p41275903
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Agent: Use path relative to __file__ to locate powershell scripts

This commit is contained in:
Mike Salvatore 2021-08-23 11:12:51 -04:00
parent 536b061cc7
commit 7f71901a29
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
monkey/infection_monkey/post_breach/shell_startup_files/windows/shell_startup_files_modification.py
View File

@ -1,7 +1,10 @@
import subprocess import subprocess
from pathlib import Path
from infection_monkey.utils.environment import is_windows_os from infection_monkey.utils.environment import is_windows_os
MODIFY_POWERSHELL_STARTUP_SCRIPT = Path(__file__).parent / "modify_powershell_startup_file.ps1"
def get_windows_commands_to_modify_shell_startup_files(): def get_windows_commands_to_modify_shell_startup_files():
if not is_windows_os(): if not is_windows_os():
@ -28,7 +31,6 @@ def get_windows_commands_to_modify_shell_startup_files():
return [ return [
"powershell.exe", "powershell.exe",
"infection_monkey/post_breach/shell_startup_files/windows" str(MODIFY_POWERSHELL_STARTUP_SCRIPT),
"/modify_powershell_startup_file.ps1",
"-startup_file_path {0}", "-startup_file_path {0}",
], STARTUP_FILES_PER_USER ], STARTUP_FILES_PER_USER

7
monkey/infection_monkey/post_breach/timestomping/windows/timestomping.py
View File

@ -1,5 +1,10 @@
from pathlib import Path
TIMESTOMPING_SCRIPT = Path(__file__).parent / "timestomping.ps1"
def get_windows_timestomping_commands(): def get_windows_timestomping_commands():
return "powershell.exe infection_monkey/post_breach/timestomping/windows/timestomping.ps1" return f"powershell.exe {TIMESTOMPING_SCRIPT}"
# Commands' source: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006 # Commands' source: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006