diff --git a/.github/.gitignore b/.github/.gitignore new file mode 100644 index 0000000..7ee4e66 --- /dev/null +++ b/.github/.gitignore @@ -0,0 +1,2 @@ + +*.log \ No newline at end of file diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..dd84ea7 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,38 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Desktop (please complete the following information):** + - OS: [e.g. iOS] + - Browser [e.g. chrome, safari] + - Version [e.g. 22] + +**Smartphone (please complete the following information):** + - Device: [e.g. iPhone6] + - OS: [e.g. iOS8.1] + - Browser [e.g. stock browser, safari] + - Version [e.g. 22] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..bbcbbe7 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,20 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: '' +labels: '' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..f255c94 --- /dev/null +++ b/.gitignore @@ -0,0 +1,40 @@ +# C# / .NET +bin/ +obj/ +*.dll +*.exe +*.pdb +*.user +*.userosscache +*.suo +*.cache +*.log + +# NuGet +*.nupkg +packages/ +*.nuget.props +*.nuget.targets + +# Visual Studio +.vs/ +*.vsidx +*.suo +*.user +*.sln.docstates + +# Rider +.idea/ + +# Build results +[Dd]ebug/ +[Rr]elease/ +x64/ +x86/ +build/ +[Bb]in/ +[Oo]bj/ + +# OS files +.DS_Store +Thumbs.db diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100644 index 0000000..13566b8 --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,8 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Editor-based HTTP Client requests +/httpRequests/ +# Datasource local storage ignored files +/dataSources/ +/dataSources.local.xml diff --git a/.idea/WAFFLEplus.iml b/.idea/WAFFLEplus.iml new file mode 100644 index 0000000..f571432 --- /dev/null +++ b/.idea/WAFFLEplus.iml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/inspectionProfiles/profiles_settings.xml b/.idea/inspectionProfiles/profiles_settings.xml new file mode 100644 index 0000000..105ce2d --- /dev/null +++ b/.idea/inspectionProfiles/profiles_settings.xml @@ -0,0 +1,6 @@ + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..db8786c --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,7 @@ + + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000..b648862 --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..35eb1dd --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..cae59b3 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,128 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity +and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +justin.wright@ascte.org. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series +of actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or +permanent ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within +the community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.0, available at +https://www.contributor-covenant.org/version/2/0/code_of_conduct.html. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct +enforcement ladder](https://github.com/mozilla/diversity). + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see the FAQ at +https://www.contributor-covenant.org/faq. Translations are available at +https://www.contributor-covenant.org/translations. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..b11a426 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1 @@ +Feel free to improve on any scripts. Feedback is very welcome. diff --git a/Important links and stuff.txt b/Important links and stuff.txt new file mode 100644 index 0000000..c811ef7 --- /dev/null +++ b/Important links and stuff.txt @@ -0,0 +1,32 @@ +* Center for Internet Security - Provides numerous resources on Internet security and creates cybersecurity standards +* CNET - Offers the latest cybersecurity news and offers thoousands of open-source software programs for download +* Mandiant- Provides up-to-date information on the most dangerous threats in cyberspace +* Ninite - Hosts a program that can quickly update all of your software at once +* NOVA Labs - The Cybersecurity Lab is a game where players learn basic coding skills, how to spot phishing scams, and how online networks defend against attacks.​ +* SANS - Provides free and fee-based training and resources for cybersecurity professionals +* SourceForge - Hosts a wealth of open-source software, much of which can help keep an operating system secure from attacks +* Splunk- Offers a monitoring and reporting program that helps thwart attacks as they happen and provides insight into past attacks. Splunk is a CyberGold sponsor of CyberPatriot. +* SuperUser​​ - Uses the knowledge of computer experts around the world to answer cybersecurity questions +* TechRepublic - Contains a wide range of resources for technical professionals​ +* ​CyberSecurityEducation.org - Free collection of cyberseurity education and career resources +* Meld(http://meldmerge.org/)- a visually based diffing and merging tool for files and directories that works on both Linux and Windows. + + +https://akshayrohatgi.com/blog/posts/How-To-Win-CyberPatriot/ + +http://technet.microsoft.com/en-us/library/default.aspx + + +http://www.bleepingcomputer.com/tutorials/tutorial74.html + + +http://windows.microsoft.com/en-us/windows7/products/features/windows-firewall + + +http://www.windowsnetworking.com/ + + +http://technet.microsoft.com/en-us/sysinternals/bb545021.aspx + +https://www.youtube.com/playlist?list=PLcn9NsWbb8s4wQrX0Qi5G4kRifQHxCV9- + diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..f288702 --- /dev/null +++ b/LICENSE @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. diff --git a/Linux CyberPatriot Checklist.pdf b/Linux CyberPatriot Checklist.pdf deleted file mode 100644 index 7dcdad3..0000000 Binary files a/Linux CyberPatriot Checklist.pdf and /dev/null differ diff --git a/Linux CyberPatriot Checklist.txt b/Linux CyberPatriot Checklist.txt new file mode 100644 index 0000000..d2d62e6 --- /dev/null +++ b/Linux CyberPatriot Checklist.txt @@ -0,0 +1,100 @@ +PRIORITY +* Open README +* Solve Forensics +* Secure root (terminal > "sudo gedit /etc/ssh/sshd_config" > set PermitRootLogin to "no") +* enable/disable ssh (depending on read me)(install openssh-service to enable/ “systemctl stop ssh” then “systemctl disable ssh” to disable) +* Check for daily updates in Software and Updates (Ubuntu specific) +* Remove/Change user accounts/admin privileges +* Fix permissions +* Delete hacking tools (like wireshark) +* Set password requirements. (check below for detail) +* Install and Enable gufw (Terminal> “sudo apt install ufw”> type “ufw” and make status=ON and Incoming=Reject) +* Update software (Terminal> “sudo apt-update” > “sudo apt-upgrade”) +* Change insecure password + + + +Security tools to install (“sudo apt install [PROGRAM NAME]”) +* Clamav (open it with “clamscan” after install)(virus removal tool) +* ufw(firewall) +* Openssh-server(ssh service) +* libpam-cracklib(creates better password policies) +* Bum (Boot Up Manager) (Use “sudo bum” to run) + + +Looking for media files and hacking tools +* Before manually checking for files, cd into the "/home" directory and run "sudo ls -Ra *" +* Use “ls -la” to also view hidden files +* To search for files use “locate *[filetype]” + * .mp3 + * .mp4 + * .jpg (careful with these as some may be important) + * .avi + * .wav + * .midi + * .bmp + * .gif + * .jpeg + * .pdf + * A TEXT FILE CONTAINING ALL THE USER PASSWORDS +* “rm [PathToFile]” + + +For solving forensics +* If you need to find a user ID in terminal > "id -u " +* Custom script wip + + +For password requirements + Pam.d +1. MAKE SURE libpam-cracklib IS INSTALLED!!!! +2. Through terminal (“cd etc/pam.d/”) +3. “Sudo gedit common-password” +4. Find the line that says “pam_unix.so” and add “remember=5” +5. Find the line that says “pam_cracklib.so” and add “ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1” (Enforces password complexity) + + +1. Through terminal (“sudo gedit /etc/pam.d/common-auth”) +2. At the end of the file add “auth required pam_tally2.so deny=5 onerr=fail unlock_time=1800” (Sets the allowed failed login attempts to 5) + + + Login.defs +1. Go to terminal (“sudo gedit /etc/login.defs”) +2. Set “PASS_MAX_DAYS” to “90” +3. Set “PASS_MIN_DAYS” to “10” +4. Set “PASS_WARN_AGE” to “7” + + +ports stuff + 1. Use "sudo ss -ln" to display all ports + 2. Look into any port that doesn't have "127.0.0.1" if the readme doesn't specify it (still make sure you know what you're doing) + 3. To close a port use "sudo lsof -i :$port" + + +Networking stuff (more advanced. Don't worry about these until later rounds.) + * Enable syn cookie protection ("systemctl -n net.ipv4.tcp_syncookies") + * Disable IPv6 (Potentially harmful! Only under certain conditions.) ("echo "net.ipv6.conf.all.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.conf") + * Disable IP Forwarding ("echo 0 | sudo tee /proc/sys/net/ipv4/ip_forward") + * Prevent IP Spoofing ("echo "nospoof on" | sudo tee -a /etc/host.conf") + +SUS Users(AMONGUSAMONGUSAMONGUSAMONGUSAMONGUSAMONGUS) + In terminal run ("cat /etc/passwd") and look for people that are: + * uid 0 + * can login + * Are allowed in the readme (CPDiscord told me about this one) + + Find fake admins/roots + * go to "/etc/sudoers.d" and make sure only authorized people can sudo + * go to "/etc/group" and remove any non-admins from sudo and admin groups + + + +Disable guest accounts +1. Go to terminal (“sudo gedit /etc/lightdm/lightdm.conf”)(might be “users.conf”) +2. Add the line “allow-guest=false” at the bottom of the file + + +Tools and extras: +* http://whois.domaintools.com/ +* https://wiki.ubuntu.com/Security/features +* Check service configuration files for required services. Sometimes can get a point for finding a wrong setting in a config file for sql, apache, etc. diff --git a/README.md b/README.md index d9ff035..c1100de 100644 --- a/README.md +++ b/README.md @@ -4,11 +4,12 @@ | File | Added by | Desc. | | :-----| :---------| :------| -| Bash.script.for.CP.txt| NotMaxwell | Runs on windows, no known bugs. | -| Linux CyberPatriot Checklist.pdf | Unknown | Should have all of the to-do items for Linux. | -| Windows CyberPatriot Checklist.txt | Unknown | Should have all of the to-do items for Windows. | -| Waffl3.ps1 | Justintimefordinner | Bash script, unkown usage. | -| LinuxScript.py | jman5213 | Python sctipt, mostly incomplete. Can be edited [here.](https://replit.com/join/fbzrymvbux-jman5213) | +| Bash.script.for.CP.txt| NotMaxwell | Windows/Server 2019 | +| Linux CyberPatriot Checklist.pdf | zumlar/SavageCabbage39 | To-do items for Linux. | +| Windows CyberPatriot Checklist.txt | aidantheunnammed | To-do items for Windows. | +| Waffl3.ps1 | Justintimefordinner | Bash script | +| LinuxScript.py | jman5213 | Python script | +| TRACEBACK_PSSWDS.csv | aidantheunnammed | Replacement passwords | \**All checklists should be in the shared Google Drive on your school account.* @@ -17,11 +18,11 @@ | Username | Name | Jobs | | :---------| :-----| :-------| -| Justintimefordinner | Justin | Team Lead / Linux / PacketTracer | -| jman5213 | Jordan | PacketTracer / Googler / Windows Server / Linux Scripter | +| Justintimefordinner | Justin | Team Lead / Linux / Cisco Packet Tracer | +| jman5213 | Jordan | Cisco Packet Tracer / Googler / Windows Server / Linux Scripter | | NotMaxwell | Maxwell | Windows / Bash Scripter | -| aidantheunnammed | Aidan | CyberPatriot Notebook / Windows | +| aidantheunnammed | Aidan | Documentarian / Windows | | SavageCabbage39 | Ty | Checklister / Windows Server | -| zumlar | Gideon | Linux / Linux Scripter / Googler / PacketTracer | +| zumlar | Gideon | Linux / Linux Scripter / Googler / Cisco Packet Tracer | \**Feel free to update any infomation here if I got it wrong.* diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3e15e85 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,16 @@ +# Security Policy + +## Supported Versions + +SOFTWARE PROVIDED WITH NO WARRANTY +EXTREMELY EXPERIMENTAL, CAN AND PROBABLY WILL DAMAGE YOUR COMPUTER IF USED INCORRECTLY + +| Version | Supported | +| ------- | ------------------ | +| 5.1.x | :x: | +| 5.0.x | :x: | +| 4.0.x | :x: | +| < 4.0 | :x: | + +## Reporting a Vulnerability + submit an issue diff --git a/Scripts/CyberPatriotAutomation/CyberPatriotAutomation.csproj b/Scripts/CyberPatriotAutomation/CyberPatriotAutomation.csproj new file mode 100644 index 0000000..df600f4 --- /dev/null +++ b/Scripts/CyberPatriotAutomation/CyberPatriotAutomation.csproj @@ -0,0 +1,15 @@ + + + + Exe + net9.0 + enable + enable + + + + + + + + diff --git a/Scripts/CyberPatriotAutomation/Models/SystemInfo.cs b/Scripts/CyberPatriotAutomation/Models/SystemInfo.cs new file mode 100644 index 0000000..9f4e729 --- /dev/null +++ b/Scripts/CyberPatriotAutomation/Models/SystemInfo.cs @@ -0,0 +1,14 @@ +namespace CyberPatriotAutomation.Models; + +/// +/// Represents current system state information +/// +public class SystemInfo +{ + public string? OSVersion { get; set; } + public List RunningServices { get; set; } = new(); + public List InstalledApplications { get; set; } = new(); + public List UserAccounts { get; set; } = new(); + public List FirewallRules { get; set; } = new(); + public Dictionary RegistrySettings { get; set; } = new(); +} diff --git a/Scripts/CyberPatriotAutomation/Models/TaskResult.cs b/Scripts/CyberPatriotAutomation/Models/TaskResult.cs new file mode 100644 index 0000000..dc24bac --- /dev/null +++ b/Scripts/CyberPatriotAutomation/Models/TaskResult.cs @@ -0,0 +1,13 @@ +namespace CyberPatriotAutomation.Models; + +/// +/// Represents the result of executing a remediation task +/// +public class TaskResult +{ + public string TaskName { get; set; } = string.Empty; + public bool Success { get; set; } + public string Message { get; set; } = string.Empty; + public string? ErrorDetails { get; set; } + public DateTime ExecutedAt { get; set; } = DateTime.Now; +} diff --git a/Scripts/CyberPatriotAutomation/Program.cs b/Scripts/CyberPatriotAutomation/Program.cs new file mode 100644 index 0000000..72bc972 --- /dev/null +++ b/Scripts/CyberPatriotAutomation/Program.cs @@ -0,0 +1,36 @@ +using Spectre.Console; + +AnsiConsole.MarkupLine("[bold blue]CyberPatriot Automation Tool[/]"); +AnsiConsole.MarkupLine("[dim]Version 1.0.0[/]"); +AnsiConsole.WriteLine(); + +// Parse command line arguments +var cliArgs = Environment.GetCommandLineArgs().Skip(1).ToArray(); +var readmeFile = ExtractArgument(cliArgs, "--readme", "-r"); +var dryRun = cliArgs.Contains("--dry-run") || cliArgs.Contains("-d"); +var interactive = !cliArgs.Contains("--no-interactive"); + +if (readmeFile != null) +{ + AnsiConsole.MarkupLine($"[yellow]README: {readmeFile}[/]"); +} + +AnsiConsole.MarkupLine($"[yellow]Interactive Mode: {(interactive ? "ON" : "OFF")}[/]"); +AnsiConsole.MarkupLine($"[yellow]Dry Run: {(dryRun ? "ON" : "OFF")}[/]"); +AnsiConsole.WriteLine(); + +AnsiConsole.MarkupLine("[green]✓ Ready to scan and remediate[/]"); +AnsiConsole.MarkupLine("[dim]Implementation in progress...[/]"); + +static string? ExtractArgument(string[] args, params string[] flags) +{ + for (int i = 0; i < args.Length; i++) + { + if (flags.Contains(args[i]) && i + 1 < args.Length) + { + return args[i + 1]; + } + } + return null; +} + diff --git a/Scripts/CyberPatriotAutomation/README.md b/Scripts/CyberPatriotAutomation/README.md new file mode 100644 index 0000000..f6c8e54 --- /dev/null +++ b/Scripts/CyberPatriotAutomation/README.md @@ -0,0 +1,174 @@ +# CyberPatriot Automation Tool + +A C# console application that automates CyberPatriot competition tasks by scanning your system and executing remediation commands. + +## Features + +- **System State Reading**: Parse README files and capture current system configuration +- **Interactive Mode**: Ask for confirmation before executing each remediation +- **Dry Run Mode**: Preview changes without making them +- **Cross-Platform**: Built on .NET 9.0 for Windows, macOS, and Linux +- **Rich Terminal UI**: Beautiful formatted output with Spectre.Console + +## Project Structure + +``` +CyberPatriotAutomation/ +├── Models/ # Data classes (TaskResult, SystemInfo) +├── Tasks/ # Base task classes for remediation logic +├── Utilities/ # Helper classes (CommandExecutor, ReadmeParser) +├── Commands/ # CLI command handlers +├── Program.cs # Entry point +└── CyberPatriotAutomation.csproj +``` + +## Prerequisites + +- .NET 9.0 SDK or later +- Administrator/sudo privileges (for system remediation) + +## Installation + +1. Clone or download the project +2. Navigate to the project directory: + ```bash + cd CyberPatriotAutomation + ``` + +3. Restore dependencies: + ```bash + dotnet restore + ``` + +## Building + +```bash +dotnet build +``` + +## Running + +Basic execution: +```bash +dotnet run +``` + +With README file: +```bash +dotnet run -- --readme path/to/README.md +``` + +With options: +```bash +dotnet run -- --readme README.md --interactive --dry-run +``` + +### Command Line Arguments + +- `--readme, -r ` - Path to the CyberPatriot README file +- `--interactive, -i` - Ask for confirmation before each action (default: enabled) +- `--no-interactive` - Run without user confirmation +- `--dry-run, -d` - Show what would be done without making changes + +## Architecture + +### Models +- **TaskResult**: Represents the outcome of a task execution +- **SystemInfo**: Stores current system state (services, users, firewall rules, etc.) + +### Tasks +- **BaseTask**: Abstract base class for all remediation tasks + - `ReadSystemStateAsync()`: Gather current system information + - `ExecuteAsync()`: Perform the remediation + - `VerifyAsync()`: Confirm the fix was successful + +### Utilities +- **CommandExecutor**: Execute system commands with optional elevation + - `ExecuteAsync()`: Run a command normally + - `ExecuteElevatedAsync()`: Run with admin/sudo privileges +- **ReadmeParser**: Parse README files to extract task requirements + +## Usage Example + +```csharp +// Create a task implementation +public class DisableUnneededService : BaseTask +{ + public DisableUnneededService() + { + Name = "Disable Unnecessary Services"; + Description = "Disable services not required for the system"; + } + + public override async Task ReadSystemStateAsync() + { + var (success, output, _) = await CommandExecutor.ExecuteAsync("systemctl", "list-units --type=service"); + // Parse and return system info + return new SystemInfo(); + } + + public override async Task ExecuteAsync() + { + var (success, _, error) = await CommandExecutor.ExecuteElevatedAsync("systemctl", "disable telemetry"); + return new TaskResult + { + TaskName = Name, + Success = success, + Message = "Service disabled", + ErrorDetails = error + }; + } + + public override async Task VerifyAsync() + { + // Verify the service is actually disabled + return true; + } +} +``` + +## Development + +### Adding New Tasks + +1. Create a new class in `Tasks/` directory +2. Inherit from `BaseTask` +3. Implement the three abstract methods +4. Register in the main application logic + +### Example: File Cleaner Task + +```csharp +public class CleanTemporaryFiles : BaseTask +{ + // Implementation here +} +``` + +## Dependencies + +- **Spectre.Console** v0.54.0 - Rich terminal output +- **System.CommandLine** v2.0.2 - Command-line argument parsing + +## Notes + +- Ensure you run with elevated privileges on Windows (Run as Administrator) +- Use `--dry-run` first to preview changes +- Always backup important files before running in production +- The tool is designed for Windows systems but can be adapted for Linux/macOS + +## Future Enhancements + +- [ ] Implement specific CyberPatriot task modules +- [ ] Add progress tracking and detailed reporting +- [ ] Create task templates for common CyberPatriot categories +- [ ] Add configuration file support +- [ ] Implement logging and audit trail + +## License + +MIT License - Feel free to modify and distribute + +## Support + +For issues or suggestions, please refer to the main repository. diff --git a/Scripts/CyberPatriotAutomation/Tasks/BaseTask.cs b/Scripts/CyberPatriotAutomation/Tasks/BaseTask.cs new file mode 100644 index 0000000..ed60107 --- /dev/null +++ b/Scripts/CyberPatriotAutomation/Tasks/BaseTask.cs @@ -0,0 +1,27 @@ +using CyberPatriotAutomation.Models; + +namespace CyberPatriotAutomation.Tasks; + +/// +/// Base class for remediation tasks +/// +public abstract class BaseTask +{ + public string Name { get; protected set; } = string.Empty; + public string Description { get; protected set; } = string.Empty; + + /// + /// Read current system state for this task area + /// + public abstract Task ReadSystemStateAsync(); + + /// + /// Execute the remediation for this task + /// + public abstract Task ExecuteAsync(); + + /// + /// Verify that the remediation was successful + /// + public abstract Task VerifyAsync(); +} diff --git a/Scripts/CyberPatriotAutomation/Utilities/CommandExecutor.cs b/Scripts/CyberPatriotAutomation/Utilities/CommandExecutor.cs new file mode 100644 index 0000000..b7c2df8 --- /dev/null +++ b/Scripts/CyberPatriotAutomation/Utilities/CommandExecutor.cs @@ -0,0 +1,81 @@ +using System.Diagnostics; +using Spectre.Console; + +namespace CyberPatriotAutomation.Utilities; + +/// +/// Handles execution of system commands and processes +/// +public class CommandExecutor +{ + /// + /// Execute a command and return the output + /// + public static async Task<(bool Success, string Output, string? Error)> ExecuteAsync(string command, string? arguments = null) + { + try + { + var processInfo = new ProcessStartInfo + { + FileName = command, + Arguments = arguments ?? string.Empty, + UseShellExecute = false, + RedirectStandardOutput = true, + RedirectStandardError = true, + CreateNoWindow = true + }; + + using var process = Process.Start(processInfo); + if (process == null) + return (false, string.Empty, "Failed to start process"); + + var output = await process.StandardOutput.ReadToEndAsync(); + var error = await process.StandardError.ReadToEndAsync(); + + await Task.Run(() => process.WaitForExit()); + + return (process.ExitCode == 0, output, string.IsNullOrEmpty(error) ? null : error); + } + catch (Exception ex) + { + AnsiConsole.WriteException(ex); + return (false, string.Empty, ex.Message); + } + } + + /// + /// Execute a command with elevated privileges (requires admin/sudo) + /// + public static async Task<(bool Success, string Output, string? Error)> ExecuteElevatedAsync(string command, string? arguments = null) + { + try + { + var processInfo = new ProcessStartInfo + { + FileName = command, + Arguments = arguments ?? string.Empty, + UseShellExecute = false, + RedirectStandardOutput = true, + RedirectStandardError = true, + CreateNoWindow = true, + Verb = "runas" // Windows elevation + }; + + using var process = Process.Start(processInfo); + if (process == null) + return (false, string.Empty, "Failed to start elevated process"); + + var output = await process.StandardOutput.ReadToEndAsync(); + var error = await process.StandardError.ReadToEndAsync(); + + await Task.Run(() => process.WaitForExit()); + + return (process.ExitCode == 0, output, string.IsNullOrEmpty(error) ? null : error); + } + catch (Exception ex) + { + AnsiConsole.WriteException(ex); + return (false, string.Empty, ex.Message); + } + } +} diff --git a/Scripts/CyberPatriotAutomation/Utilities/ReadmeParser.cs b/Scripts/CyberPatriotAutomation/Utilities/ReadmeParser.cs new file mode 100644 index 0000000..6f533f4 --- /dev/null +++ b/Scripts/CyberPatriotAutomation/Utilities/ReadmeParser.cs @@ -0,0 +1,55 @@ +namespace CyberPatriotAutomation.Utilities; + +/// +/// Parses README files to extract task requirements +/// +public class ReadmeParser +{ + /// + /// Read and parse README file for task information + /// + public static async Task> ParseReadmeAsync(string filePath) + { + var tasks = new Dictionary(); + + try + { + if (!File.Exists(filePath)) + return tasks; + + var content = await File.ReadAllTextAsync(filePath); + var lines = content.Split(new[] { Environment.NewLine }, StringSplitOptions.None); + + string? currentTask = null; + var description = new List(); + + foreach (var line in lines) + { + // Check for task headers (typically marked with # or similar) + if (line.StartsWith("#") || line.StartsWith("##")) + { + if (currentTask != null && description.Count > 0) + tasks[currentTask] = string.Join(" ", description).Trim(); + + currentTask = line.TrimStart('#').Trim(); + description.Clear(); + } + else if (!string.IsNullOrWhiteSpace(line) && currentTask != null) + { + description.Add(line.Trim()); + } + } + + // Add last task + if (currentTask != null && description.Count > 0) + tasks[currentTask] = string.Join(" ", description).Trim(); + + return tasks; + } + catch (Exception ex) + { + Console.WriteLine($"Error parsing README: {ex.Message}"); + return tasks; + } + } +} diff --git a/Scripts/Linux/LinuxScript.py b/Scripts/Linux/LinuxScript.py index 2ec3f2b..bd93a16 100644 --- a/Scripts/Linux/LinuxScript.py +++ b/Scripts/Linux/LinuxScript.py @@ -1,5 +1,6 @@ import subprocess import subprocess +import shlex class Tools: diff --git a/Scripts/Linux/ScriptyScript.sh b/Scripts/Linux/ScriptyScript.sh new file mode 100644 index 0000000..fdfa4b7 --- /dev/null +++ b/Scripts/Linux/ScriptyScript.sh @@ -0,0 +1,166 @@ +#!