redcanaryco / invoke-atomicredteam

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.
MIT License
831 stars 195 forks source link

Atomic sudo #189

Closed dwhite9 closed 5 months ago

dwhite9 commented 6 months ago

The changes made below are intended to provide a new option when installing the atomic runner code on a *Nix machine that will allow it to be configured to use a different user account other than root. That account will require sudo access.

The code updates adds checks for this configuration, and prepends the sudo command before commands that require it. To make this not require a password, the "set-sudo" script will create a sudo config to allow passwordless sudo for the account configured during the invoke-SetupAtomicRunner script. It will prompt the user once for the password and then configure the account to no longer require it for sudo permission.

This optional config will only trigger if you run the Invoke-SetupAtomicRunner as a not-root account with sudo privileged. If run as root, then the normal behavior will be preserved.