ad3t0 / arrembyscan

Uses PowerShell and Emby's API to run a a library scan of a specific directory passed into the script by Sonarr or Radarr using the connect options.

Scripts and Notes

PowerShell Scripts

MSOfficeInstall

Installs MS Office

MSOfficeInstall.ps1

Set-ExecutionPolicy Bypass -Scope Process -Force; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/powershell/MSOfficeInstall.ps1'))

ProfileMigrate

Copies data from C:\Users\CurrentUser\Documents, Desktop, Pictures to selected path

ProfileMigrate.ps1

Set-ExecutionPolicy Bypass -Scope Process -Force; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/powershell/ProfileMigrate.ps1'))

ChocoInstall

Installs https://chocolatey.org/

ChocoInstall.ps1

Set-ExecutionPolicy Bypass -Scope Process -Force; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/powershell/ChocoInstall.ps1'))

LogonStartUpTask

PowerShell logon or startup task creator

LogonStartUpTask.ps1

Set-ExecutionPolicy Bypass -Scope Process -Force; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/powershell/LogonStartUpTask.ps1'))

DriverSearch

Google search with system model for drivers in default browser

DriverSearch.ps1

Set-ExecutionPolicy Bypass -Scope Process -Force; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/powershell/DriverSearch.ps1'))

AutoLogin

Setup Windows auto login and display current

AutoLogin.ps1

Set-ExecutionPolicy Bypass -Scope Process -Force; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/powershell/AutoLogin.ps1'))

Bash Scripts

Script for Setting up Netplan

curl -sSL https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/bash/netplanSetup.sh | bash

Script for Setting up SSH PubKeyAuth and Root Login

curl -sSL https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/bash/copysshid.sh | bash

Windows Notes

Convert Windows Server 2019 Evaluation to Standard

DISM /online /Set-Edition:ServerStandard /ProductKey:N69G4-B89J2-4G8F4-WWYCC-J464C /AcceptEula

Convert Windows Server 2019 Evaluation to Datacenter

DISM /online /Set-Edition:ServerDatacenter /ProductKey:WMDGN-G9PQG-XVVXX-R3X43-63DFG /AcceptEula

Convert Windows Server 2022 Evaluation to Datacenter

DISM /online /Set-Edition:ServerDatacenter /ProductKey:WX4NM-KYWYW-QJJR4-XV3QB-6VM33 /AcceptEula

Transfer all FSMO Roles

Move-ADDirectoryServerOperationMasterRole "DC1" -OperationMasterRole 0,1,2,3,4

Seize all FSMO Roles

Move-ADDirectoryServerOperationMasterRole "DC1" -OperationMasterRole 0,1,2,3,4 -Force

Reset Domain Admin Password Error 4000, 4007

netdom resetpwd /server:PDC.domain.com /userd:Domain\domain_admin /passwordd:*

Restore Deleted AD Object

Get-ADObject -Filter {displayName -eq 'Full Name'} -IncludeDeletedObjects | Restore-ADObject

Set time server to domain hierarchy

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\VMICTimeProvider" -Name "Enabled" -Value 0
w32tm /query /source
w32tm /config /syncfromflags:DOMHIER /update
w32tm /resync

Set time server

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\VMICTimeProvider" -Name "Enabled" -Value 0
w32tm /config /manualpeerlist:time.nist.gov,0x1 /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time
w32tm /resync /force
w32tm /query /configuration

Generate and export .pfx cert

$notafter = (Get-date).AddYears(10)
$cert = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname test.com -NotAfter $notafter
$pwd = ConvertTo-SecureString -String '12345678' -Force -AsPlainText
$path = 'cert:\localMachine\my\' + $cert.thumbprint
Export-PfxCertificate -cert $path -FilePath c:\cert.pfx -Password $pwd

Ubuntu/Debian Notes

Template Setup Script

sudo bash -c "$(wget -qLO - https://raw.githubusercontent.com/Ad3t0/Ad3t0/master/bash/setup_server.sh)"

Set Timezone

sudo timedatectl set-timezone America/Denver

Edit Crontab

sudo crontab -e
sudo service cron reload

Sysbench Benchmark

#Install if needed
apt install sysbench
#Run Benchmarks
sysbench cpu run
sysbench memory run
sysbench fileio --file-test-mode=seqwr run
sysbench fileio cleanup

