sj sjfbo

Note: I did not author this, i found it somehwere.

Active Directory Attacks

Summary

Tools
Most common paths to AD compromise
- MS14-068 (Microsoft Kerberos Checksum Validation Vulnerability)
- Open Shares
[GPO - Pivoting with Local Admin

58 bytes of CSS to look great nearly everywhere

When making this website, i wanted a simple, reasonable way to make it look good on most displays. Not counting any minimization techniques, the following 58 bytes worked well for me:

main {
  max-width: 38rem;
  padding: 2rem;
  margin: auto;
}

Even though well known methods exist to bypass ptrace deactivation on a process when spawning (fake ptrace() preloading, breakpoint on ptrace(), etc... ), it is trickier when process is already protected.

Thankfully Linux 3.2+ was generous enough to provide read/write capabilities to another process with 2 new system calls: sys_process_vm_readv and sys_process_vm_writev. (see https://github.com/torvalds/linux/blob/master/arch/x86/syscalls/syscall_64.tbl#L319)

Manual says:

These system calls transfer data between the address space of the calling

Description

This simple script will take a picture of a whiteboard and use parts of the ImageMagick library with sane defaults to clean it up tremendously.

The script is here:

#!/bin/bash
convert "$1" -morphology Convolve DoG:15,100,0 -negate -normalize -blur 0x1 -channel RBG -level 60%,91%,0.1 "$2"

Results

Unfollow everyone on twitter.com

By @foldleft.bsky.social, see also Unfollow everyone on bsky.app.

Go to https://twitter.com/YOUR_USER_NAME/following
Open the Developer Console. (COMMAND+ALT+I on Mac)
Paste this into the Developer Console and run it

// Unfollow everyone on twitter.com, by Jamie Mason (https://twitter.com/fold_left)

	ruby '2.7.1'

	gem 'rails', github: 'rails/rails'
	gem 'tzinfo-data', '>= 1.2016.7' # Don't rely on OSX/Linux timezone data

	# Action Text
	gem 'actiontext', github: 'basecamp/actiontext', ref: 'okra'
	gem 'okra', github: 'basecamp/okra'

	# Drivers

	MIT License

	Copyright (c) 2018 Noel Bundick

	Permission is hereby granted, free of charge, to any person obtaining a copy
	of this software and associated documentation files (the "Software"), to deal
	in the Software without restriction, including without limitation the rights
	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	copies of the Software, and to permit persons to whom the Software is
	furnished to do so, subject to the following conditions:

	# Updated for Ruby 2.3
	string_t = None

	def get_rstring(addr):
	s = addr.cast(string_t.pointer())
	if s['basic']['flags'] & (1 << 13):
	return s['as']['heap']['ptr'].string()
	else:
	return s['as']['ary'].string()

	13:15 <xQuasar> \| HASKELL IS FOR FUCKIN FAGGOTS. YOU'RE ALL A BUNCH OF
	\| FUCKIN PUSSIES
	13:15 <xQuasar> \| JAVASCRIPT FOR LIFE FAGS
	13:16 <luite> \| hello
	13:16 <ChongLi> \| somebody has a mental illness!
	13:16 <merijn> \| Wow...I suddenly see the error of my ways and feel
	\| compelled to write Node.js!
	13:16 <genisage> \| hi
	13:16 <luite> \| you might be pleased to learn that you can compile
	\| haskell to javascript now

	[alias]
	wip = for-each-ref --sort='authordate:iso8601' --format=' %(color:green)%(authordate:relative)%09%(color:white)%(refname:short)' refs/heads