Updated common.requires_os calls (#3109)
This commit is contained in:
committed by
GitHub
parent
8f122197bb
commit
bba8cd3b57
+1
-1
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
rdr_cef_dir = Path("C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF")
|
||||
rdrcef_exe = rdr_cef_dir / "RdrCEF.exe"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/com.adobe.ARMDC.SMJobBlessHelper"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
# create masquerades
|
||||
|
||||
+1
-1
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
app_dir = Path("/Applications/test/Contents/")
|
||||
|
||||
@@ -28,7 +28,7 @@ metadata = RtaMetadata(
|
||||
SHIM_FILE = common.get_path("bin", "CVE-2013-3893.sdb")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
@common.dependencies(SHIM_FILE)
|
||||
def main():
|
||||
common.log("Application Compatibility Shims")
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main(target_host=None):
|
||||
target_host = target_host or common.get_ip()
|
||||
host_str = "\\\\%s" % target_host
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing file creation on /private/var/at/jobs/test.")
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
atom_dir = Path.home().joinpath(".atom")
|
||||
|
||||
+1
-1
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing file modification on test.plist to mimic authorization plugin modification")
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
# create masquerades
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/sh"
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/history"
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/bifrost"
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
if platform.processor() == "arm":
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
common.log("Running Windows BitsAdmin to Download")
|
||||
server, ip, port = common.serve_web()
|
||||
|
||||
@@ -24,7 +24,7 @@ ROOT_DIR = Path(__file__).parent
|
||||
EXE_FILE = common.get_path("bin", "renamed.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
fake_word = ROOT_DIR / "winword.exe"
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/bash"
|
||||
|
||||
@@ -30,7 +30,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
param1 = "--remote-debugging-port=9222"
|
||||
param2 = "--user-data-dir=remote-profile"
|
||||
|
||||
@@ -29,7 +29,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main(username="rta-tester", remote_host=None):
|
||||
if not remote_host:
|
||||
common.log("A remote host is required to detonate this RTA", "!")
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/xargs"
|
||||
|
||||
@@ -24,7 +24,7 @@ PROC = 'ping.exe'
|
||||
# ps script to mount, execute a file and unmount ISO device
|
||||
PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1")
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
|
||||
def main():
|
||||
if Path(ISO).is_file() and Path(PS_SCRIPT).is_file():
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
cal_dir = Path(f"{Path.home()}/Library/Calendars/")
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
common.log("Encoding target")
|
||||
encoded_file = Path("encoded.txt").resolve()
|
||||
|
||||
@@ -24,7 +24,7 @@ metadata = RtaMetadata(
|
||||
MY_DLL = common.get_path("bin", "mydll.dll")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
@common.dependencies(MY_DLL)
|
||||
def main():
|
||||
# http server will terminate on main thread exit
|
||||
|
||||
+1
-1
@@ -31,7 +31,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
w3wp = "C:\\Users\\Public\\w3wp.exe"
|
||||
common.copy_file(EXE_FILE, w3wp)
|
||||
|
||||
@@ -24,7 +24,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
msxsl = "C:\\Users\\Public\\msxsl.exe"
|
||||
fake_clr_path = "C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs"
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
binary = "winword.exe"
|
||||
common.copy_file(EXE_FILE, binary)
|
||||
|
||||
@@ -24,7 +24,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1")
|
||||
RENAMER = common.get_path("bin", "rcedit-x64.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
cmstp = "C:\\Users\\Public\\cmstp.exe"
|
||||
user32 = "C:\\Windows\\System32\\user32.dll"
|
||||
|
||||
+1
-1
@@ -34,7 +34,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
common.log("Memory Dump via Comsvcs")
|
||||
pid = os.getpid()
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
common.log("Temporarily disabling CrashDump...")
