"Cannot convert null to type System.DateTime" when installing

[nxtof]

Hello,

I'm trying to install Invoke-AtomicRedTeam as follows:

>  IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1')

> Install-AtomicRedTeam -Force
Installation of AtomicRedTeam Failed.
Cannot convert null to type "System.DateTime".

> Install-AtomicRedTeam -InstallPath "C:\Windows\Temp" -Force
Installation of AtomicRedTeam Failed.
Cannot convert null to type "System.DateTime".

As you can see, the installation seems to be failing for some reason. Some details:

• AV is disabled
• I tried performing the installation both with a normal user and local administrator account
• I'm running Windows 10.0.18363.719

Thank you!

[clr2of8]

Could you repeat using "Install-AtomicRedTeam -Force -Verbose" and send the output?

[nxtof]

Thanks for the blazing fast response! Here it is:

> Install-AtomicRedTeam -getAtomics -force -verbose
VERBOSE: Directory Creation
VERBOSE: Beginning download from Github
VERBOSE: GET https://github.com/redcanaryco/invoke-atomicredteam/archive/master.zip with 0-byte payload
VERBOSE: received -1-byte response of content type application/zip
VERBOSE: Extracting ART to C:\AtomicRedTeam
Installation of AtomicRedTeam Failed.
Cannot convert null to type "System.DateTime".

Contents of my C:\AtomicRedTeam:

> Get-ChildItem -Recurse C:\AtomicRedTeam\

    Directory: C:\AtomicRedTeam

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        4/16/2020   5:07 PM                invoke-atomicredteam

    Directory: C:\AtomicRedTeam\invoke-atomicredteam

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        4/16/2020   5:07 PM                Private
d-----        4/16/2020   5:07 PM                Public
-a----        4/13/2020  11:09 AM           3222 CODE_OF_CONDUCT.md
-a----        4/13/2020  11:09 AM           4752 install-atomicredteam.ps1
-a----        4/13/2020  11:09 AM           3544 install-atomicsfolder.ps1
-a----        4/13/2020  11:09 AM           4928 Invoke-AtomicRedTeam.psd1
-a----        4/13/2020  11:09 AM            672 Invoke-AtomicRedTeam.psm1
-a----        4/13/2020  11:09 AM           1078 LICENSE.txt
-a----        4/13/2020  11:09 AM           1234 README.md

    Directory: C:\AtomicRedTeam\invoke-atomicredteam\Private

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        4/13/2020  11:09 AM              0 .gitkeep
-a----        4/13/2020  11:09 AM           1282 AtomicClassSchema.ps1
-a----        4/13/2020  11:09 AM            195 Get-PrereqExecutor.ps1
-a----        4/13/2020  11:09 AM           1794 Get-TargetInfo.ps1
-a----        4/13/2020  11:09 AM            950 Invoke-CheckPrereqs.ps1
-a----        4/13/2020  11:09 AM           2117 Invoke-ExecuteCommand.ps1
-a----        4/13/2020  11:09 AM            423 Invoke-KillProcessTree.ps1
-a----        4/13/2020  11:09 AM           2271 Invoke-Process.ps1
-a----        4/13/2020  11:09 AM           1826 Replace-InputArgs.ps1
-a----        4/13/2020  11:09 AM           3017 Show-Details.ps1
-a----        4/13/2020  11:09 AM            689 Write-ExecutionLog.ps1
-a----        4/13/2020  11:09 AM            389 Write-KeyValue.ps1
-a----        4/13/2020  11:09 AM            590 Write-PrereqResults.ps1

    Directory: C:\AtomicRedTeam\invoke-atomicredteam\Public

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        4/13/2020  11:09 AM          22596 Get-AtomicTechnique.ps1
-a----        4/13/2020  11:09 AM          12425 Invoke-AtomicTest.ps1
-a----        4/13/2020  11:09 AM           1380 Invoke-MalDoc.ps1
-a----        4/13/2020  11:09 AM            863 Invoke-WebRequestVerifyHash.ps1
-a----        4/13/2020  11:09 AM          19775 New-Atomic.ps1

