shadowbrokers-exploits/windows/Resources/Tasking/Scripts/Include/_arpTasking.dsi

28 lines
680 B
Text
Raw Normal View History

sub _arpTasking(IN STRING $arpTxtFile, OUT STRING $arpCmd, OUT STRING $taskID, OUT STRING $targetID) {
echo "\nProcessing $arpTxtFile";
string $lines;
string $taskIDStr;
string $targetIDStr;
if (!ReadFile ($arpTxtFile, $lines)) {
return false;
}
for (int $i=0; $i < sizeof($lines); $i++) {
string $line = $lines[$i];
# TargetID is required
if (RegexMatch("TargetID", $line)) {
RegExSplit(" ", $line, 2, $targetIDStr);
$targetID = $targetIDStr[1];
}
# TaskID is required
if (RegexMatch("TaskID", $line)) {
RegExSplit(" ", $line, 2, $taskIDStr);
$taskID = $taskIDStr[1];
}
}
$arpCmd = "arp -query";
return true;
}