73 lines
2.4 KiB
PowerShell
73 lines
2.4 KiB
PowerShell
$ErrorActionPreference = "Stop"
|
|
|
|
$repoRoot = Split-Path -Parent $PSScriptRoot
|
|
$setupExe = Join-Path $repoRoot "SetupAttackTracer.exe"
|
|
$payloadDir = Join-Path $repoRoot "payload"
|
|
$msiAdminDir = Join-Path $repoRoot "msi-admin"
|
|
$decompiledDir = Join-Path $repoRoot "decompiled\AttackTracer"
|
|
$ilspy = Join-Path $env:USERPROFILE ".dotnet\tools\ilspycmd.exe"
|
|
|
|
if (-not (Test-Path $setupExe)) {
|
|
throw "SetupAttackTracer.exe not found at $setupExe"
|
|
}
|
|
|
|
if (-not (Test-Path $ilspy)) {
|
|
throw "ilspycmd.exe not found at $ilspy"
|
|
}
|
|
|
|
New-Item -ItemType Directory -Force -Path $payloadDir | Out-Null
|
|
New-Item -ItemType Directory -Force -Path $msiAdminDir | Out-Null
|
|
New-Item -ItemType Directory -Force -Path $decompiledDir | Out-Null
|
|
|
|
$tempBefore = @(Get-ChildItem $env:TEMP -Directory | Select-Object -ExpandProperty FullName)
|
|
$proc = Start-Process -FilePath $setupExe -PassThru
|
|
Start-Sleep -Seconds 4
|
|
|
|
$tempAfter = @(Get-ChildItem $env:TEMP -Directory | Select-Object -ExpandProperty FullName)
|
|
$newTempDirs = Compare-Object $tempBefore $tempAfter |
|
|
Where-Object SideIndicator -eq "=>" |
|
|
Select-Object -ExpandProperty InputObject
|
|
|
|
try {
|
|
if (-not $newTempDirs) {
|
|
throw "No new temp directory detected while launching SetupAttackTracer.exe"
|
|
}
|
|
|
|
$payloadSource = $null
|
|
foreach ($dir in $newTempDirs) {
|
|
if (Test-Path (Join-Path $dir "AttackTracer.msi")) {
|
|
$payloadSource = $dir
|
|
break
|
|
}
|
|
}
|
|
|
|
if (-not $payloadSource) {
|
|
throw "Could not locate AttackTracer.msi in the installer temp directories"
|
|
}
|
|
|
|
Copy-Item -Path (Join-Path $payloadSource "*") -Destination $payloadDir -Recurse -Force
|
|
|
|
$msiPath = Join-Path $payloadDir "AttackTracer.msi"
|
|
if (-not (Test-Path $msiPath)) {
|
|
throw "AttackTracer.msi was not copied into $payloadDir"
|
|
}
|
|
|
|
& msiexec /a $msiPath /qn TARGETDIR=$msiAdminDir
|
|
|
|
$appExe = Join-Path $msiAdminDir "program files\Servolutions\BotFence\AttackTracer.exe"
|
|
if (-not (Test-Path $appExe)) {
|
|
throw "Deployed application executable not found at $appExe"
|
|
}
|
|
|
|
& $ilspy -p -o $decompiledDir $appExe
|
|
|
|
Write-Host "Payload extracted to: $payloadDir"
|
|
Write-Host "MSI admin image: $msiAdminDir"
|
|
Write-Host "Decompiled sources: $decompiledDir"
|
|
}
|
|
finally {
|
|
if ($proc -and -not $proc.HasExited) {
|
|
Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
|
|
}
|
|
}
|