Expand Disk Size

df -h
sudo lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
sudo resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv

Ubuntu 22.04 Zabbix Agent Install

sudo apt update
sudo apt upgrade -y
wget https://repo.zabbix.com/zabbix/6.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_6.0-4+ubuntu22.04_all.deb
sudo dpkg -i zabbix-release_6.0-4+ubuntu22.04_all.deb
sudo apt update
sudo apt install zabbix-agent2 -y
sudo sed -i 's/Server=127.0.0.1/Server=0.0.0.0\/0/' /etc/zabbix/zabbix_agent2.conf
sudo systemctl enable zabbix-agent2
sudo systemctl restart zabbix-agent2

Ubuntu 20.04 Zabbix Agent Install

sudo apt update
sudo apt upgrade -y
wget https://repo.zabbix.com/zabbix/6.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_6.0-4+ubuntu20.04_all.deb
sudo dpkg -i zabbix-release_6.0-4+ubuntu20.04_all.deb
sudo apt update
sudo apt install zabbix-agent2 -y
sudo sed -i 's/Server=127.0.0.1/Server=0.0.0.0\/0/' /etc/zabbix/zabbix_agent2.conf
sudo systemctl enable zabbix-agent2
sudo systemctl restart zabbix-agent2

Montor network interface bandwidth

tcptrack -i eno1

Install QEMU Guest Agent

sudo apt install qemu-guest-agent
sudo systemctl start qemu-guest-agent

Set Network Config

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  renderer: networkd
  ethernets:
    ens160:
      dhcp4: 'no'
      addresses:
        - 192.168.250.10/24
      gateway4: 192.168.250.1
      nameservers:
        search:
          - TEST.lan
        addresses:
          - 192.168.250.2
          - 192.168.250.1

sudo netplan apply

Disk Speed Test

hdparm -Tt /dev/sda

MacOS Notes

Mac Setup

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/admin/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
sudo softwareupdate --install-rosetta
brew install --cask google-chrome ringcentral appcleaner adobe-acrobat-reader adobe-creative-cloud microsoft-office
sudo dscl . create /Users/admin IsHidden 1

Proxmox Notes

Proxmox Helper Scripts VE 7 Post Install https://tteck.github.io/Proxmox/

bash -c "$(wget -qLO - https://github.com/tteck/Proxmox/raw/main/misc/post-pve-install.sh)"

Proxmox Script VE 8 Upgrade https://tteck.github.io/Proxmox/

bash -c "$(wget -qLO - https://github.com/tteck/Proxmox/raw/main/misc/pve8-upgrade.sh)"

Change IP in

nano /etc/network/interfaces
nano /etc/hosts

Proxmox Dark Theme https://tteck.github.io/Proxmox/

bash <(curl -s https://raw.githubusercontent.com/Weilbyte/PVEDiscordDark/master/PVEDiscordDark.sh ) install

Remove Node From Cluster

#Set to new number of nodes
pvecm expected 1
#Remove node2
pvecm delnode node2

Zabbix Setup

wget https://repo.zabbix.com/zabbix/6.4/ubuntu/pool/main/z/zabbix-release/zabbix-release_6.4-1+ubuntu20.04_all.deb
dpkg -i zabbix-release_6.4-1+ubuntu20.04_all.deb
apt update
apt install zabbix-agent2 zabbix-agent2-plugin-*
sed -i 's/Server=127.0.0.1/Server=192.168.250.10/' /etc/zabbix/zabbix_agent2.conf
systemctl restart zabbix-agent2
systemctl enable zabbix-agent2

