-
-
Notifications
You must be signed in to change notification settings - Fork 555
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
28383b1
commit 4132dc3
Showing
36 changed files
with
1,763 additions
and
0 deletions.
There are no files selected for viewing
14 changes: 14 additions & 0 deletions
14
...AtlasModules/Toolbox/ConfigurationServices/ContextMenuTerminals/ContextMenuTeminals_0.reg
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| Windows Registry Editor Version 5.00 | ||
|
|
||
| [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked] | ||
| "{9F156763-7844-4DC4-B2B1-901F640F5155}"=- | ||
|
|
||
| [-HKEY_CLASSES_ROOT\TermsRunAsTI] | ||
|
|
||
| [-HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals] | ||
|
|
||
| [-HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals] | ||
|
|
||
| [-HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals] | ||
|
|
||
| [-HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals] |
384 changes: 384 additions & 0 deletions
384
...AtlasModules/Toolbox/ConfigurationServices/ContextMenuTerminals/ContextMenuTeminals_1.reg
Large diffs are not rendered by default.
Oops, something went wrong.
324 changes: 324 additions & 0 deletions
324
...AtlasModules/Toolbox/ConfigurationServices/ContextMenuTerminals/ContextMenuTeminals_2.reg
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,324 @@ | ||
| Windows Registry Editor Version 5.00 | ||
|
|
||
| [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked] | ||
| "{9F156763-7844-4DC4-B2B1-901F640F5155}"=- | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals] | ||
| "MUIVerb"="Terminals" | ||
| "SubCommands"="" | ||
| "Icon"="%windir%\\system32\\cmd.exe,0" | ||
| "NoWorkingDirectory"="" | ||
| "NeverDefault"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell] | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\cmd2] | ||
| "NeverDefault"="" | ||
| "Icon"="cmd.exe" | ||
| "Extended"="" | ||
| "NoWorkingDirectory"="" | ||
| @="Command Prompt" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\cmd2\command] | ||
| @="cmd.exe /s /k pushd \"%V\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\AtlasTerminals] | ||
| "NoWorkingDirectory"="" | ||
| "Extended"="" | ||
| "Icon"="PowerShell.exe" | ||
| "NeverDefault"="" | ||
| @="PowerShell" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\AtlasTerminals\command] | ||
| @="PowerShell.exe -noexit -command Set-Location -literalPath '%V'" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\Item10] | ||
| "CommandFlags"=dword:00000008 | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\Item2] | ||
| "NoWorkingDirectory"="" | ||
| @="Command Prompt (Admin)" | ||
| "Icon"="cmd.exe" | ||
| "Extended"="" | ||
| "NeverDefault"="" | ||
| "HasLUAShield"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\Item2\command] | ||
| @="PowerShell.exe -windowstyle hidden -Command \"Start-Process cmd.exe -ArgumentList '/s,/k,pushd,%V' -Verb RunAs\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\Item3] | ||
| @="PowerShell (Admin)" | ||
| "Extended"="" | ||
| "HasLUAShield"="" | ||
| "Icon"="PowerShell.exe" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\Item3\command] | ||
