Skip to content

Instantly share code, notes, and snippets.

View raandree's full-sized avatar

Raimund Andrée [MSFT] raandree

View GitHub Profile
@raandree
raandree / DsGetDcNameWin32Demo.ps1
Created March 11, 2023 16:41
This script shows how to use a Win32 function (GetDcName) from PowerShell.
$code = @'
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;
namespace Test
@raandree
raandree / Get-KerberosTickets.ps1
Created February 15, 2022 10:53
Get all Kerberos tickets from all logon sessions
$sessions = klist sessions
$pattern = '\[(\d+)\] Session \d \d:(?<LowPart>0)x(?<HighPart>[a-f0-9]+)'
$sessions = foreach ($line in $sessions)
{
if ($line -match $pattern)
{
New-Object PSObject -Property @{
LowPart = $Matches.LowPart
HighPart = $Matches.HighPart
@raandree
raandree / EventTextLengthCompare.ps1
Last active December 16, 2021 11:55
Compare length of text of an event as plain text, XML serialized, Base64 encoded and then AES256 encrypted.
function GenerateRandomSalt
{
[byte[]]$data = New-Object byte[](32)
$cp = [System.Security.Cryptography.RNGCryptoServiceProvider]::new()
for ($i = 0; $i -lt 10; $i++)
{
$cp.GetBytes($data)
}
@raandree
raandree / BootstrapPowerShellGet.ps1
Created January 13, 2021 09:23
Update a client to the newest PowerShellGet version
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
mkdir -Path C:\ProgramData\Microsoft\Windows\PowerShell\PowerShellGet -Force
Invoke-WebRequest -Uri 'https://nuget.org/nuget.exe' -OutFile C:\ProgramData\Microsoft\Windows\PowerShell\PowerShellGet\nuget.exe -ErrorAction Stop
Install-PackageProvider -Name NuGet -Force
Install-Module -Name PowerShellGet -Force
@raandree
raandree / 1. Start-PortScan.ps1
Last active April 26, 2024 10:20
PowerShell Portscan
<#
.SYNOPSIS
Powerful asynchronus IPv4 Port Scanner
.DESCRIPTION
This powerful asynchronus IPv4 Port Scanner allows you to scan every Port-Range you want (500 to 2600 would work).
The result will contain the Port number, Protocol, Service name, Description and the Status.
.EXAMPLE
@raandree
raandree / Update-AzureVmDiskSku.ps1
Last active April 18, 2020 10:33
Changes the Sku of all disks connected to a VM to the desired one. Chaning the VMs role size might also be required.
param (
[Parameter(Mandatory)]
$ResourceGroupName,
[Parameter(Mandatory)]
$VmName,
[Parameter(Mandatory)]
[ValidateSet('Standard_LRS', 'Premium_LRS', 'StandardSSD_LRS', 'UltraSSD_LRS')]
$StorageType,
@raandree
raandree / Install.ps1
Created March 4, 2020 12:51
Install Wireshark and Fiddler
$vms = Get-LabVM -Role FileServer
$wiresharkUri = 'https://1.eu.dl.wireshark.org/win64/Wireshark-win64-3.2.2.exe'
$fiddlerUri = 'https://telerik-fiddler.s3.amazonaws.com/fiddler/FiddlerSetup.exe'
$fiddler = Get-LabInternetFile -Uri $fiddlerUri -Path $labSources\SoftwarePackages -PassThru
$wireshark = Get-LabInternetFile -Uri $wiresharkUri -Path $labSources\SoftwarePackages -FileName Wireshark.exe -PassThru
Install-LabSoftwarePackage -Path $fiddler.FullName -CommandLine /S -ComputerName $vms
Install-LabSoftwarePackage -Path $wireshark.FullName -CommandLine /S -ComputerName $vms
@raandree
raandree / Get-SqlConnections.sql
Created March 4, 2020 10:56
Gets all connection from a SQL server including authentication type
SELECT
s.session_id,
c.connect_time,
s.login_time,
s.login_name,
c.protocol_type,
c.auth_scheme,
s.HOST_NAME,
s.program_name
FROM sys.dm_exec_sessions s
@raandree
raandree / Attach-Debugger.ps1
Last active April 18, 2020 16:42
Debug DSC code running in a different process
#usually the process consuming the most memory is the DSC one
$p = Get-Process -Name WmiPrvSE -IncludeUserName |
Where-Object UserName -eq 'NT AUTHORITY\SYSTEM' |
Sort-Object -Property WS -Descending |
Select-Object -First 1
Enter-PSHostProcess -Process $p -AppDomainName DscPsPluginWkr_AppDomain
$rs = Get-Runspace | Where-Object { $_.Debugger.InBreakpoint }
Debug-Runspace -Runspace $rs
@raandree
raandree / azure-pipelines.yml
Created February 14, 2020 14:14
Parallel job execution in Azure DevOps
trigger:
- '*'
stages:
- stage: develop
jobs:
- job: A
strategy:
parallel: 4
pool: