new checks

plusplusxu · Jul 19, 2018 · d70f214 · d70f214
1 parent 7e982fb
commit d70f214
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -31,7 +31,7 @@ The following techniques are currently covered by this script:
 | T1197  | msiexec.exe  | MEMORY\PSWEBSTRING | winnt32 |
 | T1118  | diskshadow.exe  | MEMORY\PSWEBDATA | winrs |     
 | T1170  | esentutl.exe | MEMORY\PSWEBOPENREAD | bitsadmin regsrv32  | 
-| T1086  | replace.exe | MEMORY\NETWEBSTRING |
+| T1086  | replace.exe | MEMORY\NETWEBSTRING | waitfor |
 | T1121  | SyncAppvPublishingServer | MEMORY\NETWEBDATA | 
 | T1117  | hh.exe | MEMORY\NETWEBOPENREAD |
 | T1127  | ieexec.exe | MEMORY\PSWEBREQUEST |

diff --git a/runtests.bat b/runtests.bat
@@ -712,6 +712,15 @@ echo Command Excuted: winrs -r:http://127.0.0.1 calc.exe
 
 timeout 5
 
+REM Example: https://twitter.com/subtee/status/872244674609676288
+echo %time% %date% [+] Testing waitfor exec
+start "" cmd /c waitfor SDX & calc.exe
+timeout 3
+start "" cmd /c waitfor /s 127.0.0.1 /si SDX
+echo Execution Finished at %time% %date%
+echo Command Excuted: waitfor SDX & calc.exe
+echo Command Excuted: waitfor /s 127.0.0.1 /si SDX
+
 
 REM ---- EOF Custom Payloads ----