| @="PowerShell -WindowStyle Hidden -NoProfile -Command \"Start-Process -Verb RunAs PowerShell.exe -ArgumentList \\\"-NoExit -Command Push-Location \\\\\\\"\\\"%V/\\\\\\\"\\\"\\\"" | ||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\OpenPS] | ||
| "CommandFlags"=dword:00000008 | ||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\OpenPSAdmin] | ||
| "MUIVerb"="Command Prompt (System)" | ||
| "HasLUAShield"="" | ||
| "Icon"="%windir%\\system32\\cmd.exe,0" | ||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\OpenPSAdmin\command] | ||
| @="PowerShell.exe -win 1 -nop -c iex((10..40|%%{(gp 'Registry::HKCR\\TermsRunAsTI' $_ -ea 0).$_})-join[char]10); # --%% cmd /k pushd \"%V\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\OpenPSAdmin0] | ||
| "MUIVerb"="PowerShell (System)" | ||
| "Icon"="%windir%\\System32\\WindowsPowerShell\\v1.0\\PowerShell.exe,0" | ||
| "HasLUAShield"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\shell\AtlasTerminals\shell\OpenPSAdmin0\command] | ||
| @="PowerShell.exe -win 1 -nop -c iex((10..40|%%{(gp 'Registry::HKCR\\TermsRunAsTI' $_ -ea 0).$_})-join[char]10); # --%% PowerShell.exe -noexit -command Set-Location -literalPath '%V'" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals] | ||
| "MUIVerb"="Terminals" | ||
| "SubCommands"="" | ||
| "Icon"="%windir%\\system32\\cmd.exe,0" | ||
| "NoWorkingDirectory"="" | ||
| "NeverDefault"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell] | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\cmd2] | ||
| "NeverDefault"="" | ||
| "Icon"="cmd.exe" | ||
| "Extended"="" | ||
| "NoWorkingDirectory"="" | ||
| @="Command Prompt" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\cmd2\command] | ||
| @="cmd.exe /s /k pushd \"%V\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\AtlasTerminals] | ||
| "NoWorkingDirectory"="" | ||
| "Extended"="" | ||
| "Icon"="PowerShell.exe" | ||
| "NeverDefault"="" | ||
| @="PowerShell" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\AtlasTerminals\command] | ||
| @="PowerShell.exe -noexit -command Set-Location -literalPath '%V'" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\Item10] | ||
| "CommandFlags"=dword:00000008 | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\Item2] | ||
| "NoWorkingDirectory"="" | ||
| @="Command Prompt (Admin)" | ||
| "Icon"="cmd.exe" | ||
| "Extended"="" | ||
| "NeverDefault"="" | ||
| "HasLUAShield"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\Item2\command] | ||
| @="PowerShell.exe -windowstyle hidden -Command \"Start-Process cmd.exe -ArgumentList '/s,/k,pushd,%V' -Verb RunAs\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\Item3] | ||
| @="PowerShell (Admin)" | ||
| "Extended"="" | ||
| "HasLUAShield"="" | ||
| "Icon"="PowerShell.exe" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\Item3\command] | ||
| @="PowerShell -WindowStyle Hidden -NoProfile -Command \"Start-Process -Verb RunAs PowerShell.exe -ArgumentList \\\"-NoExit -Command Push-Location \\\\\\\"\\\"%V/\\\\\\\"\\\"\\\"" | ||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\OpenPS] | ||
| "CommandFlags"=dword:00000008 | ||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\OpenPSAdmin] | ||
