https://computingforgeeks.com/install-guacamole-remote-desktop-on-ubuntu-jammy-jellyfish/

https://www.digitalocean.com/community/tutorials/how-to-enable-remote-desktop-protocol-using-xrdp-on-ubuntu-22-04

/etc/xrdp/xrdp.ini
[Globals]
autorun=Xorg
hidelogwindow=yes
 

xrdp fix
https://github.com/neutrinolabs/xrdp/issues/1128#issuecomment-633747125

echo xfce4-session > ~/.xsession

https://kifarunix.com/install-apache-guacamole-on-ubuntu-20-04/

https://httpd.apache.org/docs/2.4/programs/apxs.html
https://znil.net/index.php?title=Ubuntu_18.04.x_LTS_-_Guacamole_HTML5_Remotedesktop_Gateway_installieren_mit_Apache_Reverse_Proxy

echo xfce4-session> ~/.xsession

apt-get install letsencrypt
apt-get install python-certbot-apache

with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"

xrdp from 16.04 is broken, too - no clibboard

http://c-nergy.be/blog/?p=9285

apt-get -y update

apt-get -y install build-essential automake autoconf libtool pkg-config checkinstall
apt-get -y install libx11-dev libxfixes-dev libssl-dev libpam0g-dev libtool libjpeg-dev flex bison gettext autoconf libxml-parser-perl libfuse-dev xsltproc libxrandr-dev python-libxml2 nasm xserver-xorg-dev fuse

apt-get -y install xrdp
apt-get -y remove xrdp

mkdir ~/Downloads
cd ~/Downloads
wget https://github.com/neutrinolabs/xrdp/releases/download/v0.9.1/xrdp-0.9.1.tar.gz
wget https://github.com/neutrinolabs/xorgxrdp/releases/download/v0.2.0/xorgxrdp-0.2.0.tar.gz

 tar xfz xrdp-0.9.1.tar.gz
 cd ~/Downloads/xrdp-0.9.1/
 ./bootstrap
 ./configure
 make
 checkinstall -y

 cd ~/Downloads
 tar xfz xorgxrdp-0.2.0.tar.gz
 cd xorgxrdp-0.2.0
  ./bootstrap
 ./configure
 make
 checkinstall -y


echo "Symbolic links for xrdp"
echo "-----------------------"

sudo mv /etc/xrdp/startwm.sh /etc/xrdp/startwm.sh.backup
sudo ln -s /etc/X11/Xsession /etc/xrdp/startwm.sh
sudo mkdir /usr/share/doc/xrdp
sudo cp /etc/xrdp/rsakeys.ini /usr/share/doc/xrdp/rsakeys.ini

## Needed in order to have systemd working properly with xrdp
echo "-----------------------"
echo "Modify xrdp.service "
echo "-----------------------"

#Comment the EnvironmentFile - Ubuntu does not have sysconfig folder
sudo sed -i.bak 's/EnvironmentFile/#EnvironmentFile/g' /lib/systemd/system/xrdp.service

#Replace /sbin/xrdp with /sbin/local/xrdp as this is the correct location
sudo sed -i.bak 's/sbin\/xrdp/local\/sbin\/xrdp/g' /lib/systemd/system/xrdp.service
echo "-----------------------"
echo "Modify xrdp-sesman.service "
echo "-----------------------"

#Comment the EnvironmentFile - Ubuntu does not have sysconfig folder
sudo sed -i.bak 's/EnvironmentFile/#EnvironmentFile/g' /lib/systemd/system/xrdp-sesman.service

#Replace /sbin/xrdp with /sbin/local/xrdp as this is the correct location
sudo sed -i.bak 's/sbin\/xrdp/local\/sbin\/xrdp/g' /lib/systemd/system/xrdp-sesman.service

#Issue systemctl command to reflect change and enable the service
sudo systemctl daemon-reload
sudo systemctl enable xrdp.service


--------/etc/xrdp.ini----------
[Xorg]
name=Xorg
lib=libxup.so
username=ask
password=ask
ip=127.0.0.1
port=-1
code=20
--------/etc/xrdp.ini----------

ubuntu 16.04 - package list

build-essential apache2 apache2-dev apache2-utils autotools-dev automake autoconf checkinstall unzip zip libssl-dev
python-letsencrypt-apache
xubuntu-desktop xrdp
tomcat8 maven openjdk-8-jdk-headless
libcairo2-dev libjpeg-dev libpng12-dev libossp-uuid-dev libfreerdp-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev libavcodec-dev libswscale-dev

ubuntu 16.04 - X11RDP-o-Matic not needed anymore

x11rdp is fixed on ubuntu 16.04

sudo apt-get install xrdp

/etc/xrdp/xrdp.ini
[globals]
address=127.0.0.1

Reconnect to the Same Session

Since Ubuntu 14.10, a new xrdp package has been made available in the Ubuntu repository. This package fixes a long time issue related to the fact that users could not reconnect to the same session.  If you are using the package xrdp 0.6.1-1, you do not need to perform any customization, you will reconnect automatically to the same session.