/bin/bash + +LOG_FILE="/var/log/cyberpatriot.log" +touch $LOG_FILE +echo "CyberPatriot Script Started: $(date)" >> $LOG_FILE +echo "This script must be run as root" >> $LOG_FILE + +echo "Deleted all media files" >> $LOG_FILE + +find /home -name '*.mp3' -type f -delete + find /home -name '*.mov' -type f -delete + find /home -name '*.mp4' -type f -delete + find /home -name '*.avi' -type f -delete + find /home -name '*.mpg' -type f -delete + find /home -name '*.mpeg' -type f -delete + find /home -name '*.flac' -type f -delete + find /home -name '*.m4a' -type f -delete + find /home -name '*.flv' -type f -delete + find /home -name '*.ogg' -type f -delete + find /home -name '*.gif' -type f -delete + find /home -name '*.png' -type f -delete + find /home -name '*.jpg' -type f -delete + find /home -name '*.mp3' -type f -delete + find /home -name '*.tiff' -type f -delete + +#Remove prohibited Software +echo "removing prohibited software" >> $LOG_FILE +sudo apt remove ophcrack +sudo apt remove wireshark -y +sudo apt-get autoremove -y +sudo apt remove nmap +sudo apt remove nessus +sudo apt remove kismet +sudo apt remove metasploit +sudo apt remove aircrack-ng +sudo apt remove openvas +sudo apt remove sqlmap +sudo apt remove zenmap +sudo apt remove rainbow-crack +sudo apt remove ccleaner + +#Determines critical services +echo "Determining critical services and removing useless ones" >> $LOG_FILE + +#Fun stuff (SHOULD WORK ON BOTH DEBIAN AND UBUNTU) +clear +echo "Cleared command prompt" >> $LOG_FILE +unalias -a +echo "deleted all aliases" >> $LOG_FILE +printTime "All alias have been removed." >>$LOG_FILE + +clear +echo "root account locked" >> $LOG_FILE +usermod -L root +printTime "Root account has been locked. Use 'usermod -U root' to unlock it." + +clear +echo "Modified user privileges for bash history file" >> $LOG_FILE +chmod 640 .bash_history +printTime "Bash history file permissions set." + +clear +echo "Modified user privileges for Shadow files" >> $LOG_FILE +chmod 604 /etc/shadow +printTime "Read/Write permissions on shadow have been set." + +clear +echo "Checked for files and user folders not needed" >> $LOG_FILE +printTime "Check for any user folders that do not belong to any users in /home/." +ls -a /home/ >> $LOG_FILE + +clear +echo "Checked for any files for users that should not be admins" >> $LOG_FILE +printTime "Check for any files for users that should not be administrators in /etc/sudoers.d." +ls -a /etc/sudoers.d >> $LOG_FILE + +#Configuring Sysctl +echo "Configured Sysctl" >> $LOG_FILE +clear +echo > /etc/sysctl.conf +echo -e "# Controls IP packet forwarding\nnet.ipv4.ip_forward = 0\n\n# IP Spoofing protection\nnet.ipv4.conf.all.rp_filter = 1\nnet.ipv4.conf.default.rp_filter = 1\n\n# Ignore ICMP broadcast requests\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\n\n# Disable source packet routing\nnet.ipv4.conf.all.accept_source_route = 0\nnet.ipv6.conf.all.accept_source_route = 0\nnet.ipv4.conf.default.accept_source_route = 0\nnet.ipv6.conf.default.accept_source_route = 0\n\n# Ignore send redirects\nnet.ipv4.conf.all.send_redirects = 0\nnet.ipv4.conf.default.send_redirects = 0\n\n# Block SYN attacks\nnet.ipv4.tcp_syncookies = 1\nnet.ipv4.tcp_max_syn_backlog = 2048\nnet.ipv4.tcp_synack_retries = 2\nnet.ipv4.tcp_syn_retries = 5\n\n# Log Martians\nnet.ipv4.conf.all.log_martians = 1\nnet.ipv4.icmp_ignore_bogus_error_responses = 1\n\n# Ignore ICMP redirects\nnet.ipv4.conf.all.accept_redirects = 0\nnet.ipv6.conf.all.accept_redirects = 0\nnet.ipv4.conf.default.accept_redirects = 0\nnet.ipv6.conf.default.accept_redirects = 0\n\n# Ignore Directed pings\nnet.ipv4.icmp_echo_ignore_all = 1\n\n# Accept Redirects? No, this is not router\nnet.ipv4.conf.all.secure_redirects = 0\n\n# Log packets with impossible addresses to kernel log? yes\nnet.ipv4.conf.default.secure_redirects = 0\n\n########## IPv6 networking start ##############\n# Number of Router Solicitations to send until assuming no routers are present.\n# This is host and not router\nnet.ipv6.conf.default.router_solicitations = 0\n\n# Accept Router Preference in RA?\nnet.ipv6.conf.default.accept_ra_rtr_pref = 0\n\n# Learn Prefix Information in Router Advertisement\nnet.ipv6.conf.default.accept_ra_pinfo = 0\n\n# Setting controls whether the system will accept Hop Limit settings from a router advertisement\nnet.ipv6.conf.default.accept_ra_defrtr = 0\n\n#router advertisements can cause the system to assign a global unicast address to an interface\nnet.ipv6.conf.default.autoconf = 0\n\n#how many neighbor solicitations to send out per address?\nnet.ipv6.conf.default.dad_transmits = 0\n\n# How many global unicast IPv6 addresses can be assigned to each interface? +net.ipv6.conf.default.max_addresses = 1\n\n########## IPv6 networking ends ##############" >> /etc/sysctl.conf +sysctl -p >> /dev/null +printTime "Sysctl has been configured." + +#Decide whether or not to disable IPv6 +echo -e "\n\n# Disable IPv6\nnet.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1\nnet.ipv6.conf.lo.disable_ipv6 = 1" >> /etc/sysctl.conf +sysctl -p >> /dev/null +printTime "IPv6 has been disabled." +echo "IPv6 disapled" >> $LOG_FILE + +#finding and removing backdoors +echo "Fixed and removed backdoors" >> $LOG_FILE +wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.2/rkhunter-1.4.2.tar.gz +tar xfz rkhunter-1.4.2.tar.gz +sudo ./rkhunter-1.4.2/installer.sh --layout default --install +sudo ./rkhunter-1.4.2/installer.sh --layout default --install +sudo /usr/local/bin/rkhunter --update --propupd +sudo /usr/local/bin/rkhunter --check + +#Check for prohibeted software, as well as stops prohibited software from running. +echo "Checked for prohibited software" >> $LOG_FILE +sudo systemctl stop nginx +sudo systemctl disable nginx + +#games +echo "Deleted games" >> $LOG_FILE +sudo apt-get purge -y 0ad 0ad-data 0ad-data-common 2048-qt 3dchess 4digits 7kaa 7kaa-data a7xpg a7xpg-data aajm abe abe-data ace-of-penguins acm adanaxisgpl adanaxisgpl-data adonthell adonthell-data airstrike airstrike-common aisleriot alex4 alex4-data alien-arena alien-arena-data alien-arena-server alienblaster alienblaster-data allure amoebax amoebax-data amphetamine amphetamine-data an anagramarama anagramarama-data angband angband-audio angband-data angrydd animals antigravitaattori ardentryst armagetronad armagetronad-common armagetronad-dedicated asc asc-data asc-music asciijump assaultcube assaultcube-data astromenace astromenace-data-src asylum asylum-data atanks atanks-data atom4 atomix atomix-data attal attal-themes-medieval auralquiz balder2d balder2d-data ballerburg ballz ballz-data ballz-dbg bambam barrage bastet bb bear-factory beneath-a-steel-sky berusky berusky-data berusky2 berusky2-data between billard-gl billard-gl-data biloba biloba-data biniax2 biniax2-data black-box blobandconquer blobandconquer-data blobby blobby-data blobby-server bloboats blobwars blobwars-data blockattack blockout2 blocks-of-the-undead blocks-of-the-undead-data bombardier bomber bomberclone bomberclone-data boswars boswars-data bouncy bovo brainparty brainparty-data briquolo briquolo-data brutalchess bsdgames bsdgames-nonfree btanks btanks-data bubbros bucklespring bucklespring-data bugsquish bumprace bumprace-data burgerspace bve-route-cross-city-south bve-train-br-class-323 bve-train-br-class-323-3dcab bygfoot bygfoot-data bzflag bzflag-client bzflag-data bzflag-server cappuccino caveexpress caveexpress-data cavepacker cavepacker-data cavezofphear ceferino ceferino-data cgoban chessx childsplay childsplay-alphabet-sounds-bg childsplay-alphabet-sounds-ca childsplay-alphabet-sounds-de childsplay-alphabet-sounds-el childsplay-alphabet-sounds-en-gb childsplay-alphabet-sounds-es childsplay-alphabet-sounds-fr childsplay-alphabet-sounds-it childsplay-alphabet-sounds-nb childsplay-alphabet-sounds-nl childsplay-alphabet-sounds-pt childsplay-alphabet-sounds-ro childsplay-alphabet-sounds-ru childsplay-alphabet-sounds-sl childsplay-alphabet-sounds-sv chipw chocolate-common chocolate-doom chromium-bsu chromium-bsu-data circuslinux circuslinux-data colobot colobot-common colobot-common-sounds colobot-common-textures colorcode colossal-cave-adventure connectagram connectagram-data cookietool corsix-th corsix-th-data cowsay cowsay-off crack-attack crafty crafty-bitmaps crafty-books-medium crafty-books-medtosmall crafty-books-small crawl crawl-common crawl-tiles crawl-tiles-data crimson criticalmass criticalmass-data crossfire-client crossfire-client-images crossfire-client-sounds crossfire-common crossfire-maps crossfire-maps crossfire-maps-small crossfire-server crrcsim crrcsim-data csmash csmash-data csmash-demosong cube2 cube2-data cube2-server cultivation curseofwar cutemaze cuyo cuyo-data cyphesis-cpp cyphesis-cpp-clients cyphesis-cpp-mason cytadela cytadela-data d1x-rebirth d2x-rebirth dangen darkplaces darkplaces-server ddnet ddnet-data ddnet-server ddnet-tools dds deal dealer defendguin defendguin-data desmume deutex dhewm3 dhewm3-d3xp dhewm3-doom3 dizzy dodgindiamond2 dolphin-emu dolphin-emu-data doom-wad-shareware doomsday doomsday-common doomsday-data doomsday-server dopewars dopewars-data dossizola dossizola-data drascula drascula-french drascula-german drascula-italian drascula-music drascula-spanish dreamchess dreamchess-data dustracing2d dustracing2d-data dvorak7min dwarf-fortress dwarf-fortress-data eboard eboard-extras-pack1 edgar edgar-data efp einstein el-ixir ember ember-media empire empire-hub empire-lafe endless-sky endless-sky-data endless-sky-high-dpi enemylines3 enemylines7 enigma enigma-data epiphany epiphany-data etoys etqw etqw-server etw etw-data excellent-bifurcation extremetuxracer extremetuxracer-data exult exult-studio ezquake fairymax fb-music-high ffrenzy fgo fgrun fheroes2-pkg filler fillets-ng fillets-ng-data fillets-ng-data-cs fillets-ng-data-nl filters five-or-more fizmo-common fizmo-console fizmo-ncursesw fizmo-sdl2 flare flare-data flare-engine flare-game flight-of-the-amazon-queen flightgear flightgear-data-ai flightgear-data-all flightgear-data-base flightgear-data-models flightgear-phi flobopuyo fltk1.1-games fltk1.3-games foobillardplus foobillardplus-data fortunate.app fortune-anarchism fortune-mod fortune-zh fortunes fortunes-bg fortunes-bofh-excuses fortunes-br fortunes-cs fortunes-de fortunes-debian-hints fortunes-eo fortunes-eo-ascii fortunes-eo-iso3 fortunes-es fortunes-es-off fortunes-fr fortunes-ga fortunes-it fortunes-it-off fortunes-mario fortunes-min fortunes-off fortunes-pl fortunes-ru fortunes-spam fortunes-zh four-in-a-row freealchemist freecell-solver-bin freeciv freeciv-client-extras freeciv-client-gtk freeciv-client-gtk3 freeciv-client-qt freeciv-client-sdl freeciv-data freeciv-server freeciv-sound-standard freecol freedink freedink-data freedink-dfarc freedink-dfarc-dbg freedink-engine freedink-engine-dbg freedm freedoom freedroid freedroid-data freedroidrpg freedroidrpg-data freegish freegish-data freeorion freeorion-data freespace2 freespace2-launcher-wxlauncher freesweep freetennis freetennis-common freevial fretsonfire fretsonfire-game fretsonfire-songs-muldjord fretsonfire-songs-sectoid frogatto frogatto-data frotz frozen-bubble frozen-bubble-data fruit funguloids funguloids-data funnyboat gamazons game-data-packager game-data-packager-runtime gameclock gamine gamine-data garden-of-coloured-lights garden-of-coloured-lights-data gargoyle-free gav gav-themes gbrainy gcompris gearhead gearhead-data gearhead-sdl gearhead2 gearhead2-data gearhead2-sdl geekcode geki2 geki3 gemdropx gemrb gemrb-baldurs-gate gemrb-baldurs-gate-2 gemrb-baldurs-gate-2-data gemrb-baldurs-gate-data gemrb-data gemrb-icewind-dale gemrb-icewind-dale-2 gemrb-icewind-dale-2-data gemrb-icewind-dale-data gemrb-planescape-torment gemrb-planescape-torment-data geneatd gfceu gfpoken gl-117 gl-117-data glaurung glhack glob2 glob2-data glpeces glpeces-data gltron gmchess gmult gnome-2048 gnome-mines gnome-aisleriot gnome-breakout gnome-cards-data gnome-chess gnome-games-app gnome-klotski gnome-mahjongg gnome-mastermind gnome-mines gnome-nibbles gnome-robots gnome-sudoku gnome-tetravex gnubg gnubg-data gnubik gnuboy-sdl gnuboy-x gnuchess gnuchess-book gnudoq gnugo gnujump gnujump-data gnuminishogi gnurobbo gnurobbo-data gnushogi golly gomoku.app gplanarity gpsshogi gpsshogi-data granatier granule gravitation gravitywars greed grhino grhino-data gridlock.app groundhog gsalliere gtans gtkballs gtkboard gtkpool gunroar gunroar-data gweled hachu hannah hannah-data hearse hedgewars hedgewars-data heroes heroes-data heroes-sound-effects heroes-sound-tracks hex-a-hop hex-a-hop-data hexalate hexxagon higan hitori hoichess holdingnuts holdingnuts-server holotz-castle holotz-castle-data holotz-castle-editor hyperrogue hyperrogue-music iagno icebreaker ii-esu infon-server infon-viewer instead instead-data ioquake3 ioquake3-server jag jag-data jester jigzo jigzo-data jmdlx jumpnbump jumpnbump-levels jzip kajongg kanagram kanatest kapman katomic kawari8 kball kball-data kblackbox kblocks kbounce kbreakout kcheckers kdegames-card-data kdegames-card-data-kf5 kdegames-mahjongg-data-kf5 kdiamond ketm ketm-data kfourinline kgoldrunner khangman kigo kiki-the-nano-bot kiki-the-nano-bot-data kildclient killbots kiriki kjumpingcube klickety klines kmahjongg kmines knavalbattle knetwalk knights kobodeluxe kobodeluxe-data kolf kollision komi konquest koules kpat krank kraptor kraptor-data kreversi kshisen ksirk ksnakeduel kspaceduel ksquares ksudoku ktuberling kubrick laby lambdahack late late-data lbreakout2 lbreakout2-data lgc-pg lgeneral lgeneral-data libatlas-cpp-0.6-tools libgemrb libmgba libretro-beetle-pce-fast libretro-beetle-psx libretro-beetle-vb libretro-beetle-wswan libretro-bsnes-mercury-accuracy libretro-bsnes-mercury-balanced libretro-bsnes-mercury-performance libretro-desmume libretro-gambatte libretro-genesisplusgx libretro-mgba libretro-mupen64plus libretro-nestopia libretro-snes9x lierolibre lierolibre-data lightsoff lightyears lincity lincity-ng lincity-ng-data liquidwar liquidwar-data liquidwar-server littlewizard littlewizard-data lmarbles lmemory lolcat londonlaw lordsawar lordsawar-data love lskat ltris lugaru lugaru-data luola luola-data luola-levels luola-nostalgy lure-of-the-temptress macopix-gtk2 madbomber madbomber-data maelstrom magicmaze magicor magicor-data magictouch mah-jong mame mame-data mame-extra manaplus manaplus-data mancala marsshooter marsshooter-data matanza mazeofgalious mazeofgalious-data mednafen mednaffe megaglest megaglest-data meritous meritous-data mgba-common mgba-qt mgba-sdl mgt miceamaze micropolis micropolis-data minetest minetest-data minetest-mod-advspawning minetest-mod-animalmaterials minetest-mod-animals minetest-mod-character-creator minetest-mod-craftguide minetest-mod-homedecor minetest-mod-maidroid minetest-mod-mesecons minetest-mod-mobf minetest-mod-mobf-core minetest-mod-mobf-trap minetest-mod-moreblocks minetest-mod-moreores minetest-mod-nether minetest-mod-pipeworks minetest-mod-player-3d-armor minetest-mod-quartz minetest-mod-torches minetest-mod-unifieddyes minetest-mod-worldedit minetest-server mirrormagic mirrormagic-data mokomaze monopd monsterz monsterz-data moon-buggy moon-lander moon-lander-data moria morris mousetrap mrboom mrrescue mttroff mu-cade mu-cade-data mudlet multitet mupen64plus-audio-all mupen64plus-audio-sdl mupen64plus-data mupen64plus-input-all mupen64plus-input-sdl mupen64plus-qt mupen64plus-rsp-all mupen64plus-rsp-hle mupen64plus-rsp-z64 mupen64plus-ui-console mupen64plus-video-all mupen64plus-video-arachnoid mupen64plus-video-glide64 mupen64plus-video-glide64mk2 mupen64plus-video-rice mupen64plus-video-z64 nestopia nethack-common nethack-console nethack-el nethack-lisp nethack-x11 netmaze netpanzer netpanzer-data netris nettoe neverball neverball-common neverball-data neverputt neverputt-data nexuiz nexuiz-data nexuiz-music nexuiz-server nexuiz-textures nikwi nikwi-data ninix-aya ninvaders njam njam-data noiz2sa noiz2sa-data nsnake nudoku numptyphysics ogamesim ogamesim-www omega-rpg oneisenough oneko onscripter open-adventure open-invaders open-invaders-data openarena openarena-081-maps openarena-081-misc openarena-081-players openarena-081-players-mature openarena-081-textures openarena-085-data openarena-088-data openarena-data openarena-oacmp1 openarena-server openbve-data opencity opencity-data openclonk openclonk-data openlugaru openlugaru-data openmw openmw-cs openmw-data openmw-launcher openpref openssn openssn-data openttd openttd-data openttd-opengfx openttd-openmsx openttd-opensfx opentyrian openyahtzee orbital-eunuchs-sniper orbital-eunuchs-sniper-data osmose-emulator out-of-order overgod overgod-data pachi pachi-data pacman pacman4console palapeli palapeli-data pangzero parsec47 parsec47-data passage pathogen pathological pax-britannica pax-britannica-data pcsx2 pcsxr peg-e peg-solitaire pegsolitaire penguin-command pente pentobi performous performous-tools pescetti petris pgn-extract phalanx phlipple phlipple-data pianobooster picmi pinball pinball-data pinball-dev pingus pingus-data pink-pony pink-pony-data pioneers pioneers-console pioneers-console-data pioneers-data pioneers-metaserver pipenightdreams pipenightdreams-data pipewalker piu-piu pixbros pixfrogger planarity planetblupi planetblupi-common planetblupi-music-midi planetblupi-music-ogg plee-the-bear plee-the-bear-data pokemmo-installer pokerth pokerth-data pokerth-server polygen polygen-data polyglot pong2 powder powermanga powermanga-data pq prboom-plus prboom-plus-game-server primrose projectl purity purity-ng purity-off pybik pybik-bin pybridge pybridge-common pybridge-server pykaraoke pykaraoke-bin pynagram pyracerz pyscrabble pyscrabble-common pyscrabble-server pysiogame pysolfc pysolfc-cardsets pysycache pysycache-buttons-beerabbit pysycache-buttons-crapaud pysycache-buttons-ice pysycache-buttons-wolf pysycache-click-dinosaurs pysycache-click-sea pysycache-dblclick-appleandpear pysycache-dblclick-butterfly pysycache-i18n pysycache-images pysycache-move-animals pysycache-move-food pysycache-move-plants pysycache-move-sky pysycache-move-sports pysycache-puzzle-cartoons pysycache-puzzle-photos pysycache-sounds python-pykaraoke python-renpy qgo qonk qstat qtads quadrapassel quake quake-server quake2 quake2-server quake3 quake3-data quake3-server quake4 quake4-server quakespasm quarry qxw rafkill rafkill-data raincat raincat-data randtype rbdoom3bfg redeclipse redeclipse-common redeclipse-data redeclipse-server reminiscence renpy renpy-demo renpy-thequestion residualvm residualvm-data ri-li ri-li-data ricochet rlvm robocode robotfindskitten rockdodger rocksndiamonds rolldice rott rrootage rrootage-data rtcw rtcw-common rtcw-server runescape salliere sandboxgamemaker sauerbraten sauerbraten-server scid scid-data scid-rating-data scid-spell-data scorched3d scorched3d-data scottfree scummvm scummvm-data scummvm-tools sdl-ball sdl-ball-data seahorse-adventures searchandrescue searchandrescue-common searchandrescue-data sgt-launcher sgt-puzzles shogivar shogivar-data simutrans simutrans-data simutrans-makeobj simutrans-pak128.britain simutrans-pak64 singularity singularity-music sjaakii sjeng sl slashem slashem-common slashem-gtk slashem-sdl slashem-x11 slimevolley slimevolley-data slingshot sludge-engine sm snake4 snowballz solarwolf sopwith spacearyarya spacezero speedpad spellcast sponc spout spring spring-common spring-javaai spring-maps-kernelpanic spring-mods-kernelpanic springlobby starfighter starfighter-data starvoyager starvoyager-data stax steam steam-devices steam-installer steamcmd stockfish stormbaancoureur stormbaancoureur-data sudoku supertransball2 supertransball2-data supertux supertux-data supertuxkart supertuxkart-data swell-foop tagua tagua-data tali tanglet tanglet-data tatan tdfsb tecnoballz tecnoballz-data teeworlds teeworlds-data teeworlds-server tenace tenmado tennix tetrinet-client tetrinet-server tetrinetx tetzle tf tf5 tictactoe-ng tint tintin++ tinymux titanion titanion-data toga2 tomatoes tomatoes-data tome toppler torcs torcs-data torus-trooper torus-trooper-data tourney-manager trackballs trackballs-data transcend treil trigger-rally