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
techniques=["T1134", "T1003"],
|
||||
)
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
import ctypes
|
||||
from ctypes import byref, windll, wintypes
|
||||
|
||||
@@ -32,7 +32,7 @@ def vss_create():
|
||||
results = wmi.ExecMethod_("Create", createparams)
|
||||
return results.Properties_[1].value
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
import win32file
|
||||
vss_list = get_vss_list()
|
||||
|
||||
@@ -20,7 +20,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing defaults commands to dump hashes.")
|
||||
|
||||
@@ -20,7 +20,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
binary = "ProcessDump.exe"
|
||||
common.copy_file(EXE_FILE, binary)
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/osascript"
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
appdata = os.getenv("LOCALAPPDATA")
|
||||
credmanfile = f"{appdata}\\Microsoft\\Credentials\\a.txt"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing file creation on /private/var/at/tabs/test.")
|
||||
|
||||
@@ -23,7 +23,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
RENAMER = common.get_path("bin", "rcedit-x64.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
cscript = "C:\\Users\\Public\\cscript.exe"
|
||||
rcedit = "C:\\Users\\Public\\rcedit.exe"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
# create masquerades
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/testfile"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/curl"
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/xargs"
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main(remote_host=None):
|
||||
remote_host = remote_host or common.get_ip()
|
||||
common.log("DCOM Lateral Movement with MMC")
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
|
||||
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
posh = "C:\\Users\\Public\\posh.exe"
|
||||
common.copy_file(EXE_FILE, posh)
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing deletion on /private/tmp/NSCreateObjectFileImageFromMemory-test file.")
|
||||
|
||||
@@ -26,7 +26,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/defaults"
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
# Messing with the boot configuration is probably not a great idea so create a backup:
|
||||
common.log("Exporting the boot configuration....")
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
warning = "Deleting the backup catalog may have unexpected consequences. Operational issues are unknown."
|
||||
common.log("WARNING: %s" % warning, log_type="!")
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
# create masquerades
|
||||
|
||||
@@ -24,7 +24,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
message = "Deleting the USN journal may have unintended consequences"
|
||||
common.log("WARNING: %s" % message, log_type="!")
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
common.log("Deleting volume shadow copies...")
|
||||
common.execute(["vssadmin.exe", "delete", "shadows", "/for=c:", "/oldest", "/quiet"])
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/bash"
|
||||
|
||||
@@ -20,7 +20,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/bash"
|
||||
|
||||
@@ -14,7 +14,7 @@ from . import RtaMetadata
|
||||
metadata = RtaMetadata(uuid="82358d3d-6f04-42d0-a182-db37cf98294e", platforms=["linux"], endpoint=[], siem=[], techniques=[])
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
common.log("Reading sensitive files", log_type="~")
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/code"
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
# create masquerades
|
||||
|
||||
@@ -36,7 +36,7 @@ plist_content = """
|
||||
"""
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing plutil commands to modify plist file.")
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing file modification on test.dsplug to mimic DirectoryService plugin modification")
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/defaults"
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
common.log("NetSH Advanced Firewall Configuration", log_type="~")
|
||||
netsh = "netsh.exe"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing egrep commands to fingerprint virtual machine.")
