jborean93

Thoughts on WDAC and Ansible

Current Behaviour

We execute the following bootstrap script:

try { [Console]::InputEncoding = [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding } catch { $null = $_ }

if ($PSVersionTable.PSVersion -lt [Version]"3.0") {
 '{"failed":true,"msg":"Ansible requires PowerShell v3.0 or newer"}'

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function New-ScheduledTaskSession {
    <#
    .SYNOPSIS
    Creates a PSSession for a process running as a scheduled task.

    .DESCRIPTION
    Creates a PSSession that can be used to run code inside a scheduled task

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Invoke-AsScheduledJob {
    <#
    .SYNOPSIS
    Runs a scriptblock as a scheduled job.

    .DESCRIPTION
    This is a helper function to run PowerShell code as a scheduled task.

jborean93

#!/usr/bin/env python3
# Copyright: (c) 2024, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
# PYTHON_ARGCOMPLETE_OK

# Big thanks to pysmb for help with the RPC structures
# https://github.com/miketeo/pysmb

from __future__ import annotations

jborean93

#!/usr/bin/env python3

# /// script
# dependencies = [
#   "bcrypt",
#   "cryptography >= 43.0.0",
#   "pyyaml",
# ]
# ///

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Module Ctypes

Function Split-ExeArgument {
    [OutputType([string])]
    [CmdletBinding()]
    param (
        [Parameter(Mandatory, ValueFromPipeline)]

jborean93

#!/usr/bin/python

import os.path
import subprocess
import sys
import xml.etree.ElementTree as ET

def main():
    iface = sys.argv[1]
    hook_case = sys.argv[2]

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Module Ctypes
#Requires -Version 7.3

Function Get-FileProcess {
    <#
    .SYNOPSIS
    Get the process that has opened the requested file.

jborean93

ctypes_struct WINTRUST_DATA {
    [int]$cbStruct
    [IntPtr]$pPolicyCallbackData
    [IntPtr]$pSIPClientData
    [int]$dwUIChoice
    [int]$fdwRevocationChecks
    [int]$dwUnionChoice
    [IntPtr]$pCatalog
    [int]$dwStateAction
    [IntPtr]$hWVTStateData

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

#Requires -Modules Ctypes
#Requires -Version 7.3

Function Get-SignedCatalogFile {
    <#
    .SYNOPSIS
    Gets the .cat file for the specified file.