trigger-rally-data triplane triplea trophy trophy-data trophy-dbg tumiki-fighters tumiki-fighters-data tuxfootball tuxmath tuxmath-data tuxpuck tuxtype tuxtype-data tworld tworld-data typespeed uci2wb ufoai ufoai-common ufoai-data ufoai-maps ufoai-misc ufoai-music ufoai-server ufoai-sound ufoai-textures uhexen2 uhexen2-common uligo unknown-horizons uqm uqm-content uqm-music uqm-russian uqm-voice val-and-rick val-and-rick-data vbaexpress vcmi vectoroids viruskiller visualboyadvance vodovod vor warmux warmux-data warmux-servers warzone2100 warzone2100-data warzone2100-music werewolf wesnoth wesnoth-1.12 wesnoth-1.12-aoi wesnoth-1.12-core wesnoth-1.12-data wesnoth-1.12-did wesnoth-1.12-dm wesnoth-1.12-dw wesnoth-1.12-ei wesnoth-1.12-httt wesnoth-1.12-l wesnoth-1.12-low wesnoth-1.12-music wesnoth-1.12-nr wesnoth-1.12-server wesnoth-1.12-sof wesnoth-1.12-sotbe wesnoth-1.12-thot wesnoth-1.12-tools wesnoth-1.12-trow wesnoth-1.12-tsg wesnoth-1.12-ttb wesnoth-1.12-utbs wesnoth-core wesnoth-music wfut whichwayisup widelands widelands-data wing wing-data wizznic wizznic-data wmpuzzle wolf4sdl wordplay wordwarvi wordwarvi-sound xabacus xabacus xball xbill xblast-tnt xblast-tnt-images xblast-tnt-levels xblast-tnt-models xblast-tnt-musics xblast-tnt-sounds xboard xbomb xbubble xbubble-data xchain xcowsay xdemineur xdesktopwaves xevil xfireworks xfishtank xflip xfrisk xgalaga xgalaga++ xgammon xinv3d xjig xjokes xjump xletters xmabacus xmahjongg xmille xmoto xmoto-data xmountains xmpuzzles xonix xpat2 xpenguins xphoon xpilot-extra xpilot-ng xpilot-ng-client-sdl xpilot-ng-client-x11 xpilot-ng-common xpilot-ng-server xpilot-ng-utils xpuzzles xqf xracer xracer-tools xscavenger xscorch xscreensaver-screensaver-dizzy xshisen xshogi xskat xsok xsol xsoldier xstarfish xsystem35 xteddy xtron xvier xwelltris xye xye-data xzip yahtzeesharp yamagi-quake2 yamagi-quake2-core zangband zangband-data zatacka zaz zaz-data zec zivot zoom-player gameconqueror + +# Enable firewall + +#installs firewall +sudo apt install ufw + +#gives firewall status +sudo ufw status verbose +sudo ufw status >> $LOG_FILE + +#configures settings +sudo ufw default deny incoming +sudo ufw enable + +#allows services +sudo ufw allow ssh +sudo ufw allow 4422/tcp + +#denies specific ports +enable #firewall on +sudo ufw deny 23 #block Telnet +sudo ufw deny 515 #block printer port +sudo ufw allow log 22/tcp +sudo ufw allow 139 +sudo ufw allow 445 +sudo ufw allow 137 +sudo ufw allow 138 +sudo ufw deny 21 +sudo ufw deny cups + +#disables these two services +sudo apt-get purge -y cups +sudo apt-get purge -y bluetooth + +echo "Firewall enabled and setup" >> $LOG_FILE + +#start Open SSH at boot +sudo update-rc.d ssh enable +/etc/rc3.d/ +echo "SSH Starts at boot" >> $LOG_FILE + +#stop services +sudo systemctl stop httpd +sudo systemctl stop apache2 +sudo systemctl stop nginx +sudo systemctl disable nginx +sudo systemctl purge apache2 +echo "Stopped httpd, apache2, nginx" >> $LOG_FILE + +#Disabling root login +sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config +sudo sed -i 's/nullok/ /g' /etc/pam.d/common_auth + +echo "System updated and upgraded" >>$LOG_FILE +#updates system + sudo apt update + sudo apt upgrade + sudo reboot \ No newline at end of file diff --git a/Scripts/Linux/b64decode.py b/Scripts/Linux/b64decode.py new file mode 100644 index 0000000..2a1bad3 --- /dev/null +++ b/Scripts/Linux/b64decode.py @@ -0,0 +1,2 @@ +import base64 + diff --git a/Scripts/Linux/script.py b/Scripts/Linux/script.py new file mode 100644 index 0000000..d840767 --- /dev/null +++ b/Scripts/Linux/script.py @@ -0,0 +1,144 @@ +# script + +from subprocess import run +# errorCheck +fail = [] + +# disable guest +try : + run(["sudo", "usermod", "--expiredate", "1", "guest"]) +except: + fail.append("couldn't dissable guest") + + +# update system and apps +try: + run(["sudo", "apt", "update"]) + run(["sudo", "apt", "upgrade"]) + run(["sudo", "apt", "full-upgrade"]) + run(["sudo", "apt", "autoremove"]) +except: + fail.append("couldn't update system/apps") + + +# Install Security tools +try: + run(["sudo", "apt-get", "ufw"]) + run(["sudo", "enable", "ufw"]) +except: + fail.append("couldn't enable ufw") + +try: + run(["sudo", "apt", "update", "&&", "sudo", "apt", "Upgrade", "-y"]) + run(["sudo", "apt-get", "install", "openssh-server"]) + run(["sudo", "apt-get", "update", "-y"]) + run(["sudo", "apt-get", "install", "y-", "bum"]) +except: + fail.append("couldn't install security tools") + + +# disable ctrl+alt+delete +try: + run(["sudo", "sed", "-i", "/^exec uim-systray/a Exec=/bin/false", "/etc/lightdm/lightdm.conf", ]) +except: + fail.append("couldn't dissable ctrl+alt+delete") + +# Password complexity requirement. +# remove wireshark if its installed (User is responsible for figuring out if wireshark exists.) +try: + WireSharkRemove = input("Does wireshark exist and need to be deleted? y/n: ") + if (WireSharkRemove == "y" or WireSharkRemove == "Y"): + run(["sudo", "apt-get", "remove", "--purge", "wireshark"]) + run(["sudo", "apt-get", "autoremove"]) +except: + fail.append("couldn't delete wireshark") + +# update firefox +try: + FoxUpdate = input("Does FireFox need updated? y/n: ") + if (FoxUpdate == "y" or FoxUpdate == "Y"): + run(["sudo", "apt", "install", "firefox"]) +except: + fail.append("failed to update firefox") + +# SSH +try: + sshEnable = input("Does ssh need enabled? y/n: ") + if (sshEnable == "y" or sshEnable == "Y"): + run(["sudo", "systemctl", "enable", "ssh"]) + run(["sudo", "systemctl", "start", "ssh"]) + sshEnable = input("Does ssh need disabled? y/n: "): + if (sshEnable == "y" or sshEnable == "Y"): + run(["sudo", "systemctl", "stop", "ssh"]) + run(["sudo", "systemctl", "disable", "ssh"]) +except: + fail.append("couldn't enable ssh") + + +# change minimum password age +# change min password length + +# update insecure passwords +try: + usrPswdUpdt = input("Are there any users who need their password updated y/n: ") + if (usrPswdUpdt == "y" or usrPswdUpdt == "Y"): + UsrCount = int(input(" how many users need their password changed? : ")) + for count in range(1 , UsrCount + 1): + try: + UsrNme = input("Who needs their password changed? Name is caps specific. :") + run(["sudo", "passwd", UsrNme]) + except: + fail.append("unable to change "+UsrNme+"'s password") +except: + fail.append("Failed to update passwords") + + +# groups +try: + groups = input("do we need to make any groups? y/n:") + if (groups == "y" or groups == "Y"): + newGroupName = input("What is the new groups name?: ") + newGroupQuan = input("How many people are in the group?: ") + run(["sudo", "groupadd", newGroupName]) + for num in range(1 , int(newGroupQuan) + 1): + newGroupMember = input("Who is being added to the group? Please enter one user at a time: ") + run(["sudo", "usermod", "-a", "-g", newGroupName, newGroupMember]) +except: + fail.append("Failed to add groups or users") + +try: + groups = input("do you need to add anyone to a group that already exists? y/n: ") + if (groups == "y" or groups == "Y"): + groupname = input("What is the groups name?: ") + groupnum = input("How many people are being added?: ") + for count in range(1 , int(groupnum) + 1): + groupmem = input("Who is being added to the group? One user at a time.: ") + run(["sudo", "usermod", "-a", "-g", groupname, groupmem]) +except: + fail.append("Failed to add members") + + +# delete users +try: + deluser = input("Are there any users who need to be removed from the computer? y/n: ") + if (deluser == "y" or deluser == "Y"): + delusercount = int(input("How many users need deleted?: ")) + for number in range(1 , delusercount + 1): + delusername = input("What is the name of the account being deleted? Use one name at a time.: ") + run(["sudo", "userdel", delusername]) +except: + fail.append("Failed to delete users") + + +# add new users +try: + useradd = input("do you need to add any users? y/n: ") + if (useradd == "y" or useradd == "Y"): + newUserCount = int(input("How many users do you need to add?: ")) + for all in range(1 , newUserCount + 1): + newUserName = input("What is the name of the new user?: ") + run(["sudo", "useradd", newUserName]) +except: + fail.append("Failed to add new Users") + +print(fail) diff --git a/Scripts/Windows/MasterScriptStuff/Firewall/FirewallRules.psm1 b/Scripts/Windows/MasterScriptStuff/Firewall/FirewallRules.psm1 new file mode 100644 index 0000000..271d4f3 --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/Firewall/FirewallRules.psm1 @@ -0,0 +1,467 @@ +function set-FirewallRule { + #Firewall script +#Disable every pre-existing rule +Set-NetFirewallRule * -Enabled False -Action NotConfigured + +#Block multiple Windows features by pre-existing rules +Set-NetFirewallRule -DisplayGroup "AllJoyn Router","*BranchCache*","Cast to Device functionality","Connect","Cortana","Delivery Optimization","DIAL protocol server","Feedback Hub","File and Printer Sharing","Get Office","Groove Music","HomeGroup","iSCSI Service","mDNS","Media Center Extenders","Microsoft Edge","Microsoft Photos","Microsoft Solitaire Collection","Movies & TV","MSN Weather","Network Discovery","OneNote","*Wi-Fi*","Paint 3D","Proximity Sharing","*Remote*","Secure Socket Tunneling Protocol","*Skype*","SNMP Trap","Store","*Smart Card*","Virtual Machine Monitoring","Windows Collaboration Computer Name Registration Service","*Windows Media Player*","Windows Peer to Peer Collaboration Foundation","Windows View 3D Preview","*Wireless*","*WFD*","*Xbox*","3D Builder","Captive Portal Flow","Take a Test","Wallet" -Action Block -Enabled True -Profile Any + +#Block multiple insecure protocols by pre-existing rules +Set-NetFirewallRule -DisplayName "*IPv6*","*ICMP*","*SMB*","*UPnP*","*FTP*","*Telnet*" -Action Block -Enabled True -Profile Any + +#Block multiple ports with new rule +New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 20-21 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 22 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 23 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "HTTP" -LocalPort 80 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "TorPark onion routing" -LocalPort 81 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "TorPark control" -LocalPort 82 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "RTelnet" -LocalPort 107 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "RTelnet" -LocalPort 107 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "DHCPv6" -LocalPort 546-547 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "DHCPv6" -LocalPort 546-547 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Flash" -LocalPort 843 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "B.net (Free HK)" -LocalPort 1119 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "B.net (Free HK)" -LocalPort 1119 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Kazaa" -LocalPort 1214 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Kazaa" -LocalPort 1214 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "WASTE" -LocalPort 1337 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Civ" -LocalPort 1492 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Garena" -LocalPort 1513 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Garena" -LocalPort 1513 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "iSketch" -LocalPort 1626-1627 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Defunct RADIUS Ports" -LocalPort 1645-1646 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Windward" -LocalPort 1707 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Windward" -LocalPort 1707 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "America's Army" -LocalPort 1716 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Microsoft Media Services" -LocalPort 1755 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Microsoft Media Services" -LocalPort 1755 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "SSDP" -LocalPort 1900 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Macro Flash" -LocalPort 1935 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Macro Flash" -LocalPort 1935 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Netop" -LocalPort 1970 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Netop" -LocalPort 1970 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Civ 4" -LocalPort 2033 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Civ 4" -LocalPort 2033 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Warzone 2100" -LocalPort 2100 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Apple Notifs" -LocalPort 2195 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Apple Notifs Feedback" -LocalPort 2196 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "ArmA/Halo" -LocalPort 2302-2305 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "AIM/Ghost" -LocalPort 2351-2368 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Ultima Online" -LocalPort 2593 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Ultima Online" -LocalPort 2593 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Ultima Online 2" -LocalPort 2599 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Ultima Online 2" -LocalPort 2599 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "iSync" -LocalPort 3004 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Xbox LIVE" -LocalPort 3074 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Xbox LIVE" -LocalPort 3074 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "iSCSI" -LocalPort 3260 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "iSCSI" -LocalPort 3260 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "RDP" -LocalPort 3389 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "RDP" -LocalPort 3389 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "PlayStation" -LocalPort 3479-3480 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "PlayStation" -LocalPort 3479-3480 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Cyc" -LocalPort 3645 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Cyc" -LocalPort 3645 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BF4" -LocalPort 3659 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Blizzard games/Club Penguin" -LocalPort 3724 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Blizzard games/Club Penguin" -LocalPort 3724 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "WarMUX" -LocalPort 3826 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "WarMUX" -LocalPort 3826 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Warframe" -LocalPort 3960 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Warframe again" -LocalPort 3962 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "OpenTTD" -LocalPort 3978-3979 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "OpenTTD" -LocalPort 3978-3979 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Diablo 2" -LocalPort 4000 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Diablo 2" -LocalPort 4000 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Microsoft Ants" -LocalPort 4001 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Amazon Echo" -LocalPort 4070 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Amazon Echo" -LocalPort 4070 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Microsoft Remote Web Workplace admin" -LocalPort 4125 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Apprentice" -LocalPort 4747 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Many things" -LocalPort 5000 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Many things" -LocalPort 5000 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "LoL" -LocalPort 5000-5500 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Neverwinter Nights" -LocalPort 5121 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Apple Notif 2" -LocalPort 5223 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Outlaws" -LocalPort 5310 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "PostgreSQL" -LocalPort 5432 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Freeciv" -LocalPort 5556 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Freeciv" -LocalPort 5556 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "TeamViewer" -LocalPort 5938 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "TeamViewer" -LocalPort 5938 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "More b.net/CP 2 (Free HK)" -LocalPort 6112 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "More b.net/CP 2 (Free HK)" -LocalPort 6112 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "B.net/Club penguin 3" -LocalPort 6113 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6881-6887 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6881-6887 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6888 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6888 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6889-6900 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6889-6900 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Windows Live Messenger" -LocalPort 6891-6900 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Windows Live Messenger" -LocalPort 6891-6900 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6901 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6901 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6902-6968 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6902-6968 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "BitTorrent tracker" -LocalPort 6969 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "HTTP Bittorrent" -LocalPort 7000 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Enemy Territory: Quake Wars" -LocalPort 7133 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Tibia" -LocalPort 7171 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "WatchMe" -LocalPort 7272 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "WatchMe" -LocalPort 7272 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Rise: The Vieneo Province" -LocalPort 7473 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Saratoga FTP" -LocalPort 7542 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Saratoga FTP" -LocalPort 7542 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 7707-7708 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 7717 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Just Cause 2, Terraria, GTA:SA" -LocalPort 7777 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Just Cause 2, Terraria, GTA:SA" -LocalPort 7777 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Unreal Tournament" -LocalPort 7777-7788 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Unreal Tournament" -LocalPort 7777-7788 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 8075 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "MapleStory" -LocalPort 8484 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "QBittorrent" -LocalPort 9000 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Tor" -LocalPort 9030 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Tor" -LocalPort 9050-9051 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Clash of Clans" -LocalPort 9339 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Club Penguin" -LocalPort 9875 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "CrossFire" -LocalPort 10009 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "CrossFire" -LocalPort 10009 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Touhou" -LocalPort 10080 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Lock On: Modern Air Combat" -LocalPort 10308 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Lock On: Modern Air Combat" -LocalPort 10308 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "SWAT 4" -LocalPort 10480 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "SWAT 4" -LocalPort 10480 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Farming Simulator 2011" -LocalPort 10823 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Savage: Battle for Newerth" -LocalPort 11235 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Savage: Battle for Newerth" -LocalPort 11235 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "OpenRCT2" -LocalPort 11753 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 12012-12013 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 12012-12013 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Second Life" -LocalPort 12035 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Second Life" -LocalPort 12043 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Second Life" -LocalPort 12046 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Cube World" -LocalPort 12345 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Cube World" -LocalPort 12345 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Second Life" -LocalPort 13000-13050 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "CrossFire (again)" -LocalPort 13008 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "CrossFire (again)" -LocalPort 13008 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Battlefield 1942" -LocalPort 14567 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Battlefield Vietnam" -LocalPort 15567 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "XPilot" -LocalPort 15345 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "XPilot" -LocalPort 15345 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Project Zomboid" -LocalPort 16261 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Project Zomboid" -LocalPort 16261 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Battlefield 2" -LocalPort 16567 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Worms" -LocalPort 17011 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Monero P2P" -LocalPort 18080 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18200 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18200 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18201 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18201 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18206 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18206 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18300-18301 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18300-18301 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18306 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18306 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Bitcoin" -LocalPort 18333 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18400-18401 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18400-18401 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18505-18506 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18505-18506 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "X-BEAT" -LocalPort 18605-18606 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "X-BEAT" -LocalPort 18605-18606 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Minecraft: Bedrock Edition" -LocalPort 19132-19133 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 20560 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 20560 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "0 A.D. Empires Ascendant" -LocalPort 20595 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Duke Nukem 3D" -LocalPort 23513 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Duke Nukem 3D" -LocalPort 23513 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "StepMania: Online: DDR" -LocalPort 24842 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "StepMania: Online: DDR" -LocalPort 24842 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Minecraft" -LocalPort 25565 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Minecraft" -LocalPort 25565 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Minecraft" -LocalPort 25575 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Quake, EVE Online, Xonotic" -LocalPort 26000 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Quake, EVE Online, Xonotic" -LocalPort 26000 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "EVE Online" -LocalPort 26900-26901 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "QuakeWorld" -LocalPort 27000-27006 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27000-27015 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Unturned" -LocalPort 27015-27018 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27015-27030 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27015-27030 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Magicka" -LocalPort 27016 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Magicka" -LocalPort 27016 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27031 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27036-27037 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27036-27037 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "QuakeWorld" -LocalPort 27500-27900 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Quake II" -LocalPort 27901-27910 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "OpenArena" -LocalPort 27950 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Enemy Territoy, Quake III, Quake Live" -LocalPort 27960-27969 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Starsiege: Tribes" -LocalPort 28001 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Starsiege: Tribes" -LocalPort 28001 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Rust" -LocalPort 28015 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "AssaultCube Reloaded" -LocalPort 28770-28771 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Cube 2: Sauerbraten" -LocalPort 28785-28786 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 28852 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 28852 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 28910 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 28910 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Call of Duty" -LocalPort 28960 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Call of Duty" -LocalPort 28960 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Perfect World" -LocalPort 29000 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Perfect World" -LocalPort 29000 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Jedi Knight" -LocalPort 29070 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Jedi Knight" -LocalPort 29070 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 29900-29901 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 29900-29901 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 29920 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 29920 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "TetriNET" -LocalPort 31457 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Ace of Spades" -LocalPort 32887 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Infestation: Survivor Stories" -LocalPort 34000 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Factorio" -LocalPort 34197 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Runescape" -LocalPort 43594-43595 -Protocol TCP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Runescape" -LocalPort 43594-43595 -Protocol UDP -Action Block -Enabled True -Direction Inbound +New-NetFirewallRule -DisplayName "Mu Online" -LocalPort 44405 -Protocol TCP -Action Block -Enabled True -Direction Inbound + +New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 20-21 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 22 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 23 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "HTTP" -LocalPort 80 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "TorPark onion routing" -LocalPort 81 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "TorPark control" -LocalPort 82 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "RTelnet" -LocalPort 107 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "RTelnet" -LocalPort 107 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "DHCPv6" -LocalPort 546-547 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "DHCPv6" -LocalPort 546-547 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Flash" -LocalPort 843 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "B.net (Free HK)" -LocalPort 1119 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "B.net (Free HK)" -LocalPort 1119 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Kazaa" -LocalPort 1214 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Kazaa" -LocalPort 1214 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "WASTE" -LocalPort 1337 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Civ" -LocalPort 1492 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Garena" -LocalPort 1513 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Garena" -LocalPort 1513 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "iSketch" -LocalPort 1626-1627 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Defunct RADIUS Ports" -LocalPort 1645-1646 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Windward" -LocalPort 1707 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Windward" -LocalPort 1707 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "America's Army" -LocalPort 1716 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Microsoft Media Services" -LocalPort 1755 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Microsoft Media Services" -LocalPort 1755 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "SSDP" -LocalPort 1900 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Macro Flash" -LocalPort 1935 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Macro Flash" -LocalPort 1935 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Netop" -LocalPort 1970 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Netop" -LocalPort 1970 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Civ 4" -LocalPort 2033 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Civ 4" -LocalPort 2033 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Warzone 2100" -LocalPort 2100 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Apple Notifs" -LocalPort 2195 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Apple Notifs Feedback" -LocalPort 2196 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "ArmA/Halo" -LocalPort 2302-2305 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "AIM/Ghost" -LocalPort 2351-2368 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Ultima Online" -LocalPort 2593 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Ultima Online" -LocalPort 2593 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Ultima Online 2" -LocalPort 2599 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Ultima Online 2" -LocalPort 2599 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "iSync" -LocalPort 3004 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Xbox LIVE" -LocalPort 3074 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Xbox LIVE" -LocalPort 3074 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "iSCSI" -LocalPort 3260 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "iSCSI" -LocalPort 3260 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "RDP" -LocalPort 3389 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "RDP" -LocalPort 3389 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "PlayStation" -LocalPort 3479-3480 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "PlayStation" -LocalPort 3479-3480 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Cyc" -LocalPort 3645 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Cyc" -LocalPort 3645 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BF4" -LocalPort 3659 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Blizzard games/Club Penguin" -LocalPort 3724 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Blizzard games/Club Penguin" -LocalPort 3724 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "WarMUX" -LocalPort 3826 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "WarMUX" -LocalPort 3826 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Warframe" -LocalPort 3960 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Warframe again" -LocalPort 3962 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "OpenTTD" -LocalPort 3978-3979 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "OpenTTD" -LocalPort 3978-3979 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Diablo 2" -LocalPort 4000 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Diablo 2" -LocalPort 4000 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Microsoft Ants" -LocalPort 4001 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Amazon Echo" -LocalPort 4070 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Amazon Echo" -LocalPort 4070 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Microsoft Remote Web Workplace admin" -LocalPort 4125 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Apprentice" -LocalPort 4747 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Many things" -LocalPort 5000 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Many things" -LocalPort 5000 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "LoL" -LocalPort 5000-5500 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Neverwinter Nights" -LocalPort 5121 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Apple Notif 2" -LocalPort 5223 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Outlaws" -LocalPort 5310 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "PostgreSQL" -LocalPort 5432 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Freeciv" -LocalPort 5556 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Freeciv" -LocalPort 5556 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "TeamViewer" -LocalPort 5938 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "TeamViewer" -LocalPort 5938 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "More b.net/CP 2 (Free HK)" -LocalPort 6112 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "More b.net/CP 2 (Free HK)" -LocalPort 6112 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "B.net/Club penguin 3" -LocalPort 6113 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6881-6887 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6881-6887 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6888 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6888 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6889-6900 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6889-6900 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Windows Live Messenger" -LocalPort 6891-6900 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Windows Live Messenger" -LocalPort 6891-6900 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6901 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6901 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6902-6968 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6902-6968 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "BitTorrent tracker" -LocalPort 6969 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "HTTP Bittorrent" -LocalPort 7000 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Enemy Territory: Quake Wars" -LocalPort 7133 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Tibia" -LocalPort 7171 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "WatchMe" -LocalPort 7272 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "WatchMe" -LocalPort 7272 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Rise: The Vieneo Province" -LocalPort 7473 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Saratoga FTP" -LocalPort 7542 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Saratoga FTP" -LocalPort 7542 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 7707-7708 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 7717 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Just Cause 2, Terraria, GTA:SA" -LocalPort 7777 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Just Cause 2, Terraria, GTA:SA" -LocalPort 7777 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Unreal Tournament" -LocalPort 7777-7788 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Unreal Tournament" -LocalPort 7777-7788 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 8075 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "MapleStory" -LocalPort 8484 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "QBittorrent" -LocalPort 9000 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Tor" -LocalPort 9030 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Tor" -LocalPort 9050-9051 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Clash of Clans" -LocalPort 9339 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Club Penguin" -LocalPort 9875 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "CrossFire" -LocalPort 10009 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "CrossFire" -LocalPort 10009 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Touhou" -LocalPort 10080 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Lock On: Modern Air Combat" -LocalPort 10308 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Lock On: Modern Air Combat" -LocalPort 10308 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "SWAT 4" -LocalPort 10480 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "SWAT 4" -LocalPort 10480 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Farming Simulator 2011" -LocalPort 10823 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Savage: Battle for Newerth" -LocalPort 11235 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Savage: Battle for Newerth" -LocalPort 11235 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "OpenRCT2" -LocalPort 11753 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 12012-12013 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 12012-12013 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Second Life" -LocalPort 12035 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Second Life" -LocalPort 12043 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Second Life" -LocalPort 12046 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Cube World" -LocalPort 12345 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Cube World" -LocalPort 12345 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Second Life" -LocalPort 13000-13050 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "CrossFire (again)" -LocalPort 13008 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "CrossFire (again)" -LocalPort 13008 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Battlefield 1942" -LocalPort 14567 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Battlefield Vietnam" -LocalPort 15567 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "XPilot" -LocalPort 15345 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "XPilot" -LocalPort 15345 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Project Zomboid" -LocalPort 16261 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Project Zomboid" -LocalPort 16261 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Battlefield 2" -LocalPort 16567 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Worms" -LocalPort 17011 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Monero P2P" -LocalPort 18080 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18200 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18200 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18201 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18201 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18206 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18206 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18300-18301 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18300-18301 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18306 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18306 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Bitcoin" -LocalPort 18333 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18400-18401 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18400-18401 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18505-18506 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Audition Online Dance Battle" -LocalPort 18505-18506 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "X-BEAT" -LocalPort 18605-18606 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "X-BEAT" -LocalPort 18605-18606 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Minecraft: Bedrock Edition" -LocalPort 19132-19133 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 20560 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 20560 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "0 A.D. Empires Ascendant" -LocalPort 20595 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Duke Nukem 3D" -LocalPort 23513 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Duke Nukem 3D" -LocalPort 23513 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "StepMania: Online: DDR" -LocalPort 24842 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "StepMania: Online: DDR" -LocalPort 24842 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Minecraft" -LocalPort 25565 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Minecraft" -LocalPort 25565 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Minecraft" -LocalPort 25575 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Quake, EVE Online, Xonotic" -LocalPort 26000 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Quake, EVE Online, Xonotic" -LocalPort 26000 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "EVE Online" -LocalPort 26900-26901 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "QuakeWorld" -LocalPort 27000-27006 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27000-27015 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Unturned" -LocalPort 27015-27018 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27015-27030 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27015-27030 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Magicka" -LocalPort 27016 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Magicka" -LocalPort 27016 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27031 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27036-27037 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Steam" -LocalPort 27036-27037 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "QuakeWorld" -LocalPort 27500-27900 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Quake II" -LocalPort 27901-27910 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "OpenArena" -LocalPort 27950 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Enemy Territoy, Quake III, Quake Live" -LocalPort 27960-27969 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Starsiege: Tribes" -LocalPort 28001 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Starsiege: Tribes" -LocalPort 28001 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Rust" -LocalPort 28015 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "AssaultCube Reloaded" -LocalPort 28770-28771 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Cube 2: Sauerbraten" -LocalPort 28785-28786 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 28852 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Killing Floor" -LocalPort 28852 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 28910 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 28910 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Call of Duty" -LocalPort 28960 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Call of Duty" -LocalPort 28960 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Perfect World" -LocalPort 29000 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Perfect World" -LocalPort 29000 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Jedi Knight" -LocalPort 29070 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Jedi Knight" -LocalPort 29070 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 29900-29901 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 29900-29901 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 29920 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Nintendo Wi-Fi" -LocalPort 29920 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "TetriNET" -LocalPort 31457 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Ace of Spades" -LocalPort 32887 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Infestation: Survivor Stories" -LocalPort 34000 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Factorio" -LocalPort 34197 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Runescape" -LocalPort 43594-43595 -Protocol TCP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Runescape" -LocalPort 43594-43595 -Protocol UDP -Action Block -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "Mu Online" -LocalPort 44405 -Protocol TCP -Action Block -Enabled True -Direction Outbound + +#Block multiple protocols with new rule +New-NetFirewallRule -DisplayName "ICMPv4" -Protocol ICMPv4 -Action Block -Enabled True -Direction Inbound -Profile Any +New-NetFirewallRule -DisplayName "ICMPv4" -Protocol ICMPv4 -Action Block -Enabled True -Direction Outbound -Profile Any +New-NetFirewallRule -DisplayName "ICMPv6" -Protocol ICMPv6 -Action Block -Enabled True -Direction Inbound -Profile Any +New-NetFirewallRule -DisplayName "ICMPv6" -Protocol ICMPv6 -Action Block -Enabled True -Direction Outbound -Profile Any + +#Allow multiple ports with new rule +New-NetFirewallRule -DisplayName "HTTPS" -LocalPort 443 -Protocol TCP -Action Allow -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "NTP" -LocalPort 123 -Protocol UDP -Action Allow -Enabled True -Direction Outbound +New-NetFirewallRule -DisplayName "NTP" -LocalPort 123 -Protocol UDP -Action Allow -Enabled True -Direction Inbound + +#Allow multiple features with pre-existing rules +Set-NetFirewallRule -DisplayName "*Defender*" -Enabled True -Action Allow -Profile Any + +} + +Export-ModuleMember -Function set-FirewallRule \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/Firewall/FirewallUp.psm1 b/Scripts/Windows/MasterScriptStuff/Firewall/FirewallUp.psm1 new file mode 100644 index 0000000..03bf68d --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/Firewall/FirewallUp.psm1 @@ -0,0 +1,22 @@ +Function set-Firewall { + #make sure firewall service is running and configurable + Set-Service -name MpsSvc -StartupType Automatic -Status Running + + #Enable the entire firewall + Set-NetFirewallProfile -Name Domain, Public, Private -Enabled True + + #Set direction defaults + Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow + + #Settings for profiles + Set-NetFirewallProfile -Name Domain, Private, Public -NotifyOnListen False + + #Unique Settings for Public + Set-NetFirewallProfile -Name Public -AllowLocalFirewallRules False -AllowLocalIPsecRules False + + #Logging for Domain, Private, and Public + Set-NetFirewallProfile -Name Domain, Private, Public -LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log -LogMaxSizeKilobytes 16384 -LogBlocked True -LogAllowed True + +} + +Export-ModuleMember -Function set-Firewall \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/Log/Log.psm1 b/Scripts/Windows/MasterScriptStuff/Log/Log.psm1 new file mode 100644 index 0000000..7d5cbdd --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/Log/Log.psm1 @@ -0,0 +1,9 @@ +Function log { + param( + [Parameter(Mandatory=$true)] + [string]$message + ) + Write-Host $message +} + +Export-ModuleMember -Function log \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/MasterScript-Combined.ps1 b/Scripts/Windows/MasterScriptStuff/MasterScript-Combined.ps1 new file mode 100644 index 0000000..e0d4399 --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/MasterScript-Combined.ps1 @@ -0,0 +1,706 @@ +<# +MasterScript-Combined.ps1 +Combined version of MasterScript and its modules. This script inlines the module functions so it can be run as a single file. +Run on Windows PowerShell (run as Administrator). +#> +#region Helpers + +# Command-line switches: use these to run subsets of the script. +param( + [switch]$RunAll, + [switch]$RunFirewall, + [switch]$RunSecPol, + [switch]$RunServices, + [switch]$RunSSH, + [switch]$RunTasks, + [switch]$DisableSAMEnumeration, + [switch]$EnableSAMEnumeration, + [switch]$ScanUsers, + [switch]$SyncUsers, + [string]$UsersSourceUrl = '', + [switch]$WhatIf +) + +#region Helpers +function log { + param( + [Parameter(Mandatory=$true)] + [string]$message + ) + Write-Host $message +} + +function Invoke-Action { + param( + [Parameter(Mandatory=$true)][string]$Description, + [Parameter(Mandatory=$true)][scriptblock]$Action + ) + + if ($WhatIf) { + log "[WhatIf] $Description" + return + } + + try { + log "Starting: $Description" + & $Action + log "Completed: $Description" + } catch { + log "Error during $Description: $_" + } +} + +#endregion + +#region SAM enumeration +function Set-SAMEnumeration { + param( + [Parameter(Mandatory=$true)][bool]$Disable + ) + + $regPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' + $props = @{ + 'RestrictAnonymous' = ($(if ($Disable) {1} else {0})) + 'RestrictAnonymousSAM' = ($(if ($Disable) {1} else {0})) + } + + foreach ($name in $props.Keys) { + $value = $props[$name] + try { + if (Get-ItemProperty -Path $regPath -Name $name -ErrorAction SilentlyContinue) { + Set-ItemProperty -Path $regPath -Name $name -Value $value -ErrorAction Stop + } else { + New-ItemProperty -Path $regPath -Name $name -Value $value -PropertyType DWord -ErrorAction Stop | Out-Null + } + log "Set registry $regPath\$name to $value" + } catch { + log "Failed to set $name in $regPath: $_" + } + } +} +#endregion + +#region Scan user directories for all files +function Scan-UserFiles { + param( + [string]$OutputFile = $(Join-Path -Path ([Environment]::GetFolderPath('Desktop')) -ChildPath 'user_file_paths.txt'), + [string]$ErrorsFile = $(Join-Path -Path ([Environment]::GetFolderPath('Desktop')) -ChildPath 'user_file_paths_errors.txt') + ) + + $roots = @() + if ($IsWindows) { + $roots += 'C:\Users' + } else { + # macOS / Linux + $roots += '/Users' + } + + # Prepare output files + try { Remove-Item -Path $OutputFile -ErrorAction SilentlyContinue } catch { } + try { Remove-Item -Path $ErrorsFile -ErrorAction SilentlyContinue } catch { } + + foreach ($root in $roots) { + if (-not (Test-Path $root)) { + "$root not found" | Out-File -FilePath $ErrorsFile -Encoding utf8 -Append + continue + } + + # Use Get-ChildItem and capture non-terminating errors in $errs + $errs = $null + try { + Get-ChildItem -Path $root -File -Recurse -ErrorAction SilentlyContinue -ErrorVariable errs | ForEach-Object { + $_.FullName + } | Out-File -FilePath $OutputFile -Encoding utf8 -Append + } catch { + "Error scanning $root: $_" | Out-File -FilePath $ErrorsFile -Encoding utf8 -Append + } + + if ($errs) { + $errs | ForEach-Object { + "[$($_.CategoryInfo.Category)] $($_.Exception.Message) --> $($_.CategoryInfo.TargetName)" + } | Out-File -FilePath $ErrorsFile -Encoding utf8 -Append + } + } + + # Report counts + try { + $count = (Get-Content -Path $OutputFile -ErrorAction SilentlyContinue | Measure-Object -Line).Lines + log "Scan complete. Files found: $count. Output: $OutputFile. Errors (if any): $ErrorsFile" + } catch { + log "Scan complete. Output: $OutputFile. Errors (if any): $ErrorsFile" + } +} +#endregion + +#region Sync users from remote source +function Fetch-UserDefinitionsFromUrl { + param( + [Parameter(Mandatory=$true)][string]$Url + ) + + $defs = @{} + try { + log "Fetching user definitions from $Url" + $resp = Invoke-WebRequest -Uri $Url -UseBasicParsing -ErrorAction Stop + $content = $resp.Content -split "`n" + } catch { + log "Failed to fetch $Url: $_" + return $defs + } + + foreach ($line in $content) { + $l = $line.Trim() + if ($l -match '^\|') { + # markdown table row: | username | role | + $parts = $l -split '\|' | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' } + if ($parts.Count -ge 2) { + $user = $parts[0] + $role = $parts[1] + if ($user -and $role) { $defs[$user] = $role } + } + continue + } + + # common patterns: "username - admin" or "username: admin" or "- username - admin" + if ($l -match '^[\-\*\+\s]*([A-Za-z0-9_.@\\-]{2,})\s*[:\-]\s*(admin|administrator|localadmin|user|member|standard|non-admin|nonadmin|staff)\b') { + $user = $matches[1] + $role = $matches[2] + $defs[$user] = $role + continue + } + + # lines like "Create user: username (admin)" + if ($l -match '([A-Za-z0-9_.@\\-]{2,})\s*\(?\b(admin|administrator|localadmin)\b\)?') { + $user = $matches[1] + $role = $matches[2] + $defs[$user] = $role + continue + } + } + + # Normalize roles to Admin / User + $normalized = @{} + foreach ($k in $defs.Keys) { + $r = $defs[$k].ToString().ToLower() + if ($r -match 'admin') { $normalized[$k] = 'Admin' } else { $normalized[$k] = 'User' } + } + return $normalized +} + +function Get-AllLocalUsers { + $users = @() + try { + $local = Get-LocalUser -ErrorAction Stop + foreach ($u in $local) { $users += [PSCustomObject]@{ Name = $u.Name; Object = $u } } + return $users + } catch { + # fallback to WinNT ADSI enumeration + try { + $comp = [ADSI]("WinNT://$env:COMPUTERNAME") + foreach ($child in $comp.Children) { + if ($child.SchemaClassName -eq 'User') { + $users += [PSCustomObject]@{ Name = $child.Name; Object = $child } + } + } + } catch { + log "Failed to enumerate local users: $_" + } + } + return $users +} + +function Is-UserInAdminGroup { + param([string]$UserName) + try { + $members = Get-LocalGroupMember -Group 'Administrators' -ErrorAction Stop | Select-Object -ExpandProperty Name + return $members -contains $UserName + } catch { + # fallback: check ADSI + try { + $group = [ADSI]('WinNT://' + $env:COMPUTERNAME + '/Administrators,group') + foreach ($m in $group.Members()) { if ($m.GetType().InvokeMember('Name','GetProperty',$null,$m,$null) -eq $UserName) { return $true } } + } catch { } + } + return $false +} + +function Remove-UserAccount { + param([string]$UserName) + try { Remove-LocalUser -Name $UserName -ErrorAction Stop; log "Removed local user $UserName"; return } catch { } + try { net user $UserName /delete 2>&1 | Out-Null; log "Removed local user $UserName (net user)"; return } catch { log "Failed to remove $UserName: $_" } +} + +function Create-UserAccount { + param( + [string]$UserName, + [string]$Role = 'User' + ) + # generate a random password + $plain = [System.Web.Security.Membership]::GeneratePassword(12,2) -replace '\\','A' + $secure = ConvertTo-SecureString $plain -AsPlainText -Force + try { + New-LocalUser -Name $UserName -Password $secure -FullName $UserName -ErrorAction Stop + log "Created user $UserName" + } catch { + # fallback to net user + try { net user $UserName $plain /add 2>&1 | Out-Null; log "Created user $UserName (net user)" } catch { log "Failed to create $UserName: $_" } + } + + if ($Role -eq 'Admin') { + try { Add-LocalGroupMember -Group 'Administrators' -Member $UserName -ErrorAction Stop; log "Added $UserName to Administrators" } catch { try { net localgroup Administrators $UserName /add 2>&1 | Out-Null; log "Added $UserName to Administrators (net localgroup)" } catch { log "Failed to add $UserName to Administrators: $_" } } + } +} + +function Sync-UsersFromDefinitions { + param([hashtable]$Definitions) + + if ($Definitions.Count -eq 0) { log "No user definitions provided to sync."; return } + + $locals = Get-AllLocalUsers + $localNames = $locals | Select-Object -ExpandProperty Name + $protected = @('Administrator','Guest','DefaultAccount','WDAGUtilityAccount') + $currentUser = $env:USERNAME + + foreach ($lu in $localNames) { + if ($protected -contains $lu) { continue } + if ($lu -eq $currentUser) { continue } + + if (-not $Definitions.ContainsKey($lu)) { + $ans = Read-Host "Local user '$lu' not in remote list. Delete? (y/n)" + if ($ans -match '^[Yy]') { + Invoke-Action "Remove local user $lu" { Remove-UserAccount -UserName $lu } + } else { log "Kept user $lu" } + } else { + # user present in definitions, check admin membership + $expected = $Definitions[$lu] + $isAdmin = Is-UserInAdminGroup -UserName $lu + if ($expected -eq 'Admin' -and -not $isAdmin) { + $ans = Read-Host "User '$lu' should be Admin per source but is not. Add to Administrators? (y/n)" + if ($ans -match '^[Yy]') { Invoke-Action "Add $lu to Administrators" { Add-LocalGroupMember -Group 'Administrators' -Member $lu -ErrorAction SilentlyContinue } } + } elseif ($expected -eq 'User' -and $isAdmin) { + $ans = Read-Host "User '$lu' is Admin but source lists as User. Remove from Administrators? (y/n)" + if ($ans -match '^[Yy]') { Invoke-Action "Remove $lu from Administrators" { Remove-LocalGroupMember -Group 'Administrators' -Member $lu -ErrorAction SilentlyContinue } } + } + } + } + + # Add any missing users listed in definitions + foreach ($k in $Definitions.Keys) { + if (-not ($localNames -contains $k)) { + $role = $Definitions[$k] + $ans = Read-Host "User '$k' (Role=$role) is in remote list but not local. Create? (y/n)" + if ($ans -match '^[Yy]') { + Invoke-Action "Create user $k (Role=$role)" { Create-UserAccount -UserName $k -Role $role } + } else { log "Skipped creating $k" } + } + } +} +#endregion + +#region Firewall functions +function set-FirewallRule { + # Disable every pre-existing rule + Set-NetFirewallRule * -Enabled False -Action NotConfigured + + # Block multiple Windows features by pre-existing rules + Set-NetFirewallRule -DisplayGroup "AllJoyn Router","*BranchCache*","Cast to Device functionality","Connect","Cortana","Delivery Optimization","DIAL protocol server","Feedback Hub","File and Printer Sharing","Get Office","Groove Music","HomeGroup","iSCSI Service","mDNS","Media Center Extenders","Microsoft Edge","Microsoft Photos","Microsoft Solitaire Collection","Movies & TV","MSN Weather","Network Discovery","OneNote","*Wi-Fi*","Paint 3D","Proximity Sharing","*Remote*","Secure Socket Tunneling Protocol","*Skype*","SNMP Trap","Store","*Smart Card*","Virtual Machine Monitoring","Windows Collaboration Computer Name Registration Service","*Windows Media Player*","Windows Peer to Peer Collaboration Foundation","Windows View 3D Preview","*Wireless*","*WFD*","*Xbox*","3D Builder","Captive Portal Flow","Take a Test","Wallet" -Action Block -Enabled True -Profile Any + + # Block multiple insecure protocols by pre-existing rules + Set-NetFirewallRule -DisplayName "*IPv6*","*ICMP*","*SMB*","*UPnP*","*FTP*","*Telnet*" -Action Block -Enabled True -Profile Any + + # Block multiple ports with new rule (Inbound) + New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 20-21 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 22 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 23 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "HTTP" -LocalPort 80 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "TorPark onion routing" -LocalPort 81 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "TorPark control" -LocalPort 82 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "RTelnet" -LocalPort 107 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "RTelnet" -LocalPort 107 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "DHCPv6" -LocalPort 546-547 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "DHCPv6" -LocalPort 546-547 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Flash" -LocalPort 843 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "B.net (Free HK)" -LocalPort 1119 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "B.net (Free HK)" -LocalPort 1119 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Kazaa" -LocalPort 1214 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Kazaa" -LocalPort 1214 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "WASTE" -LocalPort 1337 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Civ" -LocalPort 1492 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Garena" -LocalPort 1513 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Garena" -LocalPort 1513 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "iSketch" -LocalPort 1626-1627 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Defunct RADIUS Ports" -LocalPort 1645-1646 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Windward" -LocalPort 1707 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Windward" -LocalPort 1707 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "America's Army" -LocalPort 1716 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Microsoft Media Services" -LocalPort 1755 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Microsoft Media Services" -LocalPort 1755 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "SSDP" -LocalPort 1900 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Macro Flash" -LocalPort 1935 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Macro Flash" -LocalPort 1935 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Netop" -LocalPort 1970 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Netop" -LocalPort 1970 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Civ 4" -LocalPort 2033 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Civ 4" -LocalPort 2033 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Warzone 2100" -LocalPort 2100 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Apple Notifs" -LocalPort 2195 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Apple Notifs Feedback" -LocalPort 2196 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "ArmA/Halo" -LocalPort 2302-2305 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "AIM/Ghost" -LocalPort 2351-2368 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Ultima Online" -LocalPort 2593 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Ultima Online" -LocalPort 2593 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Ultima Online 2" -LocalPort 2599 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Ultima Online 2" -LocalPort 2599 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "iSync" -LocalPort 3004 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Xbox LIVE" -LocalPort 3074 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Xbox LIVE" -LocalPort 3074 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "iSCSI" -LocalPort 3260 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "iSCSI" -LocalPort 3260 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "RDP" -LocalPort 3389 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "RDP" -LocalPort 3389 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "PlayStation" -LocalPort 3479-3480 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "PlayStation" -LocalPort 3479-3480 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Cyc" -LocalPort 3645 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Cyc" -LocalPort 3645 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "BF4" -LocalPort 3659 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Blizzard games/Club Penguin" -LocalPort 3724 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Blizzard games/Club Penguin" -LocalPort 3724 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "WarMUX" -LocalPort 3826 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "WarMUX" -LocalPort 3826 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Warframe" -LocalPort 3960 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Warframe again" -LocalPort 3962 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "OpenTTD" -LocalPort 3978-3979 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "OpenTTD" -LocalPort 3978-3979 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Diablo 2" -LocalPort 4000 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Diablo 2" -LocalPort 4000 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Microsoft Ants" -LocalPort 4001 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Amazon Echo" -LocalPort 4070 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Amazon Echo" -LocalPort 4070 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Microsoft Remote Web Workplace admin" -LocalPort 4125 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Apprentice" -LocalPort 4747 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Many things" -LocalPort 5000 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Many things" -LocalPort 5000 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "LoL" -LocalPort 5000-5500 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Neverwinter Nights" -LocalPort 5121 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Apple Notif 2" -LocalPort 5223 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Outlaws" -LocalPort 5310 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "PostgreSQL" -LocalPort 5432 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Freeciv" -LocalPort 5556 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Freeciv" -LocalPort 5556 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "TeamViewer" -LocalPort 5938 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "TeamViewer" -LocalPort 5938 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "More b.net/CP 2 (Free HK)" -LocalPort 6112 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "More b.net/CP 2 (Free HK)" -LocalPort 6112 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "B.net/Club penguin 3" -LocalPort 6113 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6881-6887 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6881-6887 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6888 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6888 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6889-6900 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "BitTorrent" -LocalPort 6889-6900 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "BitTorrent tracker" -LocalPort 6969 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "HTTP Bittorrent" -LocalPort 7000 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Enemy Territory: Quake Wars" -LocalPort 7133 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Tibia" -LocalPort 7171 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "WatchMe" -LocalPort 7272 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "WatchMe" -LocalPort 7272 -Protocol UDP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Rise: The Vieneo Province" -LocalPort 7473 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Saratoga FTP" -LocalPort 7542 -Protocol TCP -Action Block -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "Saratoga FTP" -LocalPort 7542 -Protocol UDP -Action Block -Enabled True -Direction Inbound + + # (Outbound rules mirror many of the inbound blocks) + New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 20-21 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 22 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "FTP, SSH, Telnet" -LocalPort 23 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "HTTP" -LocalPort 80 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "TorPark onion routing" -LocalPort 81 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "TorPark control" -LocalPort 82 -Protocol UDP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "RTelnet" -LocalPort 107 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "RTelnet" -LocalPort 107 -Protocol UDP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "DHCPv6" -LocalPort 546-547 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "DHCPv6" -LocalPort 546-547 -Protocol UDP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "Flash" -LocalPort 843 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "B.net (Free HK)" -LocalPort 1119 -Protocol TCP -Action Block -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "B.net (Free HK)" -LocalPort 1119 -Protocol UDP -Action Block -Enabled True -Direction Outbound + + # Block ICMP/ICMPv6 rules + New-NetFirewallRule -DisplayName "ICMPv4" -Protocol ICMPv4 -Action Block -Enabled True -Direction Inbound -Profile Any + New-NetFirewallRule -DisplayName "ICMPv4" -Protocol ICMPv4 -Action Block -Enabled True -Direction Outbound -Profile Any + New-NetFirewallRule -DisplayName "ICMPv6" -Protocol ICMPv6 -Action Block -Enabled True -Direction Inbound -Profile Any + New-NetFirewallRule -DisplayName "ICMPv6" -Protocol ICMPv6 -Action Block -Enabled True -Direction Outbound -Profile Any + + # Allow some necessary outbound ports + New-NetFirewallRule -DisplayName "HTTPS" -LocalPort 443 -Protocol TCP -Action Allow -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "NTP" -LocalPort 123 -Protocol UDP -Action Allow -Enabled True -Direction Outbound + New-NetFirewallRule -DisplayName "NTP" -LocalPort 123 -Protocol UDP -Action Allow -Enabled True -Direction Inbound + + # Allow Defender related rules + Set-NetFirewallRule -DisplayName "*Defender*" -Enabled True -Action Allow -Profile Any +} + +function set-Firewall { + # Ensure firewall service running + Set-Service -Name MpsSvc -StartupType Automatic -Status Running + + # Enable the firewall profiles + Set-NetFirewallProfile -Name Domain, Public, Private -Enabled True + + # Set direction defaults + Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow + + # Settings for profiles + Set-NetFirewallProfile -Name Domain, Private, Public -NotifyOnListen False + + # Unique settings for Public + Set-NetFirewallProfile -Name Public -AllowLocalFirewallRules False -AllowLocalIPsecRules False + + # Logging settings + Set-NetFirewallProfile -Name Domain, Private, Public -LogFileName "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log" -LogMaxSizeKilobytes 16384 -LogBlocked True -LogAllowed True +} +#endregion + +#region SSH +function setSSHconfig { + # Start the service and ensure startup + Set-Service -Name sshd -StartupType Automatic -Status Running + + # Configure firewall rules for SSH (ensure idempotency) + # Remove any previous blocking rule on port 22 (if present) + Get-NetFirewallRule -ErrorAction SilentlyContinue | Where-Object { ($_ | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue).LocalPort -contains 22 } | Remove-NetFirewallRule -ErrorAction SilentlyContinue + + New-NetFirewallRule -DisplayName "OpenSSH" -Protocol TCP -LocalPort 22 -Action Allow -Enabled True -Direction Inbound + New-NetFirewallRule -DisplayName "OpenSSH" -Protocol TCP -LocalPort 22 -Action Allow -Enabled True -Direction Outbound +} +#endregion + +#region SecPol helpers +function Get-Secpol { + param( + [Parameter(Mandatory=$true)] + [string]$CfgFile + ) + secedit /export /cfg "$CfgFile" | Out-Null + $obj = New-Object psobject + $index = 0 + $contents = Get-Content $CfgFile -Raw + [regex]::Matches($contents,"(?<=\[)(.*)(?=\])") | ForEach-Object { + $title = $_.Value + [regex]::Matches($contents,"(?<=\]).*?((?=\[)|(\Z))", [System.Text.RegularExpressions.RegexOptions]::Singleline)[$index] | ForEach-Object{ + $section = New-Object psobject + $_.Value -split "\r\n" | Where-Object{$_.Length -gt 0} | ForEach-Object { + $value = [regex]::Match($_,"(?<=\=).*).Value + $name = [regex]::Match($_,".*(?=\=") ).Value + } + } + $index += 1 + } + + # Fallback simple parser (previous implementation returned a nested PSObject). + # Use the original implementation from module file for compatibility instead of complex rewrite. + secedit /export /cfg "$CfgFile" | Out-Null + $obj = New-Object psobject + $index = 0 + $contents = Get-Content $CfgFile -Raw + [regex]::Matches($contents,"(?<=\[)(.*)(?=\])") | ForEach-Object { + $title = $_ + [regex]::Matches($contents,"(?<=\]).*?((?=\[)|())", [System.Text.RegularExpressions.RegexOptions]::Singleline)[$index] | ForEach-Object{ + $section = New-Object psobject + $_.Value -split "\r\n" | Where-Object{ $_.Length -gt 0 } | ForEach-Object { + $value = [regex]::Match($_,"(?<=\=).*" ).Value + $name = [regex]::Match($_,".*(?=\=)" ).Value + try { $section | Add-Member -MemberType NoteProperty -Name $name.ToString().Trim() -Value $value.ToString().Trim() -ErrorAction SilentlyContinue } catch { } + } + try { $obj | Add-Member -MemberType NoteProperty -Name $title -Value $section } catch { } + } + $index += 1 + } + return $obj +} + +function Set-SecPol { + param( + [Parameter(Mandatory=$true)] + $Object, + [Parameter(Mandatory=$true)] + [string]$CfgFile + ) + $Object.psobject.Properties.GetEnumerator() | ForEach-Object{ + "[$($_.Name)]" + $_.Value | ForEach-Object{ + $_.psobject.Properties.GetEnumerator() | ForEach-Object{ + "$($_.Name)=$($_.Value)" + } + } + } | Out-File -FilePath $CfgFile -ErrorAction Stop -Encoding ASCII + secedit /configure /db c:\windows\security\local.sdb /cfg "$CfgFile" /areas SECURITYPOLICY +} +#endregion + +#region Services and Tasks +function disableUnsecureServices { + # Disable unneeded/insecure services (idempotent) + $svcnames = @( + 'Browser','bthserv','Fax','icssvc','irmon','lfsvc','lltdsvc','MapsBroker','MSiSCSI','p2pimsvc','p2psvc','PhoneSvc','PlugPlay','PNRPAutoReg','PNRPsvc','RasAuto','RemoteAccess','RemoteRegistry','RpcLocator','SessionEnv','SharedAccess','SNMPTRAP','SSDPSRV','TermService','UmRdpService','upnphost','vmicrdv','W32Time','W3SVC','wercplsupport','WerSvc','WinHttpAutoProxySvc','WinRM','WlanSvc','WMPNetworkSvc','WpnService','WpnUserService*','WwanSvc','xbgm','XblAuthManager','XblGameSave','XboxGipSvc','XboxNetApiSvc','PushToInstall','spectrum','icssvc','wisvc','StiSvc','FrameServer','WbioSrvc','WFDSConSvc','WebClient','WMSVC','WalletService','UevAgentService','UwfServcingSvc','TabletInputService','TapiSrv','WiaRpc','SharedRealitySvc','SNMP','SCPolicySvc','ScDeviceEnum','simptcp','ShellHWDetection','shpamsvc','SensorService','SensrSvc','SensorDataService','SstpSvc','iprip','RetailDemo','RasMan','RmSvc','PrintNotify','WpcMonSvc','SEMgrSvc','CscService','NcaSVC','NcbService','NcdAutoSetup','Netlogon','NetTcpPortSharing','NetTcpActivator','NetMsmqActivator','Wms','WmsRepair','SmsRouter','MsKeyboardFilter','ftpsvc','AppVClient','wlidsvc','diagnosticshub.standardcollector.service','MSMQTriggers','MSMQ','LxssManager','LPDSVC','lpxlatCfgSvc','iphlpsvc','IISADMIN','vmicvss','vmms','vmictimesync','vmicrdv','vmicmsession','vmcompute','vmicheartbeat','vmicshutdown','vmicguestinterface','vmickvpexchange','HvHost','EapHost','dmwappushsvc','TrkWks','WdiSystemHost','WdiServiceHost','diagsvc','DiagTrack','NfsClnt','CertPropSvc','CaptureService_*','camsvc','PeerDistSvc','BluetoothUserService_*','BTAGService','BthAvctpSvc','tzautoupdate','ALG','AJRouter' + ) + foreach ($s in $svcnames) { + try { + Set-Service -Status Stopped -StartupType Disabled -Name $s -ErrorAction SilentlyContinue + } catch { } + } + + # Enable needed services + $needed = @('BDESVC','BFE','CryptSvc','DcomLaunch','Dhcp','Dnscache','EventLog','Group','LanmanServer','LanmanWorkstation','MpsSvc','nsi','Power','RpcEptMapper','RpcSs','SamSs','SecurityHealthService','Sense','WdNisSvc','Wecsvc','WEPHOSTSVC','WinDefend','wuauserv','WSearch','TrustedInstaller','Winmgmt','msiserver','FontCache','Wcmsvc','AudioSrv','AudioEndpointBuilder','vds','ProfSvc','UserManager','UsoSvc','Themes','Schedule','SgrmBroker','SystemEventsBroker','SENS','OneSyncSvc_*','SysMain','sppsvc','wscsvc','PcaSvc','Spooler','WPDBusEnum','ssh-agent','NlaSvc','LSM','gpsvc','EFS','DPS','DoSvc','DusmSvc','CoreMessagingRegistrar','CDPUserSvc_*','CDPSvc','EventSystem','BrokerInfrastructure','BITS','AppHostSvc') + foreach ($n in $needed) { + try { Set-Service -Status Running -StartupType Automatic -Name $n -ErrorAction SilentlyContinue } catch { } + } + + # Manual services list + $manual = @('dot3svc','WaaSMedicSvc','wmiApSrv','LicenseManager','SDRSVC','TokenBroker','W3LOGSVC','VSS','UnistoreSvc_*','UserDataSvc_*','upnphost','TimeBroker','lmhosts','TieringEngineService','StorSvc','StateRepository','svsvc','seclogon','QWAVE','PrintWorkflowUserSvc_*','pla','PerfHost','defragsvc','NetSetupSvc','netprofm','Netman','InstallService','smphost','sqprv','NgcCtnrSvc','NgcSvc','MessagingService_*','wlpasvc','KtmRm','UI0Detect','PolicyAgent','IKEEXT','hidserv','hns','GraphicsPerfSvc','FDResPub','fdPHost','fhsvc','EntAppSvc','embeddedmode','DsRoleSvc','MSDTC','DevQueryBroker','DevicesFlowUserSvc_*','DevicePickerUserSvc_*','DsmSVC','DmEnrollmentSvc','DeviceInstall','DsSvc','COMSysApp','KeyIso','ClipSVC','c2wts','wbegine','aspnet_state','AssignedAccessManagerSvc','AppXSVC','AppMgmt','Appinfo','AppIDSvc','AppReadiness','AxInstSV') + foreach ($m in $manual) { + try { Set-Service -StartupType Manual -Name $m -ErrorAction SilentlyContinue } catch { } + } + + # Some services cannot be disabled but should be stopped or set manual + $stoppedManual = @('BcastDVRUserService_*','DeviceAssociationService','VaultSvc','PimIndexMaintenanceSvc_*') + foreach ($t in $stoppedManual) { + try { Set-Service -Status Stopped -StartupType Manual -Name $t -ErrorAction SilentlyContinue } catch { } + } +} + +function disableTasks { + try { Unregister-ScheduledTask -TaskPath *Bluetooth* -ErrorAction SilentlyContinue } catch { } + try { Unregister-ScheduledTask -TaskPath *Location* -ErrorAction SilentlyContinue } catch { } + try { Unregister-ScheduledTask -TaskPath *Maps* -ErrorAction SilentlyContinue } catch { } + try { Unregister-ScheduledTask -TaskPath *UPnP* -ErrorAction SilentlyContinue } catch { } + try { Unregister-ScheduledTask -TaskPath '*Plug and Play*' -ErrorAction SilentlyContinue } catch { } + try { Unregister-ScheduledTask -TaskPath '*Windows Error Reporting*' -ErrorAction SilentlyContinue } catch { } +} +#endregion + +# Main orchestration (selective by switches) +try { + $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Definition + log "Using script dir: $ScriptDir" + + $systemAccessPath = Join-Path $ScriptDir 'lib/System Access.json' + $eventAuditPath = Join-Path $ScriptDir 'lib/Event Audit.json' + + if (Test-Path $systemAccessPath) { + $SystemAccessSecPolConfig = Get-Content -Path $systemAccessPath | ConvertFrom-Json + } else { log "Warning: $systemAccessPath not found"; $SystemAccessSecPolConfig = $null } + + if (Test-Path $eventAuditPath) { + $EventAuditSecPolConfig = Get-Content -Path $eventAuditPath | ConvertFrom-Json + } else { log "Warning: $eventAuditPath not found"; $EventAuditSecPolConfig = $null } + + $secTemp = Join-Path $env:TEMP 'SecPool.cfg' + + # Determine which actions to run + $DoFirewall = $RunAll -or $RunFirewall + $DoSecPol = $RunAll -or $RunSecPol + $DoServices = $RunAll -or $RunServices + $DoSSH = $RunAll -or $RunSSH + $DoTasks = $RunAll -or $RunTasks + # Default secure behavior: when -RunAll is used, disable SAM enumeration unless explicitly enabled + $DoSAMDisable = $DisableSAMEnumeration -or $RunAll + $DoSAMEnable = $EnableSAMEnumeration + + if ($DoSecPol) { + Invoke-Action "Export current SecPol and apply JSON settings" { + log "Exporting current SecPol to $secTemp" + $SecPool = Get-Secpol -CfgFile $secTemp + + if ($SystemAccessSecPolConfig -ne $null) { + $SystemAccessSecPolConfig.PSObject.Properties | ForEach-Object { + $name = $_.Name + $value = $_.Value + + if (-not $SecPool.PSObject.Properties.Match('System Access')) { + $null = $SecPool | Add-Member -MemberType NoteProperty -Name 'System Access' -Value (New-Object PSObject) -Force + } + try { $SecPool.'System Access'.$name = $value } catch { } + } + } + + if ($EventAuditSecPolConfig -ne $null) { + $EventAuditSecPolConfig.PSObject.Properties | ForEach-Object { + $name = $_.Name + $value = $_.Value + + if (-not $SecPool.PSObject.Properties.Match('Event Audit')) { + $null = $SecPool | Add-Member -MemberType NoteProperty -Name 'Event Audit' -Value (New-Object PSObject) -Force + } + try { $SecPool.'Event Audit'.$name = $value } catch { } + } + } + + Set-SecPol -Object $SecPool -CfgFile $secTemp + } + } + + if ($DoFirewall) { + Invoke-Action "Configure firewall rules" { + set-FirewallRule + set-Firewall + } + } + + if ($DoTasks) { + Invoke-Action "Disable scheduled tasks" { + disableTasks + } + } + + if ($DoServices) { + Invoke-Action "Disable insecure services" { + disableUnsecureServices + } + } + + if ($DoSSH) { + Invoke-Action "Configure SSH" { + setSSHconfig + } + } + + if ($DoSAMDisable -and $DoSAMEnable) { + log "Cannot specify both -DisableSAMEnumeration and -EnableSAMEnumeration. Choose one." + } elseif ($DoSAMDisable) { + Invoke-Action "Disable anonymous enumeration of SAM accounts and shares" { + Set-SAMEnumeration -Disable $true + } + } elseif ($DoSAMEnable) { + Invoke-Action "Enable anonymous enumeration of SAM accounts and shares" { + Set-SAMEnumeration -Disable $false + } + } + + if ($ScanUsers) { + Invoke-Action "Scan user directories for all files and save to Desktop" { + Scan-UserFiles + } + } + + if ($SyncUsers) { + $url = $UsersSourceUrl + if ([string]::IsNullOrWhiteSpace($url)) { + $url = Read-Host "Enter the URL of the CyberPatriot README or user list to sync from" + } + if (-not [string]::IsNullOrWhiteSpace($url)) { + $defs = Fetch-UserDefinitionsFromUrl -Url $url + if ($defs.Count -gt 0) { + Sync-UsersFromDefinitions -Definitions $defs + } else { log "No user definitions parsed from $url" } + } else { log "No URL provided for user sync." } + } + + if (-not ($DoSecPol -or $DoFirewall -or $DoTasks -or $DoServices -or $DoSSH)) { + log "No action switches provided. Use -RunAll or one of -RunFirewall, -RunSecPol, -RunServices, -RunSSH, -RunTasks. Use -WhatIf for a dry-run." + } else { + log "Completed selected actions." + } + +} catch { + log "Error during execution: $_" + throw +} diff --git a/Scripts/Windows/MasterScriptStuff/MasterScript.ps1 b/Scripts/Windows/MasterScriptStuff/MasterScript.ps1 new file mode 100644 index 0000000..0ae6306 --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/MasterScript.ps1 @@ -0,0 +1,50 @@ +# SECPOL +Import-Module .\src\secpol\Get-Secpol +Import-Module .\src\secpol\Set-Secpol + +$SystemAccessSecPolConfig = Get-Content -Path '.\lib\secpol\System Access.json' | ConvertFrom-Json +$EventAuditSecPolConfig = Get-Content -Path '.\lib\secpol\Event Audit.json' | ConvertFrom-Json + +# basic modules +Import-Module .\src\modules\log + +# firewall modules +Import-Module '.\src\Firewalls\Firewall Rules.psm1' +Import-Module '.\src\Firewalls\firewall.psm1' + +#Tasks +Import-Module .\src\tasks\tasks.psm1 + +# unsecure services +Import-Module .\src\services\services.psm1 + +# SSH +Import-Module .\src\SSH\sshconf.psm1 +# SECPOL (System Access) +$SecPool = Get-Secpol "C:\Windows\Temp\SecPool.cfg" + + +$SystemAccessSecPolConfig.PSObject.Properties | ForEach-Object { + $name = $_.Name + $value = $_.Value + + $SecPool.'System Access'.$name = $value +} + +$EventAuditSecPolConfig.PSObject.Properties | ForEach-Object { + $name = $_.Name + $value = $_.Value + + $SecPool.'Event Audit'.$name = $value +} + +Set-SecPol -Object $SecPool -CfgFile "C:\Windows\Temp\SecPool.cfg" + +set-FirewallRule; +set-Firewall; + +disableTasks; + +disableUnsecureServices; + +setSSHconfig; \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/SSH/SSHConf.psm1 b/Scripts/Windows/MasterScriptStuff/SSH/SSHConf.psm1 new file mode 100644 index 0000000..c79ca37 --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/SSH/SSHConf.psm1 @@ -0,0 +1,12 @@ +Function setSSHconfig { + #Start the service + Set-Service -Name sshd -StartupType Automatic -Status Running + + #Config firewall services to allow + Set-NetFireWallRule -LocalPort 22 -Enabled False + New-NetFireWallRule -DisplayName "OpenSSH" -Protocol TCP -LocalPort 22 -Action Allow -Enabled True -Direction Inbound + New-NetFireWallRule -DisplayName "OpenSSH" -Protocol TCP -LocalPort 22 -Action Allow -Enabled True -Direction Outbound + +} + +Export-ModuleMember -Function setSSHconfig \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/SecPol/GetSecPol.psm1 b/Scripts/Windows/MasterScriptStuff/SecPol/GetSecPol.psm1 new file mode 100644 index 0000000..8d55bb0 --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/SecPol/GetSecPol.psm1 @@ -0,0 +1,24 @@ +Function Get-Secpol($CfgFile){ + secedit /export /cfg "$CfgFile" | out-null + $obj = New-Object psobject + $index = 0 + $contents = Get-Content $CfgFile -raw + [regex]::Matches($contents,"(?<=\[)(.*)(?=\])") | ForEach-Object { + $title = $_ + [regex]::Matches($contents,"(?<=\]).*?((?=\[)|(\Z))", [System.Text.RegularExpressions.RegexOptions]::Singleline)[$index] | ForEach-Object{ + $section = new-object psobject + $_.value -split "\r\n" | Where-Object{$_.length -gt 0} | ForEach-Object { + $value = [regex]::Match($_,"(?<=\=).*").value + $name = [regex]::Match($_,".*(?=\=)").value + $section | add-member -MemberType NoteProperty -Name $name.tostring().trim() -Value $value.tostring().trim() -ErrorAction SilentlyContinue | out-null + } + $obj | Add-Member -MemberType NoteProperty -Name $title -Value $section + } + $index += 1 + } + return $obj +} + + + +Export-ModuleMember -Function Get-Secpol \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/SecPol/SetSecPol.psm1 b/Scripts/Windows/MasterScriptStuff/SecPol/SetSecPol.psm1 new file mode 100644 index 0000000..78c7b58 --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/SecPol/SetSecPol.psm1 @@ -0,0 +1,13 @@ +Function Set-SecPol($Object, $CfgFile){ + $SecPool.psobject.Properties.GetEnumerator() | ForEach-Object{ + "[$($_.Name)]" + $_.Value | ForEach-Object{ + $_.psobject.Properties.GetEnumerator() | ForEach-Object{ + "$($_.Name)=$($_.Value)" + } + } + } | out-file $CfgFile -ErrorAction Stop + secedit /configure /db c:\windows\security\local.sdb /cfg "$CfgFile" /areas SECURITYPOLICY + } + + Export-ModuleMember -Function Set-SecPol \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/Services/SetServices.psm1 b/Scripts/Windows/MasterScriptStuff/Services/SetServices.psm1 new file mode 100644 index 0000000..d94a34e --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/Services/SetServices.psm1 @@ -0,0 +1,276 @@ +Function disableUnsecureServices { + #Disable unneeded/insecure services + Set-Service -Status Stopped -StartupType Disabled -Name Browser + Set-Service -Status Stopped -StartupType Disabled -Name bthserv + Set-Service -Status Stopped -StartupType Disabled -Name Fax + Set-Service -Status Stopped -StartupType Disabled -Name icssvc + Set-Service -Status Stopped -StartupType Disabled -Name irmon + Set-Service -Status Stopped -StartupType Disabled -Name lfsvc + Set-Service -Status Stopped -StartupType Disabled -Name lltdsvc + Set-Service -Status Stopped -StartupType Disabled -Name MapsBroker + Set-Service -Status Stopped -StartupType Disabled -Name MSiSCSI + Set-Service -Status Stopped -StartupType Disabled -Name p2pimsvc + Set-Service -Status Stopped -StartupType Disabled -Name p2psvc + Set-Service -Status Stopped -StartupType Disabled -Name PhoneSvc + Set-Service -Status Stopped -StartupType Disabled -Name PlugPlay + Set-Service -Status Stopped -StartupType Disabled -Name PNRPAutoReg + Set-Service -Status Stopped -StartupType Disabled -Name PNRPsvc + Set-Service -Status Stopped -StartupType Disabled -Name RasAuto + Set-Service -Status Stopped -StartupType Disabled -Name RemoteAccess + Set-Service -Status Stopped -StartupType Disabled -Name RemoteRegistry + Set-Service -Status Stopped -StartupType Disabled -Name RpcLocator + Set-Service -Status Stopped -StartupType Disabled -Name SessionEnv + Set-Service -Status Stopped -StartupType Disabled -Name SharedAccess + Set-Service -Status Stopped -StartupType Disabled -Name SNMPTRAP + Set-Service -Status Stopped -StartupType Disabled -Name SSDPSRV + Set-Service -Status Stopped -StartupType Disabled -Name TermService + Set-Service -Status Stopped -StartupType Disabled -Name UmRdpService + Set-Service -Status Stopped -StartupType Disabled -Name upnphost + Set-Service -Status Stopped -StartupType Disabled -Name vmicrdv + Set-Service -Status Stopped -StartupType Disabled -Name W32Time + Set-Service -Status Stopped -StartupType Disabled -Name W3SVC + Set-Service -Status Stopped -StartupType Disabled -Name wercplsupport + Set-Service -Status Stopped -StartupType Disabled -Name WerSvc + Set-Service -Status Stopped -StartupType Disabled -Name WinHttpAutoProxySvc + Set-Service -Status Stopped -StartupType Disabled -Name WinRM + Set-Service -Status Stopped -StartupType Disabled -Name WlanSvc + Set-Service -Status Stopped -StartupType Disabled -Name WMPNetworkSvc + Set-Service -Status Stopped -StartupType Disabled -Name WpnService + Set-Service -Status Stopped -StartupType Disabled -Name WpnUserService* + Set-Service -Status Stopped -StartupType Disabled -Name WwanSvc + Set-Service -Status Stopped -StartupType Disabled -Name xbgm + Set-Service -Status Stopped -StartupType Disabled -Name XblAuthManager + Set-Service -Status Stopped -StartupType Disabled -Name XblGameSave + Set-Service -Status Stopped -StartupType Disabled -Name XboxGipSvc + Set-Service -Status Stopped -StartupType Disabled -Name XboxNetApiSvc + Set-Service -Status Stopped -StartupType Disabled -Name PushToInstall + Set-Service -Status Stopped -StartupType Disabled -Name spectrum + Set-Service -Status Stopped -StartupType Disabled -Name icssvc + Set-Service -Status Stopped -StartupType Disabled -Name wisvc + Set-Service -Status Stopped -StartupType Disabled -Name StiSvc + Set-Service -Status Stopped -StartupType Disabled -Name FrameServer + Set-Service -Status Stopped -StartupType Disabled -Name WbioSrvc + Set-Service -Status Stopped -StartupType Disabled -Name WFDSConSvc + Set-Service -Status Stopped -StartupType Disabled -Name WebClient + Set-Service -Status Stopped -StartupType Disabled -Name WMSVC + Set-Service -Status Stopped -StartupType Disabled -Name WalletService + Set-Service -Status Stopped -StartupType Disabled -Name UevAgentService + Set-Service -Status Stopped -StartupType Disabled -Name UwfServcingSvc + Set-Service -Status Stopped -StartupType Disabled -Name TabletInputService + Set-Service -Status Stopped -StartupType Disabled -Name TapiSrv + Set-Service -Status Stopped -StartupType Disabled -Name WiaRpc + Set-Service -Status Stopped -StartupType Disabled -Name SharedRealitySvc + Set-Service -Status Stopped -StartupType Disabled -Name SNMP + Set-Service -Status Stopped -StartupType Disabled -Name SCPolicySvc + Set-Service -Status Stopped -StartupType Disabled -Name ScDeviceEnum + Set-Service -Status Stopped -StartupType Disabled -Name simptcp + Set-Service -Status Stopped -StartupType Disabled -Name ShellHWDetection + Set-Service -Status Stopped -StartupType Disabled -Name shpamsvc + Set-Service -Status Stopped -StartupType Disabled -Name SensorService + Set-Service -Status Stopped -StartupType Disabled -Name SensrSvc + Set-Service -Status Stopped -StartupType Disabled -Name SensorDataService + Set-Service -Status Stopped -StartupType Disabled -Name SstpSvc + Set-Service -Status Stopped -StartupType Disabled -Name iprip + Set-Service -Status Stopped -StartupType Disabled -Name RetailDemo + Set-Service -Status Stopped -StartupType Disabled -Name RasMan + Set-Service -Status Stopped -StartupType Disabled -Name RmSvc + Set-Service -Status Stopped -StartupType Disabled -Name PrintNotify + Set-Service -Status Stopped -StartupType Disabled -Name WpcMonSvc + Set-Service -Status Stopped -StartupType Disabled -Name SEMgrSvc + Set-Service -Status Stopped -StartupType Disabled -Name CscService + Set-Service -Status Stopped -StartupType Disabled -Name NcaSVC + Set-Service -Status Stopped -StartupType Disabled -Name NcbService + Set-Service -Status Stopped -StartupType Disabled -Name NcdAutoSetup + Set-Service -Status Stopped -StartupType Disabled -Name Netlogon + Set-Service -Status Stopped -StartupType Disabled -Name NetTcpPortSharing + Set-Service -Status Stopped -StartupType Disabled -Name NetTcpActivator + Set-Service -Status Stopped -StartupType Disabled -Name NetMsmqActivator + Set-Service -Status Stopped -StartupType Disabled -Name Wms + Set-Service -Status Stopped -StartupType Disabled -Name WmsRepair + Set-Service -Status Stopped -StartupType Disabled -Name SmsRouter + Set-Service -Status Stopped -StartupType Disabled -Name MsKeyboardFilter + Set-Service -Status Stopped -StartupType Disabled -Name ftpsvc + Set-Service -Status Stopped -StartupType Disabled -Name AppVClient + Set-Service -Status Stopped -StartupType Disabled -Name wlidsvc + Set-Service -Status Stopped -StartupType Disabled -Name diagnosticshub.standardcollector.service + Set-Service -Status Stopped -StartupType Disabled -Name MSMQTriggers + Set-Service -Status Stopped -StartupType Disabled -Name MSMQ + Set-Service -Status Stopped -StartupType Disabled -Name LxssManager + Set-Service -Status Stopped -StartupType Disabled -Name LPDSVC + Set-Service -Status Stopped -StartupType Disabled -Name lpxlatCfgSvc + Set-Service -Status Stopped -StartupType Disabled -Name iphlpsvc + Set-Service -Status Stopped -StartupType Disabled -Name IISADMIN + Set-Service -Status Stopped -StartupType Disabled -Name vmicvss + Set-Service -Status Stopped -StartupType Disabled -Name vmms + Set-Service -Status Stopped -StartupType Disabled -Name vmictimesync + Set-Service -Status Stopped -StartupType Disabled -Name vmicrdv + Set-Service -Status Stopped -StartupType Disabled -Name vmicmsession + Set-Service -Status Stopped -StartupType Disabled -Name vmcompute + Set-Service -Status Stopped -StartupType Disabled -Name vmicheartbeat + Set-Service -Status Stopped -StartupType Disabled -Name vmicshutdown + Set-Service -Status Stopped -StartupType Disabled -Name vmicguestinterface + Set-Service -Status Stopped -StartupType Disabled -Name vmickvpexchange + Set-Service -Status Stopped -StartupType Disabled -Name HvHost + Set-Service -Status Stopped -StartupType Disabled -Name EapHost + Set-Service -Status Stopped -StartupType Disabled -Name dmwappushsvc + Set-Service -Status Stopped -StartupType Disabled -Name TrkWks + Set-Service -Status Stopped -StartupType Disabled -Name WdiSystemHost + Set-Service -Status Stopped -StartupType Disabled -Name WdiServiceHost + Set-Service -Status Stopped -StartupType Disabled -Name diagsvc + Set-Service -Status Stopped -StartupType Disabled -Name DiagTrack + Set-Service -Status Stopped -StartupType Disabled -Name NfsClnt + Set-Service -Status Stopped -StartupType Disabled -Name CertPropSvc + Set-Service -Status Stopped -StartupType Disabled -Name CaptureService_* + Set-Service -Status Stopped -StartupType Disabled -Name camsvc + Set-Service -Status Stopped -StartupType Disabled -Name PeerDistSvc + Set-Service -Status Stopped -StartupType Disabled -Name BluetoothUserService_* + Set-Service -Status Stopped -StartupType Disabled -Name BTAGService + Set-Service -Status Stopped -StartupType Disabled -Name BthAvctpSvc + Set-Service -Status Stopped -StartupType Disabled -Name tzautoupdate + Set-Service -Status Stopped -StartupType Disabled -Name ALG + Set-Service -Status Stopped -StartupType Disabled -Name AJRouter + + #Enable needed services + Set-Service -Status Running -StartupType Automatic -Name BDESVC + Set-Service -Status Running -StartupType Automatic -Name BFE + Set-Service -Status Running -StartupType Automatic -Name CryptSvc + Set-Service -Status Running -StartupType Automatic -Name DcomLaunch + Set-Service -Status Running -StartupType Automatic -Name Dhcp + Set-Service -Status Running -StartupType Automatic -Name Dnscache + Set-Service -Status Running -StartupType Automatic -Name EventLog + Set-Service -Status Running -StartupType Automatic -Name Group + Set-Service -Status Running -StartupType Automatic -Name LanmanServer + Set-Service -Status Running -StartupType Automatic -Name LanmanWorkstation + Set-Service -Status Running -StartupType Automatic -Name MpsSvc + Set-Service -Status Running -StartupType Automatic -Name nsi + Set-Service -Status Running -StartupType Automatic -Name Power + Set-Service -Status Running -StartupType Automatic -Name RpcEptMapper + Set-Service -Status Running -StartupType Automatic -Name RpcSs + Set-Service -Status Running -StartupType Automatic -Name SamSs + Set-Service -Status Running -StartupType Automatic -Name SecurityHealthService + Set-Service -Status Running -StartupType Automatic -Name Sense + Set-Service -Status Running -StartupType Automatic -Name WdNisSvc + Set-Service -Status Running -StartupType Automatic -Name Wecsvc + Set-Service -Status Running -StartupType Automatic -Name WEPHOSTSVC + Set-Service -Status Running -StartupType Automatic -Name WinDefend + Set-Service -Status Running -StartupType Automatic -Name wuauserv + Set-Service -Status Running -StartupType Automatic -Name WSearch + Set-Service -Status Running -StartupType Automatic -Name TrustedInstaller + Set-Service -Status Running -StartupType Automatic -Name Winmgmt + Set-Service -Status Running -StartupType Automatic -Name msiserver + Set-Service -Status Running -StartupType Automatic -Name FontCache + Set-Service -Status Running -StartupType Automatic -Name Wecsvc + Set-Service -Status Running -StartupType Automatic -Name Wcmsvc + Set-Service -Status Running -StartupType Automatic -Name AudioSrv + Set-Service -Status Running -StartupType Automatic -Name AudioEndpointBuilder + Set-Service -Status Running -StartupType Automatic -Name vds + Set-Service -Status Running -StartupType Automatic -Name ProfSvc + Set-Service -Status Running -StartupType Automatic -Name UserManager + Set-Service -Status Running -StartupType Automatic -Name UsoSvc + Set-Service -Status Running -StartupType Automatic -Name Themes + Set-Service -Status Running -StartupType Automatic -Name Schedule + Set-Service -Status Running -StartupType Automatic -Name SgrmBroker + Set-Service -Status Running -StartupType Automatic -Name SystemEventsBroker + Set-Service -Status Running -StartupType Automatic -Name SENS + Set-Service -Status Running -StartupType Automatic -Name OneSyncSvc_* + Set-Service -Status Running -StartupType Automatic -Name SysMain + Set-Service -Status Running -StartupType Automatic -Name sppsvc + Set-Service -Status Running -StartupType Automatic -Name wscsvc + Set-Service -Status Running -StartupType Automatic -Name PcaSvc + Set-Service -Status Running -StartupType Automatic -Name Spooler + Set-Service -Status Running -StartupType Automatic -Name WPDBusEnum + Set-Service -Status Running -StartupType Automatic -Name ssh-agent + Set-Service -Status Running -StartupType Automatic -Name NlaSvc + Set-Service -Status Running -StartupType Automatic -Name LSM + Set-Service -Status Running -StartupType Automatic -Name gpsvc + Set-Service -Status Running -StartupType Automatic -Name EFS + Set-Service -Status Running -StartupType Automatic -Name DPS + Set-Service -Status Running -StartupType Automatic -Name DoSvc + Set-Service -Status Running -StartupType Automatic -Name DcomLaunch + Set-Service -Status Running -StartupType Automatic -Name DusmSvc + Set-Service -Status Running -StartupType Automatic -Name CoreMessagingRegistrar + Set-Service -Status Running -StartupType Automatic -Name CDPUserSvc_* + Set-Service -Status Running -StartupType Automatic -Name CDPSvc + Set-Service -Status Running -StartupType Automatic -Name EventSystem + Set-Service -Status Running -StartupType Automatic -Name BrokerInfrastructure + Set-Service -Status Running -StartupType Automatic -Name BITS + Set-Service -Status Running -StartupType Automatic -Name AppHostSvc + + #Manual services + Set-Service -StartupType Manual -Name dot3svc + Set-Service -StartupType Manual -Name WaaSMedicSvc + Set-Service -StartupType Manual -Name wmiApSrv + Set-Service -StartupType Manual -Name LicenseManager + Set-Service -StartupType Manual -Name SDRSVC + Set-Service -StartupType Manual -Name TokenBroker + Set-Service -StartupType Manual -Name W3LOGSVC + Set-Service -StartupType Manual -Name VSS + Set-Service -StartupType Manual -Name UnistoreSvc_* + Set-Service -StartupType Manual -Name UserDataSvc_* + Set-Service -StartupType Manual -Name upnphost + Set-Service -StartupType Manual -Name TimeBroker + Set-Service -StartupType Manual -Name lmhosts + Set-Service -StartupType Manual -Name TieringEngineService + Set-Service -StartupType Manual -Name StorSvc + Set-Service -StartupType Manual -Name StateRepository + Set-Service -StartupType Manual -Name svsvc + Set-Service -StartupType Manual -Name seclogon + Set-Service -StartupType Manual -Name QWAVE + Set-Service -StartupType Manual -Name PrintWorkflowUserSvc_* + Set-Service -StartupType Manual -Name pla + Set-Service -StartupType Manual -Name PerfHost + Set-Service -StartupType Manual -Name defragsvc + Set-Service -StartupType Manual -Name NetSetupSvc + Set-Service -StartupType Manual -Name netprofm + Set-Service -StartupType Manual -Name Netman + Set-Service -StartupType Manual -Name InstallService + Set-Service -StartupType Manual -Name smphost + Set-Service -StartupType Manual -Name sqprv + Set-Service -StartupType Manual -Name NgcCtnrSvc + Set-Service -StartupType Manual -Name NgcSvc + Set-Service -StartupType Manual -Name MessagingService_* + Set-Service -StartupType Manual -Name wlpasvc + Set-Service -StartupType Manual -Name KtmRm + Set-Service -StartupType Manual -Name UI0Detect + Set-Service -StartupType Manual -Name PolicyAgent + Set-Service -StartupType Manual -Name IKEEXT + Set-Service -StartupType Manual -Name hidserv + Set-Service -StartupType Manual -Name hns + Set-Service -StartupType Manual -Name GraphicsPerfSvc + Set-Service -StartupType Manual -Name GraphicsPerfSvc + Set-Service -StartupType Manual -Name FDResPub + Set-Service -StartupType Manual -Name fdPHost + Set-Service -StartupType Manual -Name fhsvc + Set-Service -StartupType Manual -Name EntAppSvc + Set-Service -StartupType Manual -Name embeddedmode + Set-Service -StartupType Manual -Name DsRoleSvc + Set-Service -StartupType Manual -Name MSDTC + Set-Service -StartupType Manual -Name DevQueryBroker + Set-Service -StartupType Manual -Name DevicesFlowUserSvc_* + Set-Service -StartupType Manual -Name DevicePickerUserSvc_* + Set-Service -StartupType Manual -Name DsmSVC + Set-Service -StartupType Manual -Name DmEnrollmentSvc + Set-Service -StartupType Manual -Name DeviceInstall + Set-Service -StartupType Manual -Name DsSvc + Set-Service -StartupType Manual -Name COMSysApp + Set-Service -StartupType Manual -Name KeyIso + Set-Service -StartupType Manual -Name ClipSVC + Set-Service -StartupType Manual -Name c2wts + Set-Service -StartupType Manual -Name wbegine + Set-Service -StartupType Manual -Name aspnet_state + Set-Service -StartupType Manual -Name AssignedAccessManagerSvc + Set-Service -StartupType Manual -Name AppXSVC + Set-Service -StartupType Manual -Name AppMgmt + Set-Service -StartupType Manual -Name Appinfo + Set-Service -StartupType Manual -Name AppIDSvc + Set-Service -StartupType Manual -Name AppReadiness + Set-Service -StartupType Manual -Name AxInstSV + + #cannot be disabled but unwanted + Set-Service -Status Stopped -StartupType Manual -Name BcastDVRUserService_* + Set-Service -Status Stopped -StartupType Manual -Name DeviceAssociationService + Set-Service -Status Stopped -StartupType Manual -Name VaultSvc + Set-Service -Status Stopped -StartupType Manual -Name PimIndexMaintenanceSvc_* +} + +Export-ModuleMember -Function Disable-DefaultServices \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/Task/DisableTask.psm1 b/Scripts/Windows/MasterScriptStuff/Task/DisableTask.psm1 new file mode 100644 index 0000000..9bff41f --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/Task/DisableTask.psm1 @@ -0,0 +1,10 @@ +Function disableTasks { + Unregister-ScheduledTask -TaskPath *Bluetooth* + Unregister-ScheduledTask -TaskPath *Location* + Unregister-ScheduledTask -TaskPath *Maps* + Unregister-ScheduledTask -TaskPath *UPnP* + Unregister-ScheduledTask -TaskPath '*Plug and Play*' + Unregister-ScheduledTask -TaskPath '*Windows Error Reporting*' +} + +Export-ModuleMember -Function disableTasks diff --git a/Scripts/Windows/MasterScriptStuff/lib/Event Audit.json b/Scripts/Windows/MasterScriptStuff/lib/Event Audit.json new file mode 100644 index 0000000..c7e26ce --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/lib/Event Audit.json @@ -0,0 +1,11 @@ +{ + "AuditSystemEvents": 3, + "AuditLogonEvents": 3, + "AuditObjectAccess": 3, + "AuditPrivilegeUse": 3, + "AuditPolicyChange": 3, + "AuditAccountManage": 3, + "AuditProcessTracking": 3, + "AuditDSAccess": 3, + "AuditAccountLogon": 3 +} \ No newline at end of file diff --git a/Scripts/Windows/MasterScriptStuff/lib/System Access.json b/Scripts/Windows/MasterScriptStuff/lib/System Access.json new file mode 100644 index 0000000..e5cd209 --- /dev/null +++ b/Scripts/Windows/MasterScriptStuff/lib/System Access.json @@ -0,0 +1,14 @@ +{ + "MinimumPasswordAge": 1, + "MaximumPasswordAge": 90, + "MinimumPasswordLength": 14, + "PasswordComplexity": 1, + "PasswordHistorySize": 24, + "LockoutBadCount": 5, + "ResetLockoutCount": 15, + "LockoutDuration": 30, + "ForceLogoffWhenHourExpire": 1, + "ClearTextPassword": 0, + "EnableAdminAccount": 0, + "EnableGuestAccount": 0 +} \ No newline at end of file diff --git a/Scripts/Windows/MaxwellsWindowsScript/Overview b/Scripts/Windows/MaxwellsWindowsScript/Overview new file mode 100644 index 0000000..f4c5632 --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/Overview @@ -0,0 +1,13 @@ +List of working files: +1. file_cleaner.py +2. accountManagment.py +3. Main.py +4. firewall_config.py +5. defender_updates.py +6. audit_policies.py +7. service_manaement.py +8. software_management.py + +I don't know about: +1. password_policies.py +2. uac_settings.py diff --git a/Scripts/Windows/MaxwellsWindowsScript/__pycache__/audit_policies.cpython-312.pyc b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/audit_policies.cpython-312.pyc new file mode 100644 index 0000000..39468f1 Binary files /dev/null and b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/audit_policies.cpython-312.pyc differ diff --git a/Scripts/Windows/MaxwellsWindowsScript/__pycache__/defender_updates.cpython-312.pyc b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/defender_updates.cpython-312.pyc new file mode 100644 index 0000000..8e45851 Binary files /dev/null and b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/defender_updates.cpython-312.pyc differ diff --git a/Scripts/Windows/MaxwellsWindowsScript/__pycache__/firewall_config.cpython-312.pyc b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/firewall_config.cpython-312.pyc new file mode 100644 index 0000000..e4be1e1 Binary files /dev/null and b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/firewall_config.cpython-312.pyc differ diff --git a/Scripts/Windows/MaxwellsWindowsScript/__pycache__/password_policies.cpython-312.pyc b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/password_policies.cpython-312.pyc new file mode 100644 index 0000000..59a4f11 Binary files /dev/null and b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/password_policies.cpython-312.pyc differ diff --git a/Scripts/Windows/MaxwellsWindowsScript/__pycache__/service_manaement.cpython-312.pyc b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/service_manaement.cpython-312.pyc new file mode 100644 index 0000000..b8ec3e3 Binary files /dev/null and b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/service_manaement.cpython-312.pyc differ diff --git a/Scripts/Windows/MaxwellsWindowsScript/__pycache__/uac_settings.cpython-312.pyc b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/uac_settings.cpython-312.pyc new file mode 100644 index 0000000..bb2df74 Binary files /dev/null and b/Scripts/Windows/MaxwellsWindowsScript/__pycache__/uac_settings.cpython-312.pyc differ diff --git a/Scripts/Windows/MaxwellsWindowsScript/account-management.log b/Scripts/Windows/MaxwellsWindowsScript/account-management.log new file mode 100644 index 0000000..e69de29 diff --git a/Scripts/Windows/MaxwellsWindowsScript/accountManagment.py b/Scripts/Windows/MaxwellsWindowsScript/accountManagment.py new file mode 100644 index 0000000..82e0929 --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/accountManagment.py @@ -0,0 +1,242 @@ +import ctypes +import logging +import subprocess +import sys +from datetime import datetime +from getpass import getpass + +# Set up logging +logging.basicConfig(filename='account-management.log', level=logging.INFO) + +# log account creation +now = datetime.now() + + +# Checks if the user running the script has administrator privileges +def is_admin(): + try: + return ctypes.windll.shell32.IsUserAnAdmin() + except: + return False + + +def create_account(): + """Creates local accounts""" + username = input("Enter username: ") + password = check_password() + + create_account_cmd = f"net user {username} {password} /add" + run_cmd(create_account_cmd, f"User {username} created successfully.", f"Error creating user {username}.", + f"Create user {username} {now}", f"Failed to create {username} {now}") + + +def create_admin(): + """Creates local admin accounts""" + account_name = input("What account do you want to make an admin: ") + make_admin_cmd = f"net localgroup administrators {account_name} /add" + + run_cmd(make_admin_cmd, f"{account_name} is now apart of administrator group", f"Error making {account_name} admin", + f" {account_name} is now administrator {now}", f"Failed to create {account_name} {now}") + + +def assign_account_to_group(): + """Assign account to group""" + get_groups_cmd = "net localgroup" + + run_cmd(get_groups_cmd, "All groups are listed", "Error getting groups", f"Get all users {now}", + f"Failed to get all user {now}") + + +def remove_account_from_group(): + """Remove user from assigned group""" + print("Remove user from group") + + username = input("Enter username: ") + group = input(f"Remove {username} from: ") + command = f"net localgroup \"{username}\" " f"\"{group}\" /DELETE" + + run_cmd(command, f"Removed {username} from {group}", f"Failed to remove {username} from {group}", + f"Successfully removed {username} from {group} {now}") + + +def check_password(): + """Verifies password to create account""" + password = getpass("Enter password for account: ") + check_password = getpass("Enter password again: ") + + while password != check_password: + print("Passwords do not match") + password = getpass("Enter password for account: ") + check_password = getpass("Enter password again: ") + + return password + + +def delete_account(): + """Deletes local account off computer""" + command = "net user" + run_cmd(command, "Got all users successfully", "Failed to get all users", f"All users {now}", + f"Failed to get all {now}") + + # Removes \n and other text from the net user command + try: + all_accounts = subprocess.run(command, check=True, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) + + if all_accounts.returncode == 0: + print("All Local Accounts are listed") + for accounts in all_accounts.stdout.decode().splitlines(): + if accounts: + print(accounts) + else: + print(f"Error getting accounts") + except subprocess.CalledProcessError as e: + print(f"Error getting all accounts.") + print(e.stderr.decode()) + + username = input("Account to delete: ") + delete_account_command = f"net user {username} /DELETE" + + run_cmd(delete_account_command, "Account successfully deleted", "Error deleting account", + f"Successfully delete {username} account", f"Failed to delete {username}") + + +def enable_disable_account(): + """Enables or Disable accounts on machine""" + ask_to_enable_disable = input("Would you like to enable or disable: ") + username = input("Enter the username: ") + enable_account_command = f"net user {username} /ACTIVE:yes" + disable_account_command = f"net user {username} /ACTIVE:no" + + if ask_to_enable_disable == "enable": + try: + enable_account = subprocess.run(enable_account_command, check=True, shell=True, stdout=subprocess.PIPE, + stderr=subprocess.PIPE) + + if enable_account.returncode == 0: + print(f"{username} was successfully enabled") + else: + print("Failed to enable account") + logging.info(f"Failed to enable account: {username} {now}") + except subprocess.CalledProcessError as e: + print("An error has happened when enabling account") + print(e.stderr.decode()) + + if ask_to_enable_disable == "disable": + try: + disable_account = subprocess.run(disable_account_command, check=True, shell=True, stdout=subprocess.PIPE, + stderr=subprocess.PIPE) + + if disable_account.returncode == 0: + print(f"{username} was successfully disabled") + else: + print("Failed to disabled account") + logging.info(f"Failed to disable account {username} {now}") + except subprocess.CalledProcessError as e: + print("An error has happened when disabling account") + print(e.stderr.decode()) + + +def disable_defualt_accounts(): + disable_guest_account = "net user Guest /active:no" + disable_admin_account = "net user Administrator /active:no" + + run_cmd(disable_guest_account, "Guest account is disabled", "Failed to disable Guest account", + f"Guest is now disabled {now}", f"Failed to disable Guest account {now}") + run_cmd(disable_admin_account, "Administrator account is disabled", "Failed to disable Administrator account", + f"Administrator is now disabled {now}", f"Failed to disable Administrator account {now}") + + +def login_times(): + """Allows user to set up login restrictions for accounts""" + username = input("Enter account name: ") + days = input(f"Enter the days for {username} (ex M-F): ") + times = input(f"Enter the times for the {username} (9am-5pm)") + + command = f"net user {username} /times:{days},{times}" + + run_cmd(command, f"{username} is now active during {days} and {times}", "Failed to setup login times", + f"{username} can now login during {days} {times} {now}") + + +def all_groups_for_user(): + print("See all groups that belong to the user") + username = input("Enter username: ") + command = f"net user {username} | findstr \"Local Group Memberships\"" + + run_cmd(command, "Got all user groups", "Failed to get all user assigned groups", + f"{username} asspcoated groups listed {now}", + f"Failed to get all {username} associated groups listed {now} ") + + +def run_cmd(cmd, success_msg, error_msg, success_log_msg, failed_log_msg): + try: + result = subprocess.run(cmd, check=True, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) + + if result.returncode == 0: + print(success_msg) + logging.info(success_log_msg) + else: + print(error_msg) + print(result.stderr.decode()) + logging.critical(failed_log_msg) + + except subprocess.CalledProcessError as e: + print(error_msg) + print(e.stderr.decode()) + logging.error(failed_log_msg) + + +if is_admin(): + # Code of your program here + try: + print("ctrl-c to quit") + + while True: + print("1. Create account \t\t 2. Make account admin") + print("3. Manually add to group \t 4. Delete account") + print("5. Enable/Disable Accounts \t 6. Disable defualt accounts") + print("7. Listed associated groups to user 8. quit") + print("-" * 50) + + # Valildates the user entered a number + try: + choice = int(input("Your choice: ")) + except ValueError: + print("Please enter a number") + continue + + options = { + 1: create_account, + 2: create_admin, + 3: assign_account_to_group, + 4: delete_account, + 5: enable_disable_account, + 6: disable_defualt_accounts, + 7: all_groups_for_user, + 8: quit, + } + + # Runs the funciton based of user input + if choice in options: + options[choice]() + else: + print("Please enter a valid choice (1-6)") + + # Asks if the user want to change their choice + switch_choice = input("Do you want to switch choice? (y/n) ") + if switch_choice.lower() == "y": + if choice == 1 or choice == 2 or choice == 3: + continue + elif switch_choice.lower() == "n": + while True: + options[choice]() + else: + break + + except KeyboardInterrupt: + quit() +else: + # Re-run the program with admin rights + ctypes.windll.shell32.ShellExecuteW(None, "runas", sys.executable, " ".join(sys.argv), None, 1) + +input("Press enter to exit") diff --git a/Scripts/Windows/MaxwellsWindowsScript/accountManagmentReadMe.txt b/Scripts/Windows/MaxwellsWindowsScript/accountManagmentReadMe.txt new file mode 100644 index 0000000..60d6ced --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/accountManagmentReadMe.txt @@ -0,0 +1,33 @@ +Windows User Management +This Python script provides functions to manage local user accounts on a Windows machine. This script requires administrative privileges to run. + +Prerequisites +This script requires Python 3.6 or higher to be installed on the Windows machine. Administrative privileges are also required to create, delete, or modify user accounts. + +Functions +The following functions are provided by this script: + +create_account(): This function creates a standard user account. The user is prompted to enter a username and password for the new account. + +create_admin(): This function adds an existing user account to the Administrators group. + +assign_account_to_group(): This function adds an existing user account to a specified group. + +delete_account(): This function deletes an existing user account. + +enable_disable_account(): This function enables or disables an existing user account. + + +Navigate to the directory containing the script. + +Run the script using the following command: + +Copy code +python Windows-User-Account-Management.py +Follow the prompts to perform user management tasks. + +Example +To create a new user account, run the script and choose the Create Account option. Enter a username and password for the new account when prompted. The script will create the account and provide a success message if the operation is successful. + +Disclaimer +Use this script at your own risk. The author is not responsible for any damages or losses that may result from the use of this script. \ No newline at end of file diff --git a/Scripts/Windows/MaxwellsWindowsScript/audit_policies.py b/Scripts/Windows/MaxwellsWindowsScript/audit_policies.py new file mode 100644 index 0000000..49f098a --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/audit_policies.py @@ -0,0 +1,31 @@ +import subprocess + +policies = [ + "Account Logon", + "Account Management", + "Detailed Tracking", + "DS Access", + "Logon/Logoff", + "Object Access", + "Policy Change", + "Privilege Use", + "System" +] + + +def configure_audit_policies(): + audit_policy_mapping = policies.copy() + command_template = 'auditpol /set /category:"{}" /success:enable /failure:enable' + + for policy_name in audit_policy_mapping: + command = command_template.format(policy_name) + print(command) + try: + subprocess.run(command, shell=True, check=True) + print(f"{command} executed successfully.") + except subprocess.CalledProcessError as e: + print(f"Error executing {command}: {e}") + + +if __name__ == "__main__": + configure_audit_policies() diff --git a/Scripts/Windows/MaxwellsWindowsScript/defender_updates.py b/Scripts/Windows/MaxwellsWindowsScript/defender_updates.py new file mode 100644 index 0000000..22f540f --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/defender_updates.py @@ -0,0 +1,39 @@ +import subprocess + + +# Function to run a quick scan using Windows Defender +def run_windows_defender_scan(): + # Define the command to start a quick scan using PowerShell + command = ["powershell", "Start-MpScan", "-ScanType", "QuickScan"] + # Execute the command and capture output + result = subprocess.run(command, capture_output=True, text=True) + # Check if the scan was successful + if result.returncode == 0: + print("Quick scan completed successfully.") + print(result.stdout) # Print the output from the scan + else: + print("Quick scan failed.") + print(result.stderr) # Print any error message if the scan failed + + +# Function to check for and install Windows updates +def check_install_updates(): + try: + print("Checking for updates...") + # Initiate an update check using the 'usoclient' command + subprocess.run(["wuauclt", "/detectnow"]) + print("Update check initiated.") + + print("Installing updates...") + # Initiate update installation using 'usoclient' command + subprocess.run(["wuauclt", "/updatenow"]) + print("Update installation initiated.") + except subprocess.CalledProcessError as e: + # Handle any errors during update check or installation + print(f"Failed to check or install updates: {e}") + + +# Main section to execute the functions +if __name__ == "__main__": + run_windows_defender_scan() # Run the quick scan function + check_install_updates() # Run the update check and installation function diff --git a/Scripts/Windows/MaxwellsWindowsScript/file_cleaner.py b/Scripts/Windows/MaxwellsWindowsScript/file_cleaner.py new file mode 100644 index 0000000..70fb4de --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/file_cleaner.py @@ -0,0 +1,38 @@ +import os +import shutil + +# File types to delete +fileTypes = [".jpg", ".png", ".aac", ".ac3", ".avi", ".aiff", ".bat", ".bmp", ".exe", ".flac", ".gif", ".jpeg", ".mov", + ".m3u", ".m4p", + ".mp2", ".mp3", ".mp4", ".mpeg4", ".midi", ".msi", ".ogg", ".png", ".txt", ".sh", ".wav", ".wma", ".vqf", + ".pcap", ".zip", + ".pdf", ".json"] + +# Directory path to exclude (e.g., "Cyber Patriot Personnel") +user = os.getlogin() +exclude_directory = ["C://Program Files/Cyber Patriot Personnel", "C://Users//" + user + "//Desktop"] + +# Directories to search through +userDirectories = ["C://Users"] +safe_folder = "C://Users//" + user + "Desktop//DELETEME" + +# mkdir on desktop for files +os.mkdir(f"C://Users//{user}/Desktop//DELETEME") + +for root_dir in userDirectories: + for root, dirs, files in os.walk(root_dir): + # Skip the exclude directory + skip = False + for thing in exclude_directory: + if thing in root: + skip = True + if not skip: + # Delete files of specified types + for file in files: + if any(file.endswith(ft) for ft in fileTypes): + file_path = os.path.join(root, file) + try: + shutil.move(file_path, safe_folder) + print(f"Deleted: {file_path}") + except Exception as e: + print(f"Failed to delete {file_path}: {e}") diff --git a/Scripts/Windows/MaxwellsWindowsScript/firewall_config.py b/Scripts/Windows/MaxwellsWindowsScript/firewall_config.py new file mode 100644 index 0000000..b9603cb --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/firewall_config.py @@ -0,0 +1,10 @@ +import subprocess + + +def enable_firewall(): + subprocess.run(["powershell", "Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True"]) + print("Firewall enabled.") + + +if __name__ == "__main__": + enable_firewall() diff --git a/Scripts/Windows/MaxwellsWindowsScript/main.py b/Scripts/Windows/MaxwellsWindowsScript/main.py new file mode 100644 index 0000000..b6884be --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/main.py @@ -0,0 +1,82 @@ +import audit_policies +import ctypes +import defender_updates +import firewall_config +import password_policies +import service_manaement +import uac_settings + + +def is_admin(): + try: + admin = ctypes.windll.shell32.IsUserAnAdmin() + if not admin: + print("No no! Run me as admin, its better that way") + except: + return False + + +is_admin() + +print("\033[0m\033[31m") +print("Begin computer fixing ;)") + +print("running defender scan") +input("press enter to begin... ") +print("\033[0m") +defender_updates.run_windows_defender_scan() + +print("\033[31m") +print("configuring firewall settings") +input("press enter to begin... ") +print("\033[0m") +firewall_config.enable_firewall() + +print("\033[31m") +print("fix audit policies") +input("press enter to begin... ") +print("\033[0m") +audit_policies.configure_audit_policies() + +print("\033[31m") +print("changing password policies") +input("press enter to begin... ") +print("\033[0m") +password_policies.configure_password_policies() + +print("\033[31m") +print("running service management") +input("press enter to begin... ") +print("\033[0m") +service_manaement.manage_services() + +print("\033[31m") +print("running software management") +input("press enter to begin... ") +print("\033[0m") +import software_management + +print("\033[31m") +print("changing uac settings") +input("press enter to begin... ") +print("\033[0m") +uac_settings.configure_uac() + +print("\033[31m") +print("WARNING! RUNNING FILE CLEANER. HOPE AND PRAY") +input("press enter to begin... ") +print("\033[0m") +import file_cleaner + +print("\033[31m") +print("done. didn't run account mgmt, btw") +print("if you want ot try and update (might not work), type (y)yes") +ans = input("try update, (y)yes or no? ") +if ans == "y": + print("attempting update") + print("\033[0m") + defender_updates.check_install_updates() +else: + print("skipped. the end. if it wasn't enough, blame maxwell") + +print("\033[0m") diff --git a/Scripts/Windows/MaxwellsWindowsScript/password_policies.py b/Scripts/Windows/MaxwellsWindowsScript/password_policies.py new file mode 100644 index 0000000..5bed648 --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/password_policies.py @@ -0,0 +1,20 @@ +import subprocess + + +def configure_password_policies(): + password_policies = [ + "net accounts /minpwlen:8", + "net accounts /maxpwage:30", + "net accounts /minpwage:1", + "net accounts /uniquepw:5", + "net accounts /lockoutthreshold:5", + "net accounts /lockoutduration:30", + "net accounts /lockoutwindow:30" + ] + for policy in password_policies: + subprocess.run(policy, shell=True, check=True) + print(f"{policy} executed") + + +if __name__ == "__main__": + configure_password_policies() diff --git a/Scripts/Windows/MaxwellsWindowsScript/service_manaement.py b/Scripts/Windows/MaxwellsWindowsScript/service_manaement.py new file mode 100644 index 0000000..20793dc --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/service_manaement.py @@ -0,0 +1,27 @@ +import subprocess + + +def manage_services(): + services_to_disable = [ + "TermService", "SharedAccess", "UmRdpService", "ftpsvc", + "RemoteRegistry", "SessionEnv", "SSDPSRV", "upnphost", "W3SVC", + "sshd" + ] + for service in services_to_disable: + print(f"Stopping {service}") + try: + subprocess.run(f'net stop {service}', shell=True, check=True) + except subprocess.CalledProcessError as e: + print(e) + print(f"Failed to stop {service}") + + try: + subprocess.run(f'sc config {service} start= disabled', shell=True, check=True) + except subprocess.CalledProcessError as e: + print(e) + print(f"Failed to disable {service}") + print("Disabled and stopped unnecessary services.") + + +if __name__ == "__main__": + manage_services() diff --git a/Scripts/Windows/MaxwellsWindowsScript/software_management.py b/Scripts/Windows/MaxwellsWindowsScript/software_management.py new file mode 100644 index 0000000..2f5821f --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/software_management.py @@ -0,0 +1,20 @@ +import os +import shutil +import subprocess + + +def deleteDirectories(listA, listB): + malwareList = ["Wireshark", "Npcap"] + for dir in listA: + if dir in malwareList: + print(dir) + shutil.rmtree(f"C:/Program Files/{dir}") + for dir in listB: + if dir in malwareList: + shutil.rmtree(f"C:/Program Files (x86)/{dir}") + + +softwareListPF = os.listdir("C:/Program Files") +softwareList86 = os.listdir("C:/Program Files (x86)") +print(f"Collected Software: {softwareListPF} {softwareList86}") +deleteDirectories(softwareListPF, softwareList86) diff --git a/Scripts/Windows/MaxwellsWindowsScript/uac_settings.py b/Scripts/Windows/MaxwellsWindowsScript/uac_settings.py new file mode 100644 index 0000000..26a2db7 --- /dev/null +++ b/Scripts/Windows/MaxwellsWindowsScript/uac_settings.py @@ -0,0 +1,12 @@ +import subprocess + + +def configure_uac(): + subprocess.run( + 'powershell.exe -Command "Set-ItemProperty -Path HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System -Name ConsentPromptBehaviorAdmin -Value 2"', + shell=True, check=True) + print("UAC settings updated.") + + +if __name__ == "__main__": + configure_uac() diff --git a/Scripts/Windows/SCRIP_WIN_CP.ps1 b/Scripts/Windows/SCRIP_WIN_CP.ps1 new file mode 100644 index 0000000..1d7d7e8 --- /dev/null +++ b/Scripts/Windows/SCRIP_WIN_CP.ps1 @@ -0,0 +1,50 @@ +net accounts /minpwlen:10 +net accounts /minpwage:10 +net accounts /maxpwage:90 +net accounts /lockoutduration:30 +net accounts /lockoutthreshold:10 +net accounts /uniquepw:24 +net accounts /passwordmustmeetcomplexityrequirements:Enabled +net accounts /enforcepasswordhistory:5 + +stop-service remoteregistry +stop-service SSDPSRV +stop-service TermService +stop-service UmRdpService +stop-service upnphost +stop-service FTPSVC + +Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True + +Set-Service -Name remoteregistry -Status stopped -StartupType disabled +Set-Service -Name SSDPSRV -Status stopped -StartupType disabled +Set-Service -Name TermService -Status stopped -StartupType disabled +Set-Service -Name UmRdpService -Status stopped -StartupType disabled +Set-Service -Name upnhost -Status stopped -StartupType disabled +Set-Service -Name FTPSVC -Status stopped -StartupType disabled + +Auditpol /get /category:* +Auditpol /set /category:"Detailed Tracking" /success:enable /failure:enable +Auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable +Auditpol /set /category:"Policy Change" /success:enable /failure:enable +Auditpol /set /category:"Account Logon" /success:enable /failure:enable +Auditpol /set /category:"Account Management" /success:enable /failure:enable +Auditpol /set /category:"DS Access" /success:enable /failure:enable +auditpol /set /category:"Privilege Use" /success:enable /failure:enable +auditpol /set /category:"Object Access" /success:enable /failure:enable +auditpol /set /category:"System" /success:enable /failure:enable + +Set-ExecutionPolicy RemoteSigned + +Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name DisableCAD -Value 0 + +reg add "HKLM\SYSTEM\CurrentControlSet\Conrtol\Terminal server" /v fDenyTSConnections /t REG_DWORD /d 1 /f + +New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableSmartScreen" -Value 2 -PropertyType DWORD -Force + +gpupdate /force + +Disable-localuser Guest +Disable-localuser Administrator + +start-mpscan -scantype fullscan diff --git a/TRACEBACK_PSSWDS.csv b/TRACEBACK_PSSWDS.csv new file mode 100644 index 0000000..ea6b2f8 --- /dev/null +++ b/TRACEBACK_PSSWDS.csv @@ -0,0 +1,10 @@ +ARG0n#5128?? +C0balt_404!?! +G0ld3ngLObe!? +tUNgstt3n!_! +OXygENLUhvz! +$ilveredMAR$1 + +IND1um__vs?? +M0Ngol14#124 +T1M3I$FLEETN diff --git a/WF404 Ubuntu Checklist (2).pdf b/WF404 Ubuntu Checklist (2).pdf new file mode 100644 index 0000000..2039cbe Binary files /dev/null and b/WF404 Ubuntu Checklist (2).pdf differ diff --git a/Windows CyberPatriot Checklist.txt b/Windows CyberPatriot Checklist.txt index cba2ea6..475b5c4 100644 --- a/Windows CyberPatriot Checklist.txt +++ b/Windows CyberPatriot Checklist.txt @@ -18,12 +18,14 @@ Competition Checklist: * Change admin privileges for users that need it, and those who do not in User Account Control (type UAC in windows search bar) * Delete and shut down Autoruns in Task Manager. (Go to task manager, either ctrl+alt+delete > task manager or win+r > “taskmgr” then the startup tab in which you can disable or enable apps). * Disable guest accounts (command line > net user guest /active yes) +* Disable admin account (NOT THE ONE YOU'RE LOGGED INTO. THE USER NAMED "ADMIN".) * Change Audits to log with both successes and failures in Administrative Tools. (Search > Administrative Tools > Computer Management * Delete music and games in File Explorer. (shortcut is win+r > “.”) * Delete non-work related software from the device in Programs and Components. (shortcut is win+r > appwiz.cpl.) * Disable Cookies within the browser in Firefox. * Enable the ctrl+alt+del secure logon * Use SmartScreen online services(Security and Maintenance)=ON +*Enable Automatic Updates * Stop and Disable Services in the services menu (win+r > services.msc) * RDP * ICS (windows-r, gpedit.msc, computer config, administrative templates, network, network connections, prohibit use of internet connection sharing on you DNS domain network, enable) @@ -36,18 +38,17 @@ Competition Checklist: * Remote Desktop * WWW Publishing Service * Deny the Following Ports in Control Panel. (Control Panel > System and Security > Windows Firewall > Advanced Settings > Inbound Rules or Outbound Rules > New Rule > Port > Next > TCP or UDP > Specific Local Ports > enter port number “like 80, 443, 20, etc.) > Next > Block the Connection > Next > Choose network location/s either public, domain, or private > Next > create a name > Finish) - * RDP - * SSH - * TelNet - * SNMP - * LDAP - * FTP + * RDP - 3389 + * SSH - 22 + * TelNet - 23 + * SNMP - 161/162 + * LDAP - 389 + * FTP - 21 (command)/20 (data) * Enable security features in Windows Security. (Settings > Update and Security > Windows Security > Protection Areas, enable as many as possible) -* Run a quick scan on the machine with either Malware Removal Tool or Windows Security. (either win+r > mrt > Quick Scan or Settings > Update and Security > Windows Security > Quick Scan) -* Update Firefox through Firefox. (three lines > help? > about > Update Firefox) +* Run a quick scan on the machine with either Malware Removal Tool (Malwarebytes) or Windows Security. (either win+r > mrt > Quick Scan or Settings > Update and Security > Windows Security > Quick Scan) * Password security (win+r > gpedit.msc > Account Policy > Password Policy) OR (win+r > gpedit.msc > Account Policy > Account Lockout Policy) - Enforce password history: 24 + * Enforce password history: 24 * Maximum password age: 60 * Minimum password age: 1 * Minimum password length: 10 @@ -67,15 +68,39 @@ Competition Checklist: * Update the computer last, just in case, Taskbar > Update or Settings. +For updating browsers + * Update Firefox through Firefox. (three lines > help? > about > Update Firefox) + * Chrome (three dots > Help > About Google Chrome > Update) OR (In searchbar: "chrome://settings/help") + * Microsoft Edge (three dots > Help > About Microsoft Edge > Update) (It's the same for all other chromium browsers) + + +For group policy security settings + * Don't display last user name on login screen + * Require Ctrl+Alt+Del before signing in + * Ty got too lazy to add the rest :/ + +Registry Editor hives explained (if you ever need to use it) +* HKEY_CURRENT_USER (HKCU) - + This Hive contains the preferences and configuration for the particular user who is currently logged in. + If a different user is logged onto the same machine, then the information in this Hive would change corresponding to that particular user's configuration. +* HKEY_LOCAL_MACHINE (HKLM) - + This Hive contains the configuration for the actual computer. + The information in this Hive remains the same regardless of the user currently logged on. +* HKEY_CLASSES_ROOT (HKCR) - + This Hive contains the information which pertains to the core user interface such as file associations and shortcuts. +* HKEY_USERS (HKU) - + This Hive contains the user information for all the users that have ever logged onto this computer. +* HKEY_CURRENT_CONFIG (HKCC) - + This Hive contains the information about current hardware configuration. This Hive is linked to the HKLM Hive. +* HKEY_DYN_DATA (HKDD) - + This Hive is found only on Windows 95/98/ME. It contains information about hardware Plug and Play. + This Hive is linked to the HKLM Hive. + +Removing Malware (You will probably only need step 1) +1. Install antivirus (Malwarebytes is what CyberPatriot recommends) +2. If for SOME reason you still think malware is on the computer, look into the following: + *Process Explorer(Gives detailed information about running processes(includes virus count))(https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer) + *Process Monitor(Gives detailed info about file system, registry, and thread activity)(https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) + *TCPView(lists all programs on the computer that are connected to a remote computer)(https://learn.microsoft.com/en-us/sysinternals/downloads/tcpview) - - - - - - - - -Notes: -Look into Malwarebytes (alternative to mrt) \ No newline at end of file diff --git a/account-management.log b/account-management.log new file mode 100644 index 0000000..e69de29 diff --git a/fwunixref.pdf b/fwunixref.pdf new file mode 100644 index 0000000..dcb37ce Binary files /dev/null and b/fwunixref.pdf differ diff --git a/linux commands.txt b/linux commands.txt index 174bc66..0642505 100644 --- a/linux commands.txt +++ b/linux commands.txt @@ -1,5 +1,6 @@ sudo usermod -a -G examplegroup exampleusername +git clone "https://github.com/traceback6/waffleplus.git" sudo apt-get install -sudo ufw enable \ No newline at end of file +sudo ufw enable diff --git a/ubunturef.pdf b/ubunturef.pdf new file mode 100644 index 0000000..8170ad8 Binary files /dev/null and b/ubunturef.pdf differ