diff --git a/CHANGELOG.md b/CHANGELOG.md index 66bf63f90..1dc95da43 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,8 @@ Changelog](https://keepachangelog.com/en/1.0.0/). - Typo "trough" -> "through" in telemetry and docstring. - Crash when unexpected character encoding is used by ping command on German language systems. #1175 +- Malfunctioning timestomping PBA. #1405 +- Malfunctioning shell startup script PBA. #1419 ## [1.11.0] - 2021-08-13 ### Added diff --git a/monkey/infection_monkey/post_breach/shell_startup_files/windows/shell_startup_files_modification.py b/monkey/infection_monkey/post_breach/shell_startup_files/windows/shell_startup_files_modification.py index 62fd9425e..9d90f3812 100644 --- a/monkey/infection_monkey/post_breach/shell_startup_files/windows/shell_startup_files_modification.py +++ b/monkey/infection_monkey/post_breach/shell_startup_files/windows/shell_startup_files_modification.py @@ -1,7 +1,10 @@ import subprocess +from pathlib import Path from infection_monkey.utils.environment import is_windows_os +MODIFY_POWERSHELL_STARTUP_SCRIPT = Path(__file__).parent / "modify_powershell_startup_file.ps1" + def get_windows_commands_to_modify_shell_startup_files(): if not is_windows_os(): @@ -28,7 +31,6 @@ def get_windows_commands_to_modify_shell_startup_files(): return [ "powershell.exe", - "infection_monkey/post_breach/shell_startup_files/windows" - "/modify_powershell_startup_file.ps1", + str(MODIFY_POWERSHELL_STARTUP_SCRIPT), "-startup_file_path {0}", ], STARTUP_FILES_PER_USER diff --git a/monkey/infection_monkey/post_breach/timestomping/windows/timestomping.py b/monkey/infection_monkey/post_breach/timestomping/windows/timestomping.py index dbea6aaea..1316caa5a 100644 --- a/monkey/infection_monkey/post_breach/timestomping/windows/timestomping.py +++ b/monkey/infection_monkey/post_breach/timestomping/windows/timestomping.py @@ -1,8 +1,10 @@ -TEMP_FILE = "monkey-timestomping-file.txt" +from pathlib import Path + +TIMESTOMPING_SCRIPT = Path(__file__).parent / "timestomping.ps1" def get_windows_timestomping_commands(): - return "powershell.exe infection_monkey/post_breach/timestomping/windows/timestomping.ps1" + return f"powershell.exe {TIMESTOMPING_SCRIPT}" # Commands' source: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006 diff --git a/monkey/infection_monkey/pyinstaller_hooks/hook-infection_monkey.post_breach.py b/monkey/infection_monkey/pyinstaller_hooks/hook-infection_monkey.post_breach.py new file mode 100644 index 000000000..1deab1ee4 --- /dev/null +++ b/monkey/infection_monkey/pyinstaller_hooks/hook-infection_monkey.post_breach.py @@ -0,0 +1,3 @@ +from PyInstaller.utils.hooks import collect_data_files + +datas = collect_data_files("infection_monkey.post_breach", include_py_files=False)