ssstonebraker

#!/usr/bin/env python

# prints all the records in all the zones in colums separated by ','.
# It uses raw mode to handle pagination to iterate over zones and records

import CloudFlare

separator=","
cf = CloudFlare.CloudFlare(token='REPLACE_WITH_YOUR_OWN_CF_TOKEN', raw=True)
per_page = 10

ssstonebraker

#!/bin/sh
# for testing EDR
VERSION="ng"
ADVISORY="This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission."

###########################################
#-------) Checks pre-everything (---------#
###########################################
if ([ -f /usr/bin/id ] && [ "$(/usr/bin/id -u)" -eq "0" ]) || [ "`whoami 2>/dev/null`" = "root" ]; then
  IAMROOT="1"

ssstonebraker

#!/bin/bash

echo "[*] - Now writing file /tmp/check_ip.sh"

cat <<'EOF' > /tmp/check_ip.sh
#!/bin/bash
# Purpose: Return current external IP
CURRENTIP=$(curl --silent icanhazip.com)
echo "[*] - Current IP - ${CURRENTIP}"

ssstonebraker

TCPReplay/TCPRewrite/TCPPrep/TCPDump Cheatsheet

tcprewrite

Rewrite IP/Mac addresses, -C optionally to fix checksums

1. tcpprep, first:C2S, Second S2C, Generate cache file

ssstonebraker

AWS-CLI Cheatsheet

Table of content

• Installation
• EC2
  • UTIL: List all instances
  • UTIL: List specific fields of all instances
  • UTIL: List all instances of a product
• UTIL: List all stopped instances

ssstonebraker

{
    "username": "brakertech",
    "export_time": "2021-01-28T23:14:25.004Z",
    "export_type": "Account Items",
    "service_command_library": [
        {
            "service": "http",
            "sort_order": null,
            "name": "davtest",
            "command": "davtest -url http://$ip:$port",

ssstonebraker

* * * * * . $HOME/.bash_profile; cd $HOME/Library/cron/philips-hue-experiments && $HOME/Library/cron/philips-hue-experiments/hue.sh 2>&1 >> $HOME/Library/cron/philips-hue-experiments/log/hue.log
@daily /bin/echo "" > $HOME/Library/cron/philips-hue-experiments/log/hue.log

ssstonebraker

#!/bin/bash
# Author: Steve Stonebraker
# Date: 11/16/2020
# brakertech.com

WHOAMI=$(whoami)
path_phe=/Users/"$WHOAMI"/Library/cron/philips-hue-experiments
path_log="$PWD"/log/hue.log
path_npm=$(which npm)

ssstonebraker

[TOC]

Windows Initial Checks

Basic Info

hostname
systeminfo
whoami

Global path

If any part of the SYSTEM %PATH% variable is writeable by Authenticated Users, privesc exists

ssstonebraker

#!/bin/bash

  echo "    Removing Office 365 apps..."
    rm -rf "/Applications/Microsoft Excel.app"
    rm -rf "/Applications/Microsoft OneNote.app"
    rm -rf "/Applications/Microsoft Outlook.app"
    rm -rf "/Applications/Microsoft PowerPoint.app"
    rm -rf "/Applications/Microsoft Word.app"
    rm -rf "/Applications/Microsoft OneDrive.app"
    rm -rf "/Applications/Microsoft Teams.app"