diff --git a/atomics/T1118/T1118.yaml b/atomics/T1118/T1118.yaml index 19ff7f34..65ebdc20 100644 --- a/atomics/T1118/T1118.yaml +++ b/atomics/T1118/T1118.yaml @@ -9,10 +9,10 @@ atomic_tests: supported_platforms: - windows input_arguments: - filename: + output_file: description: location of the payload type: Path - default: PathToAtomicsFolder\T1118\src\T1118.dll + default: '%tmp%\T1118.dll' source: description: location of the source code to compile type: Path @@ -32,8 +32,10 @@ atomic_tests: name: command_prompt elevation_required: false command: | - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:library /out:#{filename} #{source} - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U #{filename} + C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:library /out:#{output_file} #{source} + C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U #{output_file} + cleanup_command: | + del #{output_file} >nul 2>&1 - name: InstallUtil GetHelp method call description: | @@ -41,10 +43,10 @@ atomic_tests: supported_platforms: - windows input_arguments: - filename: + output_file: description: location of the payload type: Path - default: PathToAtomicsFolder\T1118\src\T1118.dll + default: '%tmp%\T1118.dll' source: description: location of the source code to compile type: Path @@ -64,5 +66,7 @@ atomic_tests: name: command_prompt elevation_required: false command: | - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:library /out:#{filename} #{source} - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /? #{filename} + C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:library /out:#{output_file} #{source} + C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /? #{output_file} + cleanup_command: | + del #{output_file} >nul 2>&1 diff --git a/atomics/T1121/T1121.yaml b/atomics/T1121/T1121.yaml index 05f2ee43..6f9c63a8 100644 --- a/atomics/T1121/T1121.yaml +++ b/atomics/T1121/T1121.yaml @@ -9,10 +9,10 @@ atomic_tests: supported_platforms: - windows input_arguments: - file_name: + output_file: description: Location of the payload type: Path - default: T1121.dll + default: '%tmp%\T1121.dll' source_file: description: Location of the CSharp source_file type: Path @@ -33,9 +33,9 @@ atomic_tests: elevation_required: false command: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library #{source_file} - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U #{file_name} + C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U #{output_file} cleanup_command: | - del #{file_name} >nul 2>&1 + del #{output_file} >nul 2>&1 - name: Regsvs Uninstall Method Call Test description: | @@ -43,10 +43,10 @@ atomic_tests: supported_platforms: - windows input_arguments: - file_name: + output_file: description: Location of the payload type: Path - default: T1121.dll + default: $Env:TEMP\T1121.dll source_file: description: Location of the CSharp source_file type: Path @@ -68,9 +68,9 @@ atomic_tests: command: | $key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4=' $Content = [System.Convert]::FromBase64String($key) - Set-Content key.snk -Value $Content -Encoding Byte - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library /keyfile:key.snk #{source_file} - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe #{file_name} + Set-Content $env:Temp\key.snk -Value $Content -Encoding Byte + C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library /keyfile:$env:Temp\key.snk #{source_file} + C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe #{output_file} cleanup_command: | - del #{file_name} >nul 2>&1 - del key.snk >nul 2>&1 \ No newline at end of file + Remove-Item #{output_file} -ErrorAction Ignore | Out-Null + Remove-Item $env:Temp\key.snk -ErrorAction Ignore | Out-Null