| "MUIVerb"="Command Prompt (System)" | ||
| "HasLUAShield"="" | ||
| "Icon"="%windir%\\system32\\cmd.exe,0" | ||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\OpenPSAdmin\command] | ||
| @="PowerShell.exe -win 1 -nop -c iex((10..40|%%{(gp 'Registry::HKCR\\TermsRunAsTI' $_ -ea 0).$_})-join[char]10); # --%% cmd /k pushd \"%V\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\OpenPSAdmin0] | ||
| "MUIVerb"="PowerShell (System)" | ||
| "Icon"="%windir%\\System32\\WindowsPowerShell\\v1.0\\PowerShell.exe,0" | ||
| "HasLUAShield"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\LibraryFolder\shell\AtlasTerminals\shell\OpenPSAdmin0\command] | ||
| @="PowerShell.exe -win 1 -nop -c iex((10..40|%%{(gp 'Registry::HKCR\\TermsRunAsTI' $_ -ea 0).$_})-join[char]10); # --%% PowerShell.exe -noexit -command Set-Location -literalPath '%V'" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals] | ||
| "MUIVerb"="Terminals" | ||
| "SubCommands"="" | ||
| "Icon"="%windir%\\system32\\cmd.exe,0" | ||
| "NoWorkingDirectory"="" | ||
| "NeverDefault"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell] | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\cmd2] | ||
| "NeverDefault"="" | ||
| "Icon"="cmd.exe" | ||
| "Extended"="" | ||
| "NoWorkingDirectory"="" | ||
| @="Command Prompt" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\cmd2\command] | ||
| @="cmd.exe /s /k pushd \"%V\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\AtlasTerminals] | ||
| "NoWorkingDirectory"="" | ||
| "Extended"="" | ||
| "Icon"="PowerShell.exe" | ||
| "NeverDefault"="" | ||
| @="PowerShell" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\AtlasTerminals\command] | ||
| @="PowerShell.exe -noexit -command Set-Location -literalPath '%V'" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\Item10] | ||
| "CommandFlags"=dword:00000008 | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\Item2] | ||
| "NoWorkingDirectory"="" | ||
| @="Command Prompt (Admin)" | ||
| "Icon"="cmd.exe" | ||
| "Extended"="" | ||
| "NeverDefault"="" | ||
| "HasLUAShield"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\Item2\command] | ||
| @="PowerShell.exe -windowstyle hidden -Command \"Start-Process cmd.exe -ArgumentList '/s,/k,pushd,%V' -Verb RunAs\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\Item3] | ||
| @="PowerShell (Admin)" | ||
| "Extended"="" | ||
| "HasLUAShield"="" | ||
| "Icon"="PowerShell.exe" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\Item3\command] | ||
| @="PowerShell -WindowStyle Hidden -NoProfile -Command \"Start-Process -Verb RunAs PowerShell.exe -ArgumentList \\\"-NoExit -Command Push-Location \\\\\\\"\\\"%V/\\\\\\\"\\\"\\\"" | ||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\OpenPS] | ||
| "CommandFlags"=dword:00000008 | ||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\OpenPSAdmin] | ||
| "MUIVerb"="Command Prompt (System)" | ||
| "HasLUAShield"="" | ||
| "Icon"="%windir%\\system32\\cmd.exe,0" | ||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\OpenPSAdmin\command] | ||
| @="PowerShell.exe -win 1 -nop -c iex((10..40|%%{(gp 'Registry::HKCR\\TermsRunAsTI' $_ -ea 0).$_})-join[char]10); # --%% cmd /k pushd \"%V\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\OpenPSAdmin0] | ||
