- Details
- Written by: po3dno
- Category: Power Shell
- Hits: 949
net stop wuauserv reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /f reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /f reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /f reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientIDValidation /f net start wuauserv wuauclt.exe /resetauthorization /detectnow pause
- Details
- Written by: po3dno
- Category: Power Shell
- Hits: 882
#Convert from Base64 to SID
[byte[]]$sid = [System.Convert]::FromBase64String("AQUAAAAAAAUVAAAAuwkCIyAUg1vk+E/VWQQAAA==")
$si = New-Object Security.Principal.SecurityIdentifier($sid,0)
$si.ToString()
#Convert from SID to Base64 (Needed for squid)
$sidconvert = New-Object Security.Principal.SecurityIdentifier("S-1-5-21-587336123-1535317024-3578788068-1112")
$sid_out = New-Object 'byte[]' $sidconvert.BinaryLength
$sidconvert.GetBinaryForm($sid_out,0)
[System.Convert]::ToBase64String($sid_out)
- Details
- Written by: po3dno
- Category: Power Shell
- Hits: 918
(Get-WmiObject -ComputerName . -class "Win32_TSGeneralSetting" -Namespace root\CIMV2\TerminalServices -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)
- Details
- Written by: po3dno
- Category: Power Shell
- Hits: 1034
If an attack made it into your active directory environment and got a golden ticket, there is a specific set of steps you need to take to make sure you've cleaned out the adversary:
- Disconnect the affected networks. Entirely.
- Remediate any persistence mechanisms left behind
- Reset passwords of ALL high privileged access accounts
- Reset passwords of all VPN access credentials (+other remote access you may have)
- Change the krbtgt hash using https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51 run in it the order of using first option 1, then option 2 and then option 3: (https://cdn-images-1.medium.com/max/1000/1*Gk48jksjPuThTrPnJNHW-w.png)
- Wait minimum 10 hours
- Change the krbtgt hash again using https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51 run in it the order of using first option 1, then option 2 and then option 3: (https://cdn-images-1.medium.com/max/1000/1*Gk48jksjPuThTrPnJNHW-w.png)
- Details
- Written by: po3dno
- Category: Power Shell
- Hits: 859
Sysprep /generalize /shutdown /oobe
First, mount the vhd using
Mount-WindowsImage -ImagePath C:\VHDs\BigHomies.vhdx -Path C:\VHDMount -Index 1Then, capture it into a wim with
New-WindowsImage -CapturePath C:\VHDMount -Name Win7Image -ImagePath C:\CapturedWIMs\Win7.wim -Description "Yet another Windows 7 Image" -VerifyAnd let it do it's thing. When you are done you can unmount the vhd and discard any changes using:
Dismount-WindowsImage -Path C:\VHDMount -Discard