diff --git a/atomics/T1059.007/T1059.007.yml b/atomics/T1059.007/T1059.007.yml new file mode 100644 index 00000000..e6ae5c28 --- /dev/null +++ b/atomics/T1059.007/T1059.007.yml @@ -0,0 +1,42 @@ +attack_technique: T1059.007 +display_name: "Command and Scripting Interpreter: JavaScript" +atomic_tests: + - name: JScript execution to gather local computer information via cscript + description: JScript execution test, execute JScript via cscript command. When successful, system information will be written to $env:TEMP\T1059.007.out.txt + supported_platforms: + - windows + input_arguments: + jscript: + description: Path to sample script + type: string + default: PathToAtomicsFolder\T1059.007\src\sys_info.js + dependency_executor_name: powershell + dependencies: + - description: Sample script must exist on disk at specified location (#{jscript}) + prereq_command: "if (Test-Path #{jscript}) {exit 0} else {exit 1} " + get_prereq_command: |- + New-Item -ItemType Directory (Split-Path #{jscript}) -Force | Out-Null + Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.007/src/sys_info.js" -OutFile "#{jscript}" + executor: + command: "cscript #{jscript} > $env:TEMP\\T1059.007.out.txt'" + cleanup_command: Remove-Item $env:TEMP\T1059.007.out.txt -ErrorAction Ignore + name: command_prompt + - name: JScript execution to gather local computer information via wscript + description: JScript execution test, execute JScript via wscript command. When successful, system information will be shown with four message boxes. + supported_platforms: + - windows + input_arguments: + jscript: + description: Path to sample script + type: string + default: PathToAtomicsFolder\T1059.007\src\sys_info.js + dependency_executor_name: powershell + dependencies: + - description: Sample script must exist on disk at specified location (#{jscript}) + prereq_command: "if (Test-Path #{jscript}) {exit 0} else {exit 1} " + get_prereq_command: |- + New-Item -ItemType Directory (Split-Path #{jscript}) -Force | Out-Null + Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.007/src/sys_info.js" -OutFile "#{jscript}" + executor: + command: "wscript #{jscript}" + name: command_prompt diff --git a/atomics/T1059.007/src/sys_info.js b/atomics/T1059.007/src/sys_info.js new file mode 100644 index 00000000..f15fcab0 --- /dev/null +++ b/atomics/T1059.007/src/sys_info.js @@ -0,0 +1,14 @@ +var objWMIService = GetObject("winmgmts:\\\\.\\root\\cimv2"); +var objList = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem"); +var objItem = new Enumerator(objList); +for (; !objItem.atEnd(); objItem.moveNext()) { + var strDomain = objItem.item().Domain; + var strName = objItem.item().Name; + var strManu = objItem.item().Manufacturer; + var strModel = objItem.item().Model; + + WScript.Echo("Domain: " + strDomain); + WScript.Echo("Computer Name: " + strName); + WScript.Echo("Manufacturer: " + strManu); + WScript.Echo("Model: " + strModel); +}