From d3dd71a06850d528129071582fc9addc50fbdea1 Mon Sep 17 00:00:00 2001
From: Ana Maria Martinez Gomez <ana.martinez@mandiant.com>
Date: Tue, 26 Sep 2023 17:26:36 +0200
Subject: [PATCH] Add unzip "infected" to right click menu

Add 7z unzip with password "infected" option to the right menu for the
most common extensions.
---
 packages/7zip-15-05.vm/7zip-15-05.vm.nuspec   |  6 ++--
 .../7zip-15-05.vm/tools/chocolateyinstall.ps1 | 13 +++++--
 .../tools/chocolateyuninstall.ps1             |  7 +++-
 packages/common.vm/common.vm.nuspec           |  2 +-
 .../common.vm/tools/vm.common/vm.common.psm1  | 34 +++++++++++++------
 5 files changed, 43 insertions(+), 19 deletions(-)

diff --git a/packages/7zip-15-05.vm/7zip-15-05.vm.nuspec b/packages/7zip-15-05.vm/7zip-15-05.vm.nuspec
index 1929cc48e..5ea1943ca 100644
--- a/packages/7zip-15-05.vm/7zip-15-05.vm.nuspec
+++ b/packages/7zip-15-05.vm/7zip-15-05.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>7zip-15-05.vm</id>
-    <version>15.05</version>
+    <version>15.05.0.20230926</version>
     <authors>Igor Pavlov</authors>
     <description>7-Zip file archiver. This version is able to extract NSIS scripts.</description>
     <dependencies>
-      <dependency id="common.vm" />
+      <dependency id="common.vm" version="0.0.0.20230926" />
     </dependencies>
   </metadata>
-</package>
\ No newline at end of file
+</package>
diff --git a/packages/7zip-15-05.vm/tools/chocolateyinstall.ps1 b/packages/7zip-15-05.vm/tools/chocolateyinstall.ps1
index 27bccaec8..50c9f4942 100644
--- a/packages/7zip-15-05.vm/tools/chocolateyinstall.ps1
+++ b/packages/7zip-15-05.vm/tools/chocolateyinstall.ps1
@@ -31,8 +31,15 @@ try {
   Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $executablePath
   VM-Assert-Path $shortcut
 
-  $executablePath = Join-Path $toolDir "7z.exe" -Resolve
-  Install-BinFile -Name $toolName -Path $executablePath
+  $7zExecutablePath = Join-Path $toolDir "7z.exe" -Resolve
+  Install-BinFile -Name $toolName -Path $7zExecutablePath
+
+  # Add 7z unzip with password "infected" to the right menu for the most common extensions.
+  # 7z can unzip other file extensions like .docx but these don't likely use the infected password.
+  $extensions = @(".7z", ".bzip2", ".gzip", ".tar", ".wim", ".xz", