With the advent of PowerShell v5’s awesome new security features, old versions of PowerShell have all of the sudden become much more attractive for attackers and Red Teams. PowerShell Downgrade Attacks There are two ways to do this: Command Line Version Parameter The simplest technique is: PowerShell –Version 2 –Command <…> (or of course any of the –Version abbreviations). PowerShell.exe itself is just a simple native application that hosts the CLR, and the –Version switch tells PowerShell which version of the PowerShell assemblies to load.
If you’re interested in knowing when specific Visual Studio compiler options have been introduced, here you go. 2003 to 2005 Option Purpose ------ ------- /analyze Enable code analysis. /bigobj Increases the number of addressable sections in an .obj file. /doc Process documentation comments to an XML file. /errorReport Allows you to provide internal compiler error (ICE) information directly to the Visual C++ team. /favor Produces code that is optimized for a specific x64 architecture or for the specifics of micro-architectures in both the AMD64 and Extended Memory 64 Technology (EM64T) architectures.
Time Journal helps you analyze where you spend your time by infrequently asking the simple question: “What are you doing?”
Visual Studio Code has a built-in feature to check for and install updates, but I’ve always been frustrated by having to acknowledge the update, allow the browser to restart, watch an installer, and then get back to what I was about to do anyways (which is edit some text). As a solution, here’s a quick little PowerShell script to run. It will create a background task to run every night at 3:14 AM and update VS Code for you automatically if one is available.
In 1799, Napoleon’s explorers discovered a 4-foot tall, 700 lb stone slab in Rosetta (Rashid), Egypt. Explore its hieroglyphics and their meanings with the Rosetta Stone Explorer.
If you’ve ever been interested in having all of Wikipedia in a plain-text format, you might have been disappointed to learn that Wikipedia doesn’t actually make this format available. This PowerShell script will create a plain-text version of Wikipedia for you.
Edit: If you want to see how deep this rabbit hole goes, check out our Black Hat / DEF CON presentation: https://www.youtube.com/watch?v=x97ejtv56xw In a recent post, we talked a little bit about detecting obfuscated PowerShell through the use of PowerShell’s tokenizer - tackling, as an example, the highly irregular variable names generated by MetaSploit’s PowerShell encoder. Obfuscation has been around as long as computer programs have, so the rise of obfuscated PowerShell scripts shouldn’t be much of a surprise.
In preparation for some upcoming presentations, I wanted to make some images of the current Fortune 500 logos. No such resource existed, so now it does. The attached ZIP has: Logos for the Fortune 500, numbered by their position A PowerPoint deck with a slide where they are composed together An image of the logos in a grid An image of the logos in a grid, with a “Fortune 500” logo on top.
I recently had my HP Photosmart Premium stop working. Initially, it failed with an error message requesting that I clear the carriage jam. This was caused by the carriage being stuck at the far right of the printer where it normally goes to clean the print head. The carriage was stuck enough that moving it with my hands didn’t work. When I took the sides of the printer off, there was a movable plate stuck below the carriage that I was able to slide away using a bamboo skewer.
Edit: If you want to see how deep this rabbit hole goes, check out our Black Hat / DEF CON presentation: https://www.youtube.com/watch?v=x97ejtv56xw I was recently looking at a sample that was encoded using MSF’s basic template obfuscation (stolen without attribution from Matt Graeber of course): https://github.com/rapid7/metasploit-framework/blob/b206de77081069dd53b1f90f57bfaccd0ecbb0d8/data/templates/scripts/to_mem_pshreflection.ps1.template For example: function mtKZ { Param ($l7PpJu1SE4VO, $qhnBBk5lHo) $pcE6VKGt = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') return $pcE6VKGt.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($pcE6VKGt.