in cortado/rtas/unusual_kerberos_client.py [0:0]
def main():
exe_file = _common.get_resource_path("bin/renamed_posh.exe")
ps1_file = _common.get_resource_path("bin/Invoke-ImageLoad.ps1")
renamer = _common.get_resource_path("bin/rcedit-x64.exe")
posh = "C:\\Users\\Public\\posh.exe"
user32 = "C:\\Windows\\System32\\user32.dll"
dll = "C:\\Users\\Public\\System.DirectoryServices.Protocols.test.dll"
ps1 = "C:\\Users\\Public\\Invoke-ImageLoad.ps1"
rcedit = "C:\\Users\\Public\\rcedit.exe"
_common.copy_file(exe_file, posh)
_common.copy_file(user32, dll)
_common.copy_file(ps1_file, ps1)
_common.copy_file(renamer, rcedit)
log.info("Modifying the OriginalFileName attribute")
_ = _common.execute_command(
[
rcedit,
dll,
"--set-version-string",
"OriginalFilename",
"System.DirectoryServices.Protocols.test.dll",
]
)
log.info("Loading System.DirectoryServices.Protocols.test.dll")
_ = _common.execute_command(
[
posh,
"-c",
f"Import-Module {ps1}; Invoke-ImageLoad {dll};",
"Test-NetConnection",
"-ComputerName",
"portquiz.net",
"-Port",
"88",
],
timeout_secs=10,
)
_common.remove_files([posh, dll, ps1])