Debloat-Windows-10 VS CyberChef

Hmm looking here: https://docs.atlasos.net/troubleshooting/removed-features/

It just seems to remove a lot of security modules, out of all the bloat out there why would I want to just remove the sec modules? Also it now adds an option to include those, so all in all, it then removes:

- Some APPX and UWP applications

- Logging of Network Configuration

- Microsoft Edge and WebView

- Restore Points and System Reset

- Telemetry

- Windows Error Reporting

- Windows Updates

- Hyper-V and VBS

- Background Apps

- Disk Defragmentation

- User Account Control (UAC)

I can use https://github.com/W4RH4WK/Debloat-Windows-10 and https://www.oo-software.com/en/shutup10 and https://www.oo-software.com/en/ooappbuster to do most of the debloating and telemetry tasks.

I don't see the point of removing

- Disk Defragmentation (how much does this even affect general usage?)

- UAC (?)

- Hyper-V (since this is an optional feature anyway)

I try to uninstall OneDrive completely during the install process, but either a PS Script (https://github.com/W4RH4WK/Debloat-Windows-10/blob/master/scripts/remove-onedrive.ps1) works nor does it with an intunewin program (OneDriveSetup.exe /uninstall).

All results are just the same guy, and what ultimately helped him didn't help me. https://github.com/W4RH4WK/Debloat-Windows-10/issues/254

Here's a few of the scripts I use. https://github.com/W4RH4WK/Debloat-Windows-10 https://github.com/Sycnex/Windows10Debloater https://christitus.com/debloat-windows-10-2020/ I also run this program after debloating https://www.oo-software.com/en/shutup10

I've managed to trim a lot of the bloat from our standard non-ltsc image. I can't share what I have unfortunately, but some of what I used was based off stuff I found here: https://github.com/W4RH4WK/Debloat-Windows-10/tree/master/scripts

Install Win10 and strip it down to what YOU need from it. That way you also learn a lot by tweaking etc. To do this you need tools like this collection of debloating scripts: https://github.com/W4RH4WK/Debloat-Windows-10, O&O shut up 10, a guide for stopping unused services, etc..

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...