Posts

If you want to create screenshots with PowerShell, then you need to use .NET. I will show you the required code below. But if you want to do it easier, you can also use my Screenshot PowerShell module (more information on that further down). I also demonstrate the following options in this video on YouTube. Why though? Of course, screenshots can simply be created manually by pressing the [Print] key on your keyboard, and there are also good tools for editing screenshots (for example Greenshot). But if you already automate something with PowerShell then it can be helpful e.g. for documentation purposes, if you can create screenshots automatically. ...

If you want to find out which process is listening on a specific TCP/UDP port, you can also use PowerShell for this in Windows. I find this easier than analyzing the output of netstat. I also show this in a Video on YouTube. For TCP: Get-NetTCPConnection For TCP connections, there is the Get-NetTCPConnection cmdlet. However, it only returns the ID of the running process (the OwningProcess property), but we can resolve that using Get-Process. Manually, you would do it like this: ...

I recently had an issue on my Unraid server: I wanted to delete a share (“myshare”) via the GUI, but it just did not do it. When I checked the logs, I found the following: 1 2 3 4 5 6 7 Dec 27 21:53:24 tower emhttpd: readlink -e '/mnt/user/myshare' Dec 27 21:53:24 tower emhttpd: /mnt/user/myshare Dec 27 21:53:24 tower emhttpd: shcmd (750): rmdir '/mnt/user/myshare' Dec 27 21:53:24 tower shfs: /usr/sbin/zfs unmount 'cache/myshare' 2>&1 Dec 27 21:53:24 tower shfs: /usr/sbin/zfs destroy 'cache/myshare' 2>&1 Dec 27 21:53:24 tower shfs: cannot destroy 'cache/myshare': dataset is busy Dec 27 21:53:24 tower shfs: /usr/sbin/zfs mount 'cache/myshare' 2>&1 So apparently the dataset is busy 😐… Weird, because it’s completely empty and no Containers or VMs are supposed to use the share. The hints that I found on the Internet did not help me: ...

If you quickly want to retrieve infos about Active Directory Based Activation (ADBA) in your domain, you can use this PowerShell One-liner: 1 Get-ADDomain | %{Get-ADObject -SearchBase "CN=Activation Objects,CN=Microsoft SPP,CN=Services,CN=Configuration,$($_.DistinguishedName)" -LDAPFilter "(objectclass=msspp-activationobject)" -Properties * -ErrorAction SilentlyContinue | fl displayName,DistinguishedName,Name,msspp-csvlkpartialproductkey } I haven’t tested it in a multi-domain environment, but I think it should work. Explanation The code uses aliases, which are not great in scripts, but neat in One-Liners. It uses Get-ADDomain to determine the Distinguished Name for the Domain. This should make the code portable. ...

I decided to try a bit more Penetration Testing/Ethical Hacking. The following is a Write-Up regarding the TryHackMe room “Blueprint”. Tasks The only info that we have is: Do you have what is takes to hack into this Windows Machine? And the questions: “Lab” user NTLM hash decrypted root.txt So we can assume it’s a Windows machine. Discovery I booted up my Kali linux machine and created a folder on my Desktop to use as a workspace. ...

The NTFS file system is used by default in Windows. And normally a file has only one associated normal data stream with the name :$DATA. But there are also the so-called “Alternate Data Streams” (ADS), which can contain additional data. These ADS are not visible in the Windows Explorer or most other applications. ADS are sometimes used by the system, but could also be used by attackers to hide data. ...

If you export data via PowerShell (for example to a CSV file via Export-CSV), the original property names of the PowerShell objects are used. However, if these are not fully fitting for your purpose, you can also customize them. So-called “Calculated Properties” and the cmdlet Select-Object can be used for this. This can be used, for example, to Rename properties Format property values Create completely custom properties (e.g. by calling additional cmdlets) Output objects normally As a reminder: The selection of object properties with Select-Object is possible with the -Property parameter. However, the parameter usually does not have to be named explicitly. ...

I recently worked on a client project, where I had to do some work around Active Directory Computers. I used PowerShell and some light filtering and processing. And now I share those examples, and hopefully someone finds them interesting or helpful. Maybe it will be me, who finds it interesting in the future. In that case: Moin Andi! 👋 Example 1: Filter Computer by Operating System Version The AD attribute OperatingSystemVersion holds the OS version with the build number in a format like this: 10.0 (19041) ...

I recently upgraded this website to 11ty v2.0, but I needed more change. Initially I just wanted to create a basic Design with Terminal.css. But then I randomly stumbled over the Hugo Theme Gallery and found some beautiful themes! So I chose to use Hugo Papermod and migrate the Website to Hugo 🤓. Since I don’t really know JavaScript, so it doesn’t matter for me that Hugo uses Go instead. I never used Go as a programming language, but it sounds great. I’ll just ramble a bit now what I did to migrate my blog. ...

Normally when a user leaves the Company their OneDrive for Business site gets automatically delegated to their manager. That means the manager gets SharePoint Site Collection admin rights to the OneDrive site of their subordinate. Checking and Changing Access Delegation ⚠️ Access Delegation is enabled as default. The setting can be found and changed here: Go to More features in the new SharePoint admin center, and sign in with an account that has admin permissions for your organization. […] Under User profiles, select Open. Under My Site Settings, select Setup My Sites. Next to My Site Cleanup, make sure Enable access delegation is selected. (Source: https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion#configure-automatic-access-delegation) ...