Generated docs from job=generate-docs branch=master [ci skip]
This commit is contained in:
@@ -57846,10 +57846,11 @@ execution:
|
||||
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host}
|
||||
-u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
|
||||
-i -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
elevation_required: true
|
||||
- name: psexec.py (Impacket)
|
||||
auto_generated_guid: edbcd8c9-3639-4844-afad-455c91e95a35
|
||||
description: 'Will execute a command on the remote host with Impacket psexec.py
|
||||
|
||||
@@ -47735,10 +47735,11 @@ execution:
|
||||
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force
|
||||
executor:
|
||||
command: '"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host}
|
||||
-u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
|
||||
-i -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
|
||||
|
||||
'
|
||||
name: command_prompt
|
||||
elevation_required: true
|
||||
- name: BlackCat pre-encryption cmds with Lateral Movement
|
||||
auto_generated_guid: 31eb7828-97d7-4067-9c1e-c6feb85edc4b
|
||||
description: This atomic attempts to emulate the unique behavior of BlackCat
|
||||
|
||||
@@ -99,11 +99,11 @@ Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a re
|
||||
| password | Password | string | P@ssw0rd1|
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)
|
||||
|
||||
|
||||
```cmd
|
||||
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
|
||||
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -i -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
|
||||
```
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user