OperatorsKit/KIT/DelExclusion/delexclusion.cna

# author REDMED-X

beacon_command_register(
	"delexclusion", "Delete an exclusion from Windows Defender for a folder, file, process or extension.",
	"INFO:\nDelete an exclusion from Windows Defender for a folder, file, process or extension. \n\n" .
	"ARGUMENTS:\n[<exclusion type>]: specify one of the following exclusion types you want to delete: path (file/folder), process, extension.\n[<exclusion name>]: specify the exclusion data/name that you want to delete.\n\n" .
	"USAGE:\ndelexclusion <exclusion type> <exclusion data>\n\n" .
	"EXAMPLES:\ndelexclusion path C:\\Users\\Public\\Downloads\ndelexclusion process C:\\Windows\\System32\\example.exe\n\n");
	
alias delexclusion {
    $bid = $1;
    $excltype = $2;
    $excldata = $3;

    if ($excltype eq "") {
        berror($bid, "Please specify one of the following extension types: path | process | extension.\n");
        return;
    }

    if ($excltype eq "path" || $excltype eq "process" || $excltype eq "extension") {
        if ($excldata eq "") {
            berror($bid, "Please specify the exclusion data/name that you want to delete.\n");
            return;
        }
    }
    else {
        berror($bid, "This exclusion type isn't supported. Please specify one of the following options: path | process | extension.\n");
        return;
    }
	
    # Read in the right BOF file
    $handle = openf(script_resource("delexclusion.o"));
    $data   = readb($handle, -1);
    closef($handle);

    # Pack our arguments
    $arg_data  = bof_pack($bid, "zZ", $excltype, $excldata);

    blog($bid, "Tasked to add a new exclusion..");
    beacon_inline_execute($bid, $data, "go", $arg_data);
}


beacon_command_register(
	"delfirewallrule", "Delete a firewall rule.",
	"INFO:\nDelete a firewall rule using COM.\n\n" .
	"ARGUMENTS:\n[<rule name>]: the name of the firewall rule you want to delete.\n\n" .
	"USAGE:\ndelfirewallrule \"<rule name>\"\n\n" .
	"EXAMPLES:\ndelfirewallrule \"ExampleRuleName1\"\n\n");
	
alias delfirewallrule {
    $bid = $1;
    $name = $2;
	
    if ($name eq "") {
        berror($bid, "Please specify the name of the firewall rule you want to delete.\n");
        return;
    }
	
    # Read in the right BOF file
    $handle = openf(script_resource("DelFirewallRule/delfirewallrule.o"));
    $data   = readb($handle, -1);
    closef($handle);

    # Pack our arguments
    $arg_data  = bof_pack($bid, "Z", $name);

    blog($bid, "Tasked to delete a new firewall rule..");
    beacon_inline_execute($bid, $data, "go", $arg_data);
}


beacon_command_register(
	"dellocalcert", "Delete a local computer certificate from a specific store.",
	"INFO:\nDelete a local computer certificate from a specified store based on its unique thumbprint.\n\n" . 
	"ARGUMENTS:\n[<store name>]: the name of the certificate store from which to delete the certificate.\n[<thumbprint>]: the thumbprint of the certificate that you want to delete in format (all caps): AABBCCDDEEFF00112233445566778899AABBCCDD.\n\n" .
	"USAGE:\ndellocalcert <store name> <thumbprint>\n\n" .
	"EXAMPLES:\ndellocalcert ROOT AABBCCDDEEFF00112233445566778899AABBCCDD\n\n");
	

alias dellocalcert {
    $bid = $1;
	$store = $2;
    $thumbprint = $3;
	
	if ($store eq "") {
		berror($bid, "Please specify a valid local computer certificate store name like ROOT.\n");
		return;
	}

	if ($thumbprint eq "") {
		berror($bid, "Please specify the thumbprint for the certificate that you want to delete from the store.\n");
		return;
	}
	
    # Read in the right BOF file
    $handle = openf(script_resource("DelLocalCert/dellocalcert.o"));
    $data   = readb($handle, -1);
    closef($handle);

	# Pack our arguments
    $arg_data  = bof_pack($bid, "Zz", $store, $thumbprint);

	blog($bid, "Tasked to delete a certificate..");
    beacon_inline_execute($bid, $data, "go", $arg_data);
}