null
Exploitable = $true
Explanation = $null
}