Method executePsInject

workflow/executor_spawn.go:309–339

executePsInject executes unmanaged PowerShell (inject)

(ctx context.Context, client *csclient.Client, beaconID string, action Action)

// executePsInject executes unmanaged PowerShell (inject)
func (e *Executor) executePsInject(ctx context.Context, client *csclient.Client, beaconID string, action Action) (string, error) {
	pidVal, ok := action.Parameters["pid"]
	if !ok {
		return "", fmt.Errorf("pid parameter required for psinject")
	}
	var pid int
	switch v := pidVal.(type) {
	case float64:
		pid = int(v)
	case int:
		pid = v
	default:
		return "", fmt.Errorf("pid must be a number")
	}

	arch, ok := action.Parameters["arch"].(string)
	if !ok {
		return "", fmt.Errorf("arch parameter required for psinject")
	}
	commandlet, ok := action.Parameters["commandlet"].(string)
	if !ok {
		return "", fmt.Errorf("commandlet parameter required for psinject")
	}
	args, _ := action.Parameters["args"].(string) // optional

	resp, err := client.PsInject(ctx, beaconID, pid, arch, commandlet, args)
	if err != nil {
		return "", err
	}
	return e.waitForOutput(ctx, client, resp.TaskID)
}

// executeExecuteAssembly executes a .NET assembly
func (e *Executor) executeExecuteAssembly(ctx context.Context, client *csclient.Client, beaconID string, action Action) (string, error) {