Initial OfficeCom Sentinel client and deployment assets

scripts/extract-attacktracer.ps1

@@ -0,0 +1,72 @@
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$setupExe = Join-Path $repoRoot "SetupAttackTracer.exe"
+$payloadDir = Join-Path $repoRoot "payload"
+$msiAdminDir = Join-Path $repoRoot "msi-admin"
+$decompiledDir = Join-Path $repoRoot "decompiled\AttackTracer"
+$ilspy = Join-Path $env:USERPROFILE ".dotnet\tools\ilspycmd.exe"
+
+if (-not (Test-Path $setupExe)) {
+    throw "SetupAttackTracer.exe not found at $setupExe"
+}
+
+if (-not (Test-Path $ilspy)) {
+    throw "ilspycmd.exe not found at $ilspy"
+}
+
+New-Item -ItemType Directory -Force -Path $payloadDir | Out-Null
+New-Item -ItemType Directory -Force -Path $msiAdminDir | Out-Null
+New-Item -ItemType Directory -Force -Path $decompiledDir | Out-Null
+
+$tempBefore = @(Get-ChildItem $env:TEMP -Directory | Select-Object -ExpandProperty FullName)
+$proc = Start-Process -FilePath $setupExe -PassThru
+Start-Sleep -Seconds 4
+
+$tempAfter = @(Get-ChildItem $env:TEMP -Directory | Select-Object -ExpandProperty FullName)
+$newTempDirs = Compare-Object $tempBefore $tempAfter |
+    Where-Object SideIndicator -eq "=>" |
+    Select-Object -ExpandProperty InputObject
+
+try {
+    if (-not $newTempDirs) {
+        throw "No new temp directory detected while launching SetupAttackTracer.exe"
+    }
+
+    $payloadSource = $null
+    foreach ($dir in $newTempDirs) {
+        if (Test-Path (Join-Path $dir "AttackTracer.msi")) {
+            $payloadSource = $dir
+            break
+        }
+    }
+
+    if (-not $payloadSource) {
+        throw "Could not locate AttackTracer.msi in the installer temp directories"
+    }
+
+    Copy-Item -Path (Join-Path $payloadSource "*") -Destination $payloadDir -Recurse -Force
+
+    $msiPath = Join-Path $payloadDir "AttackTracer.msi"
+    if (-not (Test-Path $msiPath)) {
+        throw "AttackTracer.msi was not copied into $payloadDir"
+    }
+
+    & msiexec /a $msiPath /qn TARGETDIR=$msiAdminDir
+
+    $appExe = Join-Path $msiAdminDir "program files\Servolutions\BotFence\AttackTracer.exe"
+    if (-not (Test-Path $appExe)) {
+        throw "Deployed application executable not found at $appExe"
+    }
+
+    & $ilspy -p -o $decompiledDir $appExe
+
+    Write-Host "Payload extracted to: $payloadDir"
+    Write-Host "MSI admin image:      $msiAdminDir"
+    Write-Host "Decompiled sources:   $decompiledDir"
+}
+finally {
+    if ($proc -and -not $proc.HasExited) {
+        Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
+    }
+}