mirror/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-09-14 16:00:38 +02:00
Code Issues

Update Winget.yml (#384)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
unrooted 2024-08-18 00:52:52 +02:00 committed by GitHub
parent d5d11f47a1
commit 659a0240e8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
yml/OSBinaries/Winget.yml
View File

@ -5,12 +5,19 @@ Author: Paul Sanders
Created: 2022-01-03
Commands:
- Command: winget.exe install --manifest manifest.yml
Description: 'Downloads a file from the web address specified in manifest.yml and executes it on the system. Local manifest setting must be enabled in winget for it to work: "winget settings --enable LocalManifestFiles"'
Description: 'Downloads a file from the web address specified in manifest.yml and executes it on the system. Local manifest setting must be enabled in winget for it to work: `winget settings --enable LocalManifestFiles`'
Usecase: Download and execute an arbitrary file from the internet
Category: Execute
Privileges: Local Administrator - required to enable local manifest setting
MitreID: T1105
OperatingSystem: Windows 10, Windows 11
- Command: winget.exe install --accept-package-agreements -s msstore [name or ID]
Description: 'Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine. For example, use "Sysinternals Suite" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.'
Usecase: Download and install software from Microsoft Store, even if Microsoft Store App is blocked
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Users\user\AppData\Local\Microsoft\WindowsApps\winget.exe
Code_Sample:
@ -26,3 +33,4 @@ Resources:
Acknowledgement:
- Person: Paul
Handle: '@saulpanders'
- Person: Konrad 'unrooted' Klawikowski