[nxtof]

And here's the output of Install-AtomicRedTeam -force -verbose (without--getAtomics`):

> Install-AtomicRedTeam -force -verbose
VERBOSE: Directory Creation
VERBOSE: Beginning download from Github
VERBOSE: GET https://github.com/redcanaryco/invoke-atomicredteam/archive/master.zip with 0-byte payload
VERBOSE: received 30933-byte response of content type application/zip
VERBOSE: Extracting ART to C:\AtomicRedTeam
Installation of AtomicRedTeam Failed.
Cannot convert null to type "System.DateTime".

[clr2of8]

Thank you! I'll check it out

[nxtof]

If I remove C:\AtomicRedTeam and try again with verbose mode turned on this is what I get:

VERBOSE: Directory Creation                                                                                                                                                                                                              VERBOSE: Beginning download from Github                                                                                                                                                                                                  VERBOSE: GET https://github.com/redcanaryco/invoke-atomicredteam/archive/master.zip with 0-byte payload                                                                                                                                  VERBOSE: received 30933-byte response of content type application/zip                                                                                                                                                                    VERBOSE: Extracting ART to C:\AtomicRedTeam                                                                                                                                                                                              VERBOSE: Loading module from path 'C:\Program
Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1'.
VERBOSE: Loading 'FormatsToProcess' from path 'C:\Program
Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.format.ps1xml'.                                                                                                                                              VERBOSE: Loading module from path 'C:\Program                                                                                                                                                                                            Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll'.                                                                                                                                   VERBOSE: Exporting cmdlet 'Find-Package'.                                                                                                                                                                                                VERBOSE: Exporting cmdlet 'Get-Package'.                                                                                                                                                                                                 VERBOSE: Exporting cmdlet 'Get-PackageProvider'.                                                                                                                                                                                         VERBOSE: Exporting cmdlet 'Get-PackageSource'.
VERBOSE: Exporting cmdlet 'Install-Package'.
VERBOSE: Exporting cmdlet 'Import-PackageProvider'.
VERBOSE: Exporting cmdlet 'Find-PackageProvider'.
VERBOSE: Exporting cmdlet 'Install-PackageProvider'.
VERBOSE: Exporting cmdlet 'Register-PackageSource'.
VERBOSE: Exporting cmdlet 'Save-Package'.
VERBOSE: Exporting cmdlet 'Set-PackageSource'.
VERBOSE: Exporting cmdlet 'Uninstall-Package'.
VERBOSE: Exporting cmdlet 'Unregister-PackageSource'.
VERBOSE: Importing cmdlet 'Find-Package'.
VERBOSE: Importing cmdlet 'Find-PackageProvider'.
VERBOSE: Importing cmdlet 'Get-Package'.
VERBOSE: Importing cmdlet 'Get-PackageProvider'.
VERBOSE: Importing cmdlet 'Get-PackageSource'.
VERBOSE: Importing cmdlet 'Import-PackageProvider'.
VERBOSE: Importing cmdlet 'Install-Package'.
VERBOSE: Importing cmdlet 'Install-PackageProvider'.
VERBOSE: Importing cmdlet 'Register-PackageSource'.
VERBOSE: Importing cmdlet 'Save-Package'.
VERBOSE: Importing cmdlet 'Set-PackageSource'.
VERBOSE: Importing cmdlet 'Uninstall-Package'.
VERBOSE: Importing cmdlet 'Unregister-PackageSource'.
Installation of AtomicRedTeam Failed.
Cannot convert null to type "System.DateTime".

[nxtof]

Not exactly sure why but if I debug it step by step in Powershell ISE it seems to work. Might be worth investigating though so I'll leave the issue open.

Thank you!

[clr2of8]

If you run this manually, do you get the convert error? import-module "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1" -verbose

[clr2of8]

Also, could you show output of "get-package P*"

[clr2of8]

closing now until we see it again and can debug more