http://c-nergy.be/blog/?p=8952

mod_authn_otp-1.1.7.tar.gz

https://code.google.com/p/mod-authn-otp/ - old page https://github.com/archiecobbs/mod-authn-otp - at this time down direct download: https://s3.amazonaws.com/archie-public/mod-authn-otp/mod_authn_otp-1.1.7.tar.gz local mirror: https://drive.google.com/open?id=0B12y8hY3D9OJZWZDOXl5YV9hd3M

compile quacamole

libcairo2-dev libjpeg-dev libpng12-dev libossp-uuid-dev libfreerdp-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev automake autoconf checkinstall libtool maven tomcat7 apache2-dev apache2-utils autotools-dev unzip zip apache reverseproxy benötigt: a2enmod proxy_http tomcat7: /etc/tomcat7/server.xml: address="127.0.0.1" /etc/default/tomcat7: GUACAMOLE_HOME = /etc/guacamole qr: apt-get install php5-gd cp guacamole/target/guacamole-0.9.9.war /var/lib/tomcat7/webapps/guacamole.war

powershell compress single file via NTFS (pinvoke)

	Add-Type @"
	using System;
	using System.IO;
	using System.Runtime.InteropServices;
	public class NTFSFileCompression
	{
	#pragma warning disable
	[DllImport("kernel32.dll")]
	public static extern bool DeviceIoControl(
	IntPtr hDevice, uint dwIoControlCode, ref short lpInBuffer, uint nInBufferSize,
	IntPtr lpOutBuffer, uint nOutBufferSize, ref uint lpBytesReturned,
	IntPtr lpOverlapped);
	private const uint FSCTL_SET_COMPRESSION = 0x0009C040;
	private const short COMPRESSION_FORMAT_NONE = 0;
	private const short COMPRESSION_FORMAT_DEFAULT = 1;
	private static bool SetCompression(IntPtr handle, short compression)
	{
	uint lpBytesReturned = 0;
	return DeviceIoControl(
	handle, FSCTL_SET_COMPRESSION, ref compression, 2, IntPtr.Zero,
	0, ref lpBytesReturned, IntPtr.Zero);
	}
	public static bool SetFileCompressed(string path)
	{
	using (FileStream fs = OpenFileStream(path))
	{
	return SetCompression(fs.Handle, COMPRESSION_FORMAT_DEFAULT);
	}
	}
	public static bool SetFileUncompressed(string path)
	{
	using (FileStream fs = OpenFileStream(path))
	{
	return SetCompression(fs.Handle, COMPRESSION_FORMAT_NONE);
	}
	}
	private static FileStream OpenFileStream(string path)
	{
	return File.Open(path, FileMode.Open, FileAccess.ReadWrite, FileShare.None);
	}
	}
	"@
	[NTFSFileCompression]::SetFileCompressed([string]"aFile.txt")

view raw NTFSFileCompression.ps1 hosted with ❤ by GitHub

C# Source: http://www.blackwasp.co.uk/FileCompression.aspx

Azure Powershell

1. Azure Powershell installieren https://azure.microsoft.com/en-us/documentation/articles/powershell-install-configure/ 2. Azure subscription installieren http://blogs.technet.com/b/canitpro/archive/2013/11/06/set-by-step-manage-windows-azure-using-powershell.aspx 3. Powershell Session zur Azure-VM aufbauen https://gallery.technet.microsoft.com/scriptcenter/Configures-Secure-Remote-b137f2fe

ssh - allow password authentication to localhost

Match address 127.0.0.1/32,::1
PasswordAuthentication yes

xrdp session resumption

X11RDP/ xrdp has no proper session resumption / reconnection
X11RDP-o-Matic fixes this /etc/xrdp/xrdp.ini [globals] address=127.0.0.1

apt install history

/var/log/apt/history.log

harden openssh

nop.exe

	#pragma comment(linker, "/SUBSYSTEM:windows /ENTRY:mainCRTStartup")
	void main() {
	;
	}

view raw gistfile1.cpp hosted with ❤ by GitHub

nop.exe
C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\vcvarsall.bat
Cl nop.c

add windows user to sql instance in single user mode

	"D:\Microsoft SQL Server\<INSTANCE_NAME>\MSSQL\Binn\sqlservr.exe" -s<INSTANCE_NAME> -m
	wichtig parameter für sqlcmd sind case sensitive
	sqlcmd -E -S<SERVERNAME>\<INSTANCE_NAME>
	CREATE LOGIN [<domain>\<user>] FROM WINDOWS;
	GO
	SP_ADDSRVROLEMEMBER '<domain>\<user>', 'sysadmin'
	GO

view raw add windows user to sql instance in single user mode hosted with ❤ by GitHub

embed gist snippets in blogspot

How to embed gist snippets in blogspot

create QR Code for Google Authenticator without using google charts API

One time pad authentication for apache: mod-authn-otp/
create QR Code for Google Authenticator without using google charts API (source code gpl): qr generator
Google Authenticator

apt-get install php5 php5-gd libapache2-mod-php5

Install Guacamole

Install Guacamole
Guacamole HTML5 gateway

tomcat - server.xml - listen localhost only:

	<Connector address="127.0.0.1" port="8009" protocol="AJP/1.3"
	connectionTimeout="20000"
	URIEncoding="UTF-8" />
	<Connector address="127.0.0.1" port="8080" protocol="HTTP/1.1"
	connectionTimeout="20000"
	URIEncoding="UTF-8"
	redirectPort="8443" />

view raw server.xml hosted with ❤ by GitHub

Guacamole - apache as reverse proxy for tomcat:

	<Location /guacamole/>
	Order allow,deny
	Allow from all
	ProxyPass ajp://127.0.0.1:8009/guacamole/ max=20 flushpackets=on
	ProxyPassReverse ajp://127.0.0.1:8009/guacamole/
	AuthName "Password"
	AuthUserFile /etc/guacamole/.htpasswd
	SetEnv proxy-chain-auth On
	AuthType Basic
	Order deny,allow
	Deny from all
	require valid-user
	</Location>

view raw guacamole.conf hosted with ❤ by GitHub

apt-get install xubuntu-desktop xrdp
apt-get install libcairo2-dev libpango1.0-dev libpng12-dev freerdp-x11 libssh2-1 libvncserver-dev libfreerdp-dev libvorbis-dev libssl0.9.8 libssh-dev libssh2-1-dev libpulse-dev
apt-get install uuid uuid-dev libossp-uuid-dev

compile apache module for existing apache binary

apxs - APache eXtenSion tool

mod-authn-otp - Apache module for one-time password authentication

apt-get install build-essential apache2 apache2-dev apache2-utils
apt-get autotools-dev automake checkinstall
apt-get unzip zip
apt-get install libssl-dev
./autogen.sh
./configure
make
apxs -i -a mod_authn_otp.la
chown www-data:www-data otp
chown www-data:www-data otp/otp-users.txt
a2enmod authn_otp proxy_http headers

simulate hanging windows service

Creating a simple Windows Service in .NET

simulate hanging service:

        protected override void OnStop()

        {

            while (true) { }

        }

Kill-Service.ps1

	1: function Kill-Service() {
	2: param(
	3: [Parameter(Mandatory=$true)]
	4: [string]$srvcName,
	5: [Parameter(Mandatory=$false)]
	6: [string]$ComputerName='.',
	7: [Parameter(Mandatory=$false)]
	8: [string]$TimeOut='00:00:05'
	9: )
	10: $srvName
	11: $ComputerName
	12: $TimeOut
	13: #Invoke-Command -cn $ComputerName -ArgumentList $srvcName -ScriptBlock {
	14: Invoke-Command -ArgumentList $srvcName -ScriptBlock {
	15: $svc = Get-Service $srvcName
	16: if ($svc -ne $null) {
	17: try {
	18: Write-Host($svc.Name)
	19: $svc.stop() # stoppe Service
	20: $svc.WaitForStatus('Stopped',$TimeOut) # Warte $Timeout auf Stop von Service
	21: Write-Host ('Service exited gracefully')
	22: }
	23: catch [System.ServiceProcess.TimeoutException] {
	24: #sichere Service FailureActions
	25: $regpath="HKLM:\SYSTEM\CurrentControlSet\Services\"+$srvcName
	26: $before=(Get-ItemProperty -Path $regpath -Name FailureActions).FailureActions
	27: Write-Host('Recovery Settings saved')
	28: # ermittele PID des Service-Prozesses
	29: $ServiceNamePID = Get-Service $srvcName
	30: $ServicePID = (Get-WmiObject Win32_Service | Where {$_.Name -eq $ServiceNamePID.Name}).ProcessID
	31: set-itemproperty -Path $regpath -Name FailureActions -Value ([byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x14,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x60,0xea,0x00,0x00,0x00,0x00,0x00,0x00,0x60,0xea,0x00,0x00,0x00,0x00,0x00,0x00,0x60,0xea,0x00,0x00))
	32: Write-Host('Recovery Settings overwritten')
	33: Stop-Process $ServicePID -Force
	34: Write-Host('Process ' + $ServicePID + ' Killed')
	35: #(Get-WmiObject -class win32_process -filter ('ProcessId = '+$ServicePID)).terminate()
	36: set-itemproperty -Path $regpath -Name FailureActions -Value $before
	37: Write-Host('Recovery Settings restored')
	38: }
	39: catch [Exception] {
	40: write-host $_.Exception.GetType().FullName;
	41: write-host $_.Exception.Message;
	42: }
	43: }
	44: else
	45: {
	46: Write-Host('No Service returned')
	47: }
	48: }
	49: }

view raw gistfile1.ps1 hosted with ❤ by GitHub

usefull links

PowerShell-AD-Recon

PowerSploit and other

http://adsecurity.org/

mimikatz

syphersec

https://github.com/samratashok/nishang

veil-powerview

https://github.com/darkoperator/Posh-SecMod

Write-MiniDump

https://zmap.io/