| "MUIVerb"="PowerShell (System)" | ||
| "Icon"="%windir%\\System32\\WindowsPowerShell\\v1.0\\PowerShell.exe,0" | ||
| "HasLUAShield"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Drive\shell\AtlasTerminals\shell\OpenPSAdmin0\command] | ||
| @="PowerShell.exe -win 1 -nop -c iex((10..40|%%{(gp 'Registry::HKCR\\TermsRunAsTI' $_ -ea 0).$_})-join[char]10); # --%% PowerShell.exe -noexit -command Set-Location -literalPath '%V'" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals] | ||
| "MUIVerb"="Terminals" | ||
| "SubCommands"="" | ||
| "Icon"="%windir%\\system32\\cmd.exe,0" | ||
| "NoWorkingDirectory"="" | ||
| "NeverDefault"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell] | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\cmd2] | ||
| "NeverDefault"="" | ||
| "Icon"="cmd.exe" | ||
| "Extended"="" | ||
| "NoWorkingDirectory"="" | ||
| @="Command Prompt" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\cmd2\command] | ||
| @="cmd.exe /s /k pushd \"%V\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\AtlasTerminals] | ||
| "NoWorkingDirectory"="" | ||
| "Extended"="" | ||
| "Icon"="PowerShell.exe" | ||
| "NeverDefault"="" | ||
| @="PowerShell" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\AtlasTerminals\command] | ||
| @="PowerShell.exe -noexit -command Set-Location -literalPath '%V'" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\Item10] | ||
| "CommandFlags"=dword:00000008 | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\Item2] | ||
| "NoWorkingDirectory"="" | ||
| @="Command Prompt (Admin)" | ||
| "Icon"="cmd.exe" | ||
| "Extended"="" | ||
| "NeverDefault"="" | ||
| "HasLUAShield"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\Item2\command] | ||
| @="PowerShell.exe -windowstyle hidden -Command \"Start-Process cmd.exe -ArgumentList '/s,/k,pushd,%V' -Verb RunAs\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\Item3] | ||
| @="PowerShell (Admin)" | ||
| "Extended"="" | ||
| "HasLUAShield"="" | ||
| "Icon"="PowerShell.exe" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\Item3\command] | ||
| @="PowerShell -WindowStyle Hidden -NoProfile -Command \"Start-Process -Verb RunAs PowerShell.exe -ArgumentList \\\"-NoExit -Command Push-Location \\\\\\\"\\\"%V/\\\\\\\"\\\"\\\"" | ||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\OpenPS] | ||
| "CommandFlags"=dword:00000008 | ||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\OpenPSAdmin] | ||
| "MUIVerb"="Command Prompt (System)" | ||
| "HasLUAShield"="" | ||
| "Icon"="%windir%\\system32\\cmd.exe,0" | ||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\OpenPSAdmin\command] | ||
| @="PowerShell.exe -win 1 -nop -c iex((10..40|%%{(gp 'Registry::HKCR\\TermsRunAsTI' $_ -ea 0).$_})-join[char]10); # --%% cmd /k pushd \"%V\"" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\OpenPSAdmin0] | ||
| "MUIVerb"="PowerShell (System)" | ||
| "Icon"="%windir%\\System32\\WindowsPowerShell\\v1.0\\PowerShell.exe,0" | ||
| "HasLUAShield"="" | ||
|
|
||
| [HKEY_CLASSES_ROOT\Directory\Background\shell\AtlasTerminals\shell\OpenPSAdmin0\command] | ||
| @="PowerShell.exe -win 1 -nop -c iex((10..40|%%{(gp 'Registry::HKCR\\TermsRunAsTI' $_ -ea 0).$_})-join[char]10); # --%% PowerShell.exe -noexit -command Set-Location -literalPath '%V'" | ||
|
|
||
| ; RunAsTI function | ||
| ; https://github.com/AveYo/LeanAndMean | ||
| [HKEY_CLASSES_ROOT\TermsRunAsTI] | ||
| "10"="function RunAsTI ($cmd,$arg) { $id='RunAsTI'; $key=\"Registry::HKU\\$(((whoami /user)-split' ')[-1])\\Volatile Environment\"; $code=@'" | ||
| "11"=" $I=[int32]; $M=$I.module.gettype(\"System.Runtime.Interop`Services.Mar`shal\"); $P=$I.module.gettype(\"System.Int`Ptr\"); $S=[string]" | ||
| "12"=" $D=@(); $T=@(); $DM=[AppDomain]::CurrentDomain.\"DefineDynami`cAssembly\"(1,1).\"DefineDynami`cModule\"(1); $Z=[uintptr]::size " | ||
| "13"=" 0..5|% {$D += $DM.\"Defin`eType\"(\"AveYo_$_\",1179913,[ValueType])}; $D += [uintptr]; 4..6|% {$D += $D[$_].\"MakeByR`efType\"()}" | ||
| "14"=" $F='kernel','advapi','advapi', ($S,$S,$I,$I,$I,$I,$I,$S,$D[7],$D[8]), ([uintptr],$S,$I,$I,$D[9]),([uintptr],$S,$I,$I,[byte[]],$I)" | ||
| "15"=" 0..2|% {$9=$D[0].\"DefinePInvok`eMethod\"(('CreateProcess','RegOpenKeyEx','RegSetValueEx')[$_],$F[$_]+'32',8214,1,$S,$F[$_+3],1,4)}" | ||
| "16"=" $DF=($P,$I,$P),($I,$I,$I,$I,$P,$D[1]),($I,$S,$S,$S,$I,$I,$I,$I,$I,$I,$I,$I,[int16],[int16],$P,$P,$P,$P),($D[3],$P),($P,$P,$I,$I)" | ||
| "17"=" 1..5|% {$k=$_; $n=1; $DF[$_-1]|% {$9=$D[$k].\"Defin`eField\"('f' + $n++, $_, 6)}}; 0..5|% {$T += $D[$_].\"Creat`eType\"()}" | ||
| "18"=" 0..5|% {nv \"A$_\" ([Activator]::CreateInstance($T[$_])) -fo}; function F ($1,$2) {$T[0].\"G`etMethod\"($1).invoke(0,$2)}" | ||
| "19"=" $TI=(whoami /groups)-like'*1-16-16384*'; $As=0; if(!$cmd) {$cmd='control';$arg='admintools'}; if ($cmd-eq'This PC'){$cmd='file:'}" | ||
| "20"=" if (!$TI) {'TrustedInstaller','lsass','winlogon'|% {if (!$As) {$9=sc.exe start $_; $As=@(get-process -name $_ -ea 0|% {$_})[0]}}" | ||
| "21"=" function M ($1,$2,$3) {$M.\"G`etMethod\"($1,[type[]]$2).invoke(0,$3)}; $H=@(); $Z,(4*$Z+16)|% {$H += M \"AllocHG`lobal\" $I $_}" | ||
| "22"=" M \"WriteInt`Ptr\" ($P,$P) ($H[0],$As.Handle); $A1.f1=131072; $A1.f2=$Z; $A1.f3=$H[0]; $A2.f1=1; $A2.f2=1; $A2.f3=1; $A2.f4=1" | ||
| "23"=" $A2.f6=$A1; $A3.f1=10*$Z+32; $A4.f1=$A3; $A4.f2=$H[1]; M \"StructureTo`Ptr\" ($D[2],$P,[boolean]) (($A2 -as $D[2]),$A4.f2,$false)" | ||
| "24"=" $Run=@($null, \"PowerShell -win 1 -nop -c iex `$env:R; # $id\", 0, 0, 0, 0x0E080600, 0, $null, ($A4 -as $T[4]), ($A5 -as $T[5]))" | ||
| "25"=" F 'CreateProcess' $Run; return}; $env:R=''; rp $key $id -force; $priv=[diagnostics.process].\"GetM`ember\"('SetPrivilege',42)[0]" | ||
| "26"=" 'SeSecurityPrivilege','SeTakeOwnershipPrivilege','SeBackupPrivilege','SeRestorePrivilege' |% {$priv.Invoke($null, @(\"$_\",2))}" | ||
| "27"=" $HKU=[uintptr][uint32]2147483651; $NT='S-1-5-18'; $reg=($HKU,$NT,8,2,($HKU -as $D[9])); F 'RegOpenKeyEx' $reg; $LNK=$reg[4]" | ||
| "28"=" function L ($1,$2,$3) {sp 'Registry::HKCR\\AppID\\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}' 'RunAs' $3 -force -ea 0" | ||
| "29"=" $b=[Text.Encoding]::Unicode.GetBytes(\"\\Registry\\User\\$1\"); F 'RegSetValueEx' @($2,'SymbolicLinkValue',0,6,[byte[]]$b,$b.Length)}" | ||
| "30"=" function Q {[int](gwmi win32_process -filter 'name=\"explorer.exe\"'|?{$_.getownersid().sid-eq$NT}|select -last 1).ProcessId}" | ||
| "31"=" $env:wt='PowerShell'; dir \"$env:ProgramFiles\\WindowsApps\\Microsoft.WindowsTerminal*\\wt.exe\" -rec|% {$env:wt='\"'+$_.FullName+'\" \"-d .\"'}" | ||
| "32"=" $11bug=($((gwmi Win32_OperatingSystem).BuildNumber)-eq'22000')-AND(($cmd-eq'file:')-OR(test-path -lit $cmd -PathType Container))" | ||
| "33"=" if ($11bug) {'System.Windows.Forms','Microsoft.VisualBasic' |% {$9=[Reflection.Assembly]::LoadWithPartialName(\"'$_\")}}" | ||
| "34"=" if ($11bug) {$path='^(l)'+$($cmd -replace '([\\+\\^\\%\\~\\(\\)\\[\\]])','{$1}')+'{ENTER}'; $cmd='control.exe'; $arg='admintools'}" | ||
| "35"=" L ($key-split'\\\\')[1] $LNK ''; $R=[diagnostics.process]::start($cmd,$arg); if ($R) {$R.PriorityClass='High'; $R.WaitForExit()}" | ||
| "36"=" if ($11bug) {$w=0; do {if($w-gt40){break}; sleep -mi 250;$w++} until (Q); [Microsoft.VisualBasic.Interaction]::AppActivate($(Q))}" | ||
| "37"=" if ($11bug) {[Windows.Forms.SendKeys]::SendWait($path)}; do {sleep 7} while(Q); L '.Default' $LNK 'Interactive User'" | ||
| "38"="'@; $V='';'cmd','arg','id','key'|%{$V+=\"`n`$$_='$($(gv $_ -val)-replace\"'\",\"''\")';\"}; sp $key $id $($V,$code) -type 7 -force -ea 0" | ||
| "39"=" start PowerShell -args \"-win 1 -nop -c `n$V `$env:R=(gi `$key -ea 0).getvalue(`$id)-join''; iex `$env:R\" -verb runas" | ||
| "40"="}; $A=,([environment]::commandline-split'-[-]%+ ?',2)[1]-split'\"([^\"]+)\"|([^ ]+)',2|%{$_.Trim(' \"')}; RunAsTI $A[1] $A[2]; # AveYo, 2023.07.06" | ||
| ; |
22 changes: 22 additions & 0 deletions
22
src/playbook/Executables/AtlasModules/Toolbox/ConfigurationServices/FIleSharing/disable.cmd
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| @echo off | ||
| set "script=%windir%\AtlasModules\Scripts\ScriptWrappers\DisableFileSharing.ps1" | ||
|
|
||
| if not exist "%script%" ( | ||
| echo Script not found. | ||
| echo "%script%" | ||
| pause | ||
| exit /b 1 | ||
| ) | ||
|
|
||
| set "___args="%~f0" %*" | ||
| fltmc > nul 2>&1 || ( | ||
| echo Administrator privileges are required. | ||
| powershell -c "Start-Process -Verb RunAs -FilePath 'cmd' -ArgumentList """/c $env:___args"""" 2> nul || ( | ||
| echo You must run this script as admin. | ||
| if "%*"=="" pause | ||
| exit /b 1 | ||
| ) | ||
| exit /b | ||
| ) | ||
|
|
||
| powershell -EP Bypass -NoP ^& """$env:script""" %* |
22 changes: 22 additions & 0 deletions
22
src/playbook/Executables/AtlasModules/Toolbox/ConfigurationServices/FIleSharing/enable.cmd
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| @echo off | ||
| set "script=%windir%\AtlasModules\Scripts\ScriptWrappers\EnableFileSharing.ps1" | ||
|
|
||
| if not exist "%script%" ( | ||
| echo Script not found. | ||
| echo "%script%" | ||
| pause | ||
| exit /b 1 | ||
| ) | ||
|
|
||
| set "___args="%~f0" %*" | ||
| fltmc > nul 2>&1 || ( | ||
| echo Administrator privileges are required. | ||
| powershell -c "Start-Process -Verb RunAs -FilePath 'cmd' -ArgumentList """/c $env:___args"""" 2> nul || ( | ||
| echo You must run this script as admin. | ||
| if "%*"=="" pause | ||
| exit /b 1 | ||
| ) | ||
| exit /b | ||
| ) | ||
|
|
||
| powershell -EP Bypass -NoP ^& """$env:script""" %* |
Oops, something went wrong.