Skip to content

Instantly share code, notes, and snippets.

View nullbind's full-sized avatar

Scott Sutherland nullbind

View GitHub Profile
function Get-ClrReflection
{
<#
.SYNOPSIS
Detects memory-only CLR (.NET) modules
Author: Joe Desimone (@dez_)
License: BSD 3-Clause
@jaredcatkinson
jaredcatkinson / Get-KerberosTicketGrantingTicket.ps1
Last active February 24, 2024 15:19
Kerberos Ticket Granting Ticket Collection Script and Golden Ticket Detection Tests
function Get-KerberosTicketGrantingTicket
{
<#
.SYNOPSIS
Gets the Kerberos Tickets Granting Tickets from all Logon Sessions
.DESCRIPTION
Get-KerberosTicketGrantingTicket uses the Local Security Authority (LSA) functions to enumerate Kerberos logon sessions and return their associate Kerberos Ticket Granting Tickets.
select n [id], SUSER_NAME(n) [user_name]
from (
select top 10000 row_number() over(order by t1.number) as N
from master..spt_values t1
cross join master..spt_values t2
) a
where SUSER_NAME(n) is not null
@mikesmullin
mikesmullin / x86-assembly-notes.md
Last active April 22, 2024 21:15
Notes on x86-64 Assembly and Machine Code

Mike's x86-64 Assembly (ASM) Notes

Assembling Binary Machine Code

Operating Modes:

These determine the assumed/default size of instruction operands, and restricts which opcodes are available, and how they are used.

Modern operating systems, booted inside Real mode,

# Show message box popup.
Add-Type -AssemblyName System.Windows.Forms
$result = [System.Windows.Forms.MessageBox]::Show("My message", "Window Title", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::None)
# Show input box popup.
Add-Type -AssemblyName Microsoft.VisualBasic
$inputText = [Microsoft.VisualBasic.Interaction]::InputBox("Enter some value:", "Window Title", "Default value")
# Show an Open File Dialog and return the file selected by the user.
function Read-OpenFileDialog([string]$InitialDirectory, [switch]$AllowMultiSelect)