Skip to content

Instantly share code, notes, and snippets.

View wdormann's full-sized avatar

wdormann wdormann

64 followers · 0 following
View GitHub Profile
@wdormann
wdormann / checksvc-lpe.py
Created November 23, 2021 14:27
Python script to check for explicitly privileged services that are controllable by non-admin users
import os
import subprocess
import ctypes
# See: https://blogs.msmvps.com/erikr/2007/09/26/set-permissions-on-a-specific-service-windows/
svcinfo = {}
#nonadmin = ['AU', 'AN', 'BG', 'BU', 'DG', 'WD', 'IU', 'LG']
nonadmin = ['AU', 'AN', 'BG', 'BU', 'DG', 'IU', 'LG']
FNULL = open(os.devnull, 'w')
@wdormann
wdormann / noappinstaller.reg
Last active December 14, 2021 00:30
Prevent the ability to click on a ms-appinstaller: URI for the current user
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Classes\ms-appinstaller]
"URL Protocol"=-
@wdormann
wdormann / checkjndi.py
Last active December 22, 2021 16:28
Check for JAR files that may be vulnerable to CVE-2021-44228
# This script is deprecated.
# See https://github.com/CERTCC/CVE-2021-44228_scanner for up-to-date scanners
@wdormann
wdormann / checkjndi.ps1
Last active December 27, 2021 11:03
Check for JAR files that may be vulnerable to CVE-2021-44228
# This script is deprecated.
# See https://github.com/CERTCC/CVE-2021-44228_scanner for up-to-date scanners
@wdormann
wdormann / enable_bottom-up_ASLR.reg
Created November 16, 2017 17:52
Enable both Mandatory ASLR *and* Bottom-up ASLR system-wide
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel]
"MitigationOptions"=hex:00,01,01,00,00,00,00,00,00,00,00,00,00,00,00,00
@wdormann
wdormann / diagcab_highrisk.reg
Created June 7, 2022 17:34
Set .diagcab files as high risk in Windows to help mitigate DogWalk
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations]
"HighRiskFileTypes"=".diagcab"
@wdormann
wdormann / unregister-msdt.reg
Created May 30, 2022 12:54
Unregister ms-msdt to protect against recent Office 0day
Windows Registry Editor Version 5.00
[-HKEY_CLASSES_ROOT\ms-msdt]
@wdormann
wdormann / dangerous.reg
Created August 11, 2022 12:50
Have Windows treat dangerous files as, well, dangerous. List courtesy @Laughing_Mantis
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations]
"HighRiskFileTypes"=".appinstaller;.application;.appx;.appxbundle;.diagcab;.diagpkg;.diagcfg;.fluid;.fxb;.glb;.gltf;.library-ms;.loop;.msix;.partial;.perfmoncfg;.pko;.ply;.ppkg;.qds;.rat;.resmoncfg;.search-ms;.searchConnector-ms;.settingcontent-ms;.stl;.symlink;.theme;.themepack;.UDL;.url;.wab;.wbcat;.wcx;.website;.whiteboard;.xbap;.ZFSendToTarget;"
@wdormann
wdormann / checkaslrfiles.py
Last active September 19, 2022 23:40
Python script to check for PE files linked with /DYNAMICBASE, but are not actually ASLR compatible due to missing relocation table
'''checkaslrfiles.py: Check for files that opt into ASLR with /DYNAMICBASE,
but do not have a relocation table to allow ASLR to function.
usage: checkaslrfiles.py <dir>
ex: checkaslr.py "C:\Program Files\"
requires: pefile <https://github.com/erocarrera/pefile>, which should be
installable via: pip install pefile
'''
@wdormann
wdormann / checksvc.py
Last active September 20, 2022 10:03
Check for insecure services on Windows
import os
import subprocess
import ctypes
# See: https://blogs.msmvps.com/erikr/2007/09/26/set-permissions-on-a-specific-service-windows/
svcinfo = {}
nonadmin = ['AU', 'AN', 'BG', 'BU', 'DG', 'WD', 'IU', 'LG']
FNULL = open(os.devnull, 'w')