def main()

in cortado/rtas/lateral_commands.py [0:0]

• 51 lines of code
• 10 McCabe index (conditional complexity)

def main():
    remote_host = _common.get_host_ip()
    log.info("Attempting to laterally move to %s" % remote_host)

    remote_host = _common.resolve_hostname(remote_host)
    log.info("Using ip address %s" % remote_host)

    # Put the hostname in quotes for WMIC, but leave it as is
    if not re.match(_const.IP_REGEX, remote_host):
        wmi_node = f'"{remote_host}"'
    else:
        wmi_node = remote_host

    commands = [
        "sc.exe \\\\{host} create test_service binPath= %s" % MY_APP_EXE,
        "sc.exe \\\\{host} config test_service binPath= c:\\windows\\system32\\ipconfig.exe",
        "sc.exe \\\\{host} failure test_service command= c:\\windows\\system32\\net.exe",
        "sc.exe \\\\{host} start test_service",
        "sc.exe \\\\{host} delete test_service",
        "wmic.exe /node:{wmi_node} process call create ipconfig.exe",
        "wmic.exe /node:{wmi_node} path WIN32_USERACCOUNT where(name='vagrant') set passwordexpires='false'",
        "net.exe time \\\\{host}",
        "net.exe use \\\\{host}\\admin$",
        "net.exe use \\\\{host}\\admin$ /delete",
        "net.exe use \\\\{host}\\c$",
        "net.exe use \\\\{host}\\c$ /delete",
    ]

    for command in commands:
        formatted_command = command.format(host=remote_host, wmi_node=wmi_node)
        _ = _common.execute_command(formatted_command, shell=True)

    _, whoami, _ = _common.execute_command("whoami", shell=True)
    _, hostname, _ = _common.execute_command("hostname", shell=True)

    if not whoami or not hostname:
        raise _common.ExecutionError("Can't get `whoami` or `hostname` command results")

    whoami = whoami.lower()

    separator = "\\\\"
    domain, _, _ = whoami.partition(separator)  # type: ignore
    hostname = hostname.lower()
    schtasks_host = remote_host

    # Check if the account is local or a domain
    if domain in (hostname, "NT AUTHORITY"):
        log.info(
            "Need password for remote scheduled task in workgroup. Performing instead on %s." % _common.get_host_ip()
        )
        schtasks_host = _common.get_host_ip()

    task_name = "test_task-%d" % os.getpid()
    schtask_commands = [
        r"schtasks /s {host} /delete /tn {name} /f",
        r"schtasks /s {host} /create /SC MONTHLY /MO first /D SUN /tn {name} /tr c:\windows\system32\ipconfig.exe /f",
        r"schtasks /s {host} /run /tn {name}",
        r"schtasks /s {host} /delete /tn {name} /f",
    ]

    for command in schtask_commands:
        command = command.format(host=schtasks_host, name=task_name)
        _ = _common.execute_command(command, shell=True)

    # Remote powershell
    _ = _common.execute_command(["C:\\Windows\\system32\\wsmprovhost.exe", "-Embedding"], timeout_secs=5)