p15670423
/
monkey
1
0
Fork 5
Code Issues Pull Requests 3 Projects Releases Wiki Activity

Create $Profile if it doesn't exist 

(Runs a powershell script instead of commands like other PBAs)
This commit is contained in:
Shreya 2020-08-04 14:49:43 +05:30
parent f30b81eec7
commit 04eb0650cd
3 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
monkey/infection_monkey/post_breach/actions/modify_shell_startup_files.py
View File

@ -35,7 +35,7 @@ class ModifyShellStartupFiles(PBA):
for startup_file_per_user in shell_startup_files_per_user_for_windows:
windows_cmds = ' '.join(cmds_for_windows).format(startup_file_per_user)
pbas.append(self.ModifyShellStartupFile(linux_cmds='', windows_cmds=['powershell.exe', windows_cmds]))
pbas.append(self.ModifyShellStartupFile(linux_cmds='', windows_cmds=windows_cmds))
for username in usernames_for_linux:
for shell_startup_file in shell_startup_files_for_linux:

11
monkey/infection_monkey/post_breach/shell_startup_files/windows/modify_powershell_startup_file.ps1 Normal file
View File

@ -0,0 +1,11 @@
param (
[string]$startup_file_path = $profile
)
If (!(Test-Path $startup_file_path)) { # create profile.ps1 file if it doesn't exist already
New-Item -Path $startup_file_path -ItemType "file" -Force
}
Add-Content $startup_file_path "# Successfully modified $startup_file_path" ; # add line to $Profile
cat $startup_file_path | Select -last 1 ; # print last line of $Profile
$OldProfile = cat $startup_file_path | Select -skiplast 1 ;
Set-Content $startup_file_path -Value $OldProfile ;

8
monkey/infection_monkey/post_breach/shell_startup_files/windows/shell_startup_files_modification.py
View File

@ -21,9 +21,7 @@ def get_windows_commands_to_modify_shell_startup_files():
for user in USERS]
return [
'Add-Content {0}',
'\"# Successfully modified {0}\" ;', # add line to $profile
'cat {0} | Select -last 1 ;', # print last line of $profile
'$OldProfile = cat {0} | Select -skiplast 1 ;',
'Set-Content {0} -Value $OldProfile ;' # remove last line of $profile
'powershell.exe',
'infection_monkey/post_breach/shell_startup_files/windows/modify_powershell_startup_file.ps1',
'-startup_file_path {0}'
], STARTUP_FILES_PER_USER