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
tmp_dir = Path("/tmp/TestDMGDir")
|
||||
|
||||
+1
-1
@@ -19,7 +19,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing file modification on com.apple.dock.plist to mimic dock plist modification")
|
||||
|
||||
@@ -23,7 +23,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "DoublePersist.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
binary = "DoublePersist.exe"
|
||||
common.copy_file(EXE_FILE, binary)
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/dscl"
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/dseditgroup"
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/dsenableroot"
|
||||
|
||||
@@ -30,7 +30,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
if platform.processor() == "arm":
|
||||
|
||||
@@ -29,7 +29,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1")
|
||||
RENAMER = common.get_path("bin", "rcedit-x64.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
cscript = "C:\\Users\\Public\\cscript.exe"
|
||||
user32 = "C:\\Windows\\System32\\user32.dll"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
file_path = "/tmp/test"
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/emond"
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/eggshell"
|
||||
|
||||
+1
-1
@@ -15,7 +15,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/bash"
|
||||
|
||||
@@ -26,7 +26,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
# create masquerades
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
# create masquerades
|
||||
|
||||
+1
-1
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
common.log("Executing file modification on test.plist to mimic emond file modification")
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/bash"
|
||||
|
||||
@@ -27,7 +27,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main(args=None):
|
||||
slow_commands = ["gpresult.exe /z", "systeminfo.exe"]
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/sed"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
|
||||
masquerade = "/tmp/launchctl"
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
addinproc = "C:\\Users\\Public\\AddInProcess.exe"
|
||||
certoc = "C:\\Users\\Public\\CertOc.exe"
|
||||
|
||||
@@ -19,7 +19,7 @@ metadata = RtaMetadata(
|
||||
# source code - https://gist.github.com/joe-desimone/0b2bb00eca4c522ba0bd5541a6f3528b
|
||||
BIN = common.get_path("bin", "LoadLib-Callback64.exe")
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
|
||||
def main():
|
||||
if Path(BIN).is_file():
|
||||
|
||||
@@ -18,7 +18,7 @@ metadata = RtaMetadata(
|
||||
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
import time
|
||||
from os import path
|
||||
|
||||
@@ -28,7 +28,7 @@ DLL = common.get_path("bin", "faultrep.dll")
|
||||
WER = "c:\\windows\\system32\\werfault.exe"
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
import os
|
||||
from os import path
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
import ctypes, platform
|
||||
from ctypes import windll, wintypes
|
||||
|
||||
@@ -21,7 +21,7 @@ metadata = RtaMetadata(
|
||||
# source code -https://gist.github.com/Samirbous/cee44dbd0254c28d4f57709d5c723aee
|
||||
BIN = common.get_path("bin", "rta_unhook_ldrload.exe")
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
|
||||
def main():
|
||||
if Path(BIN).is_file():
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
adfind = "C:\\Users\\Public\\adfind.exe"
|
||||
common.copy_file(EXE_FILE, adfind)
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
appcmd = "C:\\Users\\Public\\appcmd.exe"
|
||||
common.copy_file(EXE_FILE, appcmd)
|
||||
|
||||
+1
-1
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
arp = "C:\\Windows\\System32\\arp.exe"
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
aspnet_regiis = "C:\\Users\\Public\\aspnet_regiis.exe"
|
||||
common.copy_file(EXE_FILE, aspnet_regiis)
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
attrib = "C:\\Users\\Public\\attrib.exe"
|
||||
common.copy_file(EXE_FILE, attrib)
|
||||
|
||||
@@ -20,7 +20,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
auditpol = "C:\\Users\\Public\\auditpol.exe"
|
||||
common.copy_file(EXE_FILE, auditpol)
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
hh = "C:\\Users\\Public\\hh.exe"
|
||||
mshta = "C:\\Windows\\System32\\mshta.exe"
|
||||
|
||||
@@ -20,7 +20,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
esensor = "C:\\Users\\Public\\esensor.exe"
|
||||
common.copy_file(EXE_FILE, esensor)
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
fltmc = "C:\\Users\\Public\\fltmc.exe"
|
||||
common.copy_file(EXE_FILE, fltmc)
|
||||
|
||||
@@ -19,7 +19,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
fsutil = "C:\\Windows\\System32\\fsutil.exe"
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ metadata = RtaMetadata(
|
||||
EXE_FILE = common.get_path("bin", "renamed_posh.exe")
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
xcopy = "C:\\Users\\Public\\xcopy.exe"
|
||||
common.copy_file(EXE_FILE, xcopy)
|
||||
|
||||
@@ -16,7 +16,7 @@ metadata = RtaMetadata(
|
||||
)
|
||||
|
||||
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.requires_os(*metadata.platforms)
|
||||
def main():
|
||||
powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user