def main()

in cortado/rtas/exec_scripting_persistence_locations.py [0:0]


def main():
    powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"

    log.info("Dropping executable to Startup Folder using powershell")
    _ = _common.execute_command(
        [
            powershell,
            "-C",
            "Copy-Item",
            "C:\\Windows\\System32\\cmd.exe",
            "'C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\'",
        ]
    )

    log.info("Dropping executable to Startup Folder using powershell")
    _ = _common.execute_command(
        [
            powershell,
            "-C",
            "Copy-Item",
            "C:\\Windows\\System32\\cmd.exe",
            "'C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\cmd2.exe'",
        ]
    )

    _common.remove_files(
        [
            "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\cmd2.exe",
            "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\cmd.exe",
        ]
    )