$ErrorActionPreference = "Stop" $repoRoot = Split-Path -Parent $PSScriptRoot $setupExe = Join-Path $repoRoot "SetupAttackTracer.exe" $payloadDir = Join-Path $repoRoot "payload" $msiAdminDir = Join-Path $repoRoot "msi-admin" $decompiledDir = Join-Path $repoRoot "decompiled\AttackTracer" $ilspy = Join-Path $env:USERPROFILE ".dotnet\tools\ilspycmd.exe" if (-not (Test-Path $setupExe)) { throw "SetupAttackTracer.exe not found at $setupExe" } if (-not (Test-Path $ilspy)) { throw "ilspycmd.exe not found at $ilspy" } New-Item -ItemType Directory -Force -Path $payloadDir | Out-Null New-Item -ItemType Directory -Force -Path $msiAdminDir | Out-Null New-Item -ItemType Directory -Force -Path $decompiledDir | Out-Null $tempBefore = @(Get-ChildItem $env:TEMP -Directory | Select-Object -ExpandProperty FullName) $proc = Start-Process -FilePath $setupExe -PassThru Start-Sleep -Seconds 4 $tempAfter = @(Get-ChildItem $env:TEMP -Directory | Select-Object -ExpandProperty FullName) $newTempDirs = Compare-Object $tempBefore $tempAfter | Where-Object SideIndicator -eq "=>" | Select-Object -ExpandProperty InputObject try { if (-not $newTempDirs) { throw "No new temp directory detected while launching SetupAttackTracer.exe" } $payloadSource = $null foreach ($dir in $newTempDirs) { if (Test-Path (Join-Path $dir "AttackTracer.msi")) { $payloadSource = $dir break } } if (-not $payloadSource) { throw "Could not locate AttackTracer.msi in the installer temp directories" } Copy-Item -Path (Join-Path $payloadSource "*") -Destination $payloadDir -Recurse -Force $msiPath = Join-Path $payloadDir "AttackTracer.msi" if (-not (Test-Path $msiPath)) { throw "AttackTracer.msi was not copied into $payloadDir" } & msiexec /a $msiPath /qn TARGETDIR=$msiAdminDir $appExe = Join-Path $msiAdminDir "program files\Servolutions\BotFence\AttackTracer.exe" if (-not (Test-Path $appExe)) { throw "Deployed application executable not found at $appExe" } & $ilspy -p -o $decompiledDir $appExe Write-Host "Payload extracted to: $payloadDir" Write-Host "MSI admin image: $msiAdminDir" Write-Host "Decompiled sources: $decompiledDir" } finally { if ($proc -and -not $proc.HasExited) { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }