redcanaryco/atomic-red-team

Problem: T1218.005, the term 'invoke-athhtmlapplication' is not recognized as the name of a cmdlet, function, script file, or operable program. check the spelling of the name, or if a path was included, verify that the path is correct and try again.

dreambegins opened this issue · 3 comments

dreambegins commented

What did you do?

Invoke-AtomicTest T1218.005 -Session $session

What happened instead?

the term 'invoke-athhtmlapplication' is not recognized as the name of a cmdlet, function, script file, or operable program. check the spelling of the name, or if a path was included, verify that the path is correct and try again.

  • & {Invoke-ATHHTMLApplication -HTAFilePath C:\Test.hta -ScriptEngine J ...
  •

Your Environment

  • Which specific operating system are you running (e.g. Windows 7 SP1 32-bit)? windows 10 64 bit
  • Did you run the test from an elevated or root prompt? yes
  • If relevant, which atomic test is this specific to?
  • If relevant, which execution harness are you attempting to use?
dreambegins commented

Hi, I have already found where the problem is.
"the term 'invoke-athhtmlapplication' is not recognized as the name of a cmdlet..." is because that the remote host didn't install, import the "AtomicTestHarnesses" module.
I don't know why, but it seems like that the source code

get_prereq_command: |
#Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

didn't be executed.

In order to sovle this problem, I modify the source code like this"

executor:
command: |
Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
Import-Module AtomicTestHarnesses -Force
Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -AsLocalUNCPath -SimulateLateralMovement -MSHTAFilePath #{mshta_file_path}
name: powershell

Then, the T1218.005 can be executed correctly.

github-actions commented

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

github-actions commented

This issue was closed because it has been stalled for 5 days with no activity.