ZFS Set Volsize

zfs set volsize=120G rpool/data/vm-<VM ID>-disk-<DISK ID>

Install QEMU Guest Agent

sudo apt install qemu-guest-agent
sudo systemctl start qemu-guest-agent

Set dedicated network interface for replication

echo "migration: insecure,network=172.17.93.0/24" >> /etc/pve/datacenter.cfg

Manually Remove Snapshot

nano /etc/pve/qemu-server/<vmid>.conf
zfs list
zfs destroy

Microsoft Download Links

Windows Server ISOs

OS	Download Link
Windows Server 2012 R2	http://download.microsoft.com/download/6/2/A/62A76ABB-9990-4EFC-A4FE-C7D698DAEB96/9600.17050.WINBLUE_REFRESH.140317-1640_X64FRE_SERVER_EVAL_EN-US-IR3_SSS_X64FREE_EN-US_DV9.ISO
Windows Server 2016	http://download.microsoft.com/download/6/9/5/6957BB28-1FAD-4E62-B161-F873196130BD/14393.0.161119-1705.RS1_REFRESH_SERVERESSENTIALS_OEM_X64FRE_EN-US.ISO
Windows Server 2019	https://software-download.microsoft.com/download/pr/17763.737.190906-2324.rs5_release_svc_refresh_SERVER_EVAL_x64FRE_en-us_1.iso
Windows Server 2022	https://software-download.microsoft.com/download/sg/20348.169.210806-2348.fe_release_svc_refresh_SERVER_EVAL_x64FRE_en-us.iso

Microsoft Office Installers

Version	Download Link
Office 365 Professional Plus	http://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/O365ProPlusRetail.img
Office 365 Business	http://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/O365BusinessRetail.img
Office 365 Home Premium	http://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/O365HomePremRetail.img
Office 2019 Professional Plus	https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/ProPlus2019Retail.img
Office 2016 Professional Plus	https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/ProPlusRetail.img
Office 2013 Professional	https://officeredir.microsoft.com/r/rlidO15C2RMediaDownload?p1=db&p2=en-US&p3=ProfessionalRetail
Visio 2019 Professional	https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/VisioPro2019Retail.img
Visio 2016 Professional	http://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/VisioProRetail.img
Visio 2016 Standard	http://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/VisioStdRetail.img
Project 2019 Professional	https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/ProjectPro2019Retail.img
Project 2016 Professional	http://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/ProjectProRetail.img
Project 2016 Standard	http://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/ProjectStdRetail.img
Outlook 2016	http://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/OutlookRetail.img

BIOS Keys

Manufacturer	Key
Acer	Del or F2
ASRock	F2
Asus	Del, F10 or F9
Biostar	Del
Dell	F2 or F12
EVGA	Del
Gigabyte	Del
HP	F10
Lenovo	F2, Fn + F2, F1 or Enter then F1
Intel	F2
MSI	Del
Microsoft Surface	Press and hold volume up
Origin PC	F2
Samsung	F2
Toshiba	F2
Zotac	Del

IP BlackLists

Category	Name	Description	Source	Header/Label
Anonymizers	dan.me.uk	This list contains a full list of all TOR nodes	https://www.dan.me.uk/torlist/	Anon_TOR
Anonymizers	MaxMind	MaxMind.com sample list of high-risk IP addresses.	https://www.maxmind.com/en/high-risk-ip-sample-list	Anon_MaxMind
Attacks	Talos	TalosIntel.com List of known malicious network threats	http://talosintel.com/feeds/ip-filter.blf	Talos
Attacks	BadIPs 15d	Bad IPs in category any with score above 2 and age less than 15d	https://www.badips.com/get/list/any/2?age=15d	BadIPs_15d
Attacks	BadIPs 30d	BadIPs.com Bad IPs in category any with score above 2 and age less than 30d	https://www.badips.com/get/list/any/2?age=30d	BadIPs_30d
Attacks	Blocklist.de	Blocklist.de IPs that have been detected by fail2ban in the last 48 hours	http://lists.blocklist.de/lists/all.txt	Blocklist.de
Attacks	Cyber Crime WHQ	Block IPs	https://cybercrime-tracker.net/fuckerz.php	Cyber_Crime
Attacks	ISC_1d	https://isc.sans.edu/api/sources/attacks/1000/1?text	https://cinsarmy.com/list/ci-badguys.txt
Attacks	Emerging Threats and DShield - Block IPs	This is combines several lists. At the moment of writing the blocklist contains the following:
Attacks	Emerging Threats and DShield - Compromised IPs	Compromised IPs	https://rules.emergingthreats.net/blockrules/compromised-ips.txt	ET_Comp_IP
Attacks	GreenSnow	GreenSnow.co the blacklisted list of IPs for online servers.	https://blocklist.greensnow.co/greensnow.txt	GreenSnow
Attacks	MyIP.ms	Our sites are visited by tens of thousands of people every day. Our unique protection system allows us to easily identify the IP of Unknown Spam Bots / Crawlers and other IP with dangerous software. Below are published in real time our blacklist of such IP's. Hope it will be helpful for you. Read More	https://www.myip.ms/files/blacklist/general/latest_blacklist.txt	MyIP_ms
Attacks	Internet Storm Center	IP Block List	https://isc.sans.edu/api/sources/attacks/1000/30?text	ISC_30d
Attacks	NormShield	NormShield.com IPs in category attack with severity all	https://iplists.firehol.org/files/normshield_all_attack.ipset	NormShield_All
Attacks	Snort IPfilter	Same as TALOS	http://labs.snort.org/feeds/ip-filter.blf	SnortIPfilter
Malware	Abuse.ch Feodo	Included in RW. Abuse.ch Feodo tracker trojan includes IPs which are being used by Feodo (also known as Cridex or Bugat) which commits ebanking fraud	https://feodotracker.abuse.ch/blocklist/?download=ipblocklist	Abusech_Feodo
Malware	Abuse.ch Ransomware Tracker Feed	Abuse.ch Ransomware Tracker Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites.	https://ransomwaretracker.abuse.ch/feeds/csv/	Abusech_Feed
Malware	Abuse.ch Ransomware Tracker RW	Abuse.ch Ransomware Tracker Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites.	https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt	Abusech_RW
Malware	Abuse.ch SSL Blacklist Agressive	Abuse.ch SSL Blacklist The aggressive version of the SSL IP Blacklist contains all IPs that SSLBL ever detected being associated with a malicious SSL certificate	https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv	Abusech_sslbl
Malware	Abuse.ch Zeus	Included in RW. Abuse.ch Zeus tracker standard, contains the same data as the ZeuS IP blocklist (zeus_badips) but with the slight difference that it doesn't exclude hijacked websites (level 2) and free web hosting providers (level 3)	https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist	Abusech_Zeus
Malware	Bambenek	Master Feed of known, active and non-sinkholed C&Cs IP addresses	https://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt	Bambenek_All
Malware	IBM X-Force	IBM X-Force Exchange Botnet Command and Control Servers	https://iplists.firehol.org/files/xforce_bccs.ipset	IBM_XForce
Malware	Malc0de	Malc0de.com malicious IPs of the last 30 days	http://malc0de.com/bl/IP_Blacklist.txt	Malc0de
Malware	MalwareDomainList	malwaredomainlist.com list of malware active ip addresses	http://www.malwaredomainlist.com/hostslist/ip.txt	MalwareDomainList
Malware	URLVir	URLVir.com Active Malicious IP Addresses Hosting Malware. URLVir is an online security service developed by NoVirusThanks Company Srl that automatically monitors changes of malicious URLs (executable files)	http://www.urlvir.com/export-ip-addresses/	URLVir
Malware	VxVault	VxVault The latest 100 additions of VxVault.	http://vxvault.net/ViriList.php?s=0&m=100	VxVault
Reputation	AlienVault	AlienVault.com IP reputation database	https://reputation.alienvault.com/reputation.generic	AlienVault
Reputation	Binary Defense	Binary Defense Systems Artillery Threat Intelligence Feed and Banlist Feed	https://www.binarydefense.com/banlist.txt	BinaryDefense
Reputation	CINS Army	CIArmy.com IPs with poor Rogue Packet score that have not yet been identified as malicious by the community	http://cinsscore.com/list/ci-badguys.txt	CINS_Army
Attacks	ISCBlock		https://isc.sans.edu/feeds/block.txt
Anonymizers	ProxyLists_1d		https://iplists.firehol.org/files/proxylists_1d.ipset
Malware	Abuse_DYRE		https://sslbl.abuse.ch/blacklist/dyre_sslipblacklist.csv

arrembyscan's Issues

setting up first time

$logDir =
is this embys log dir or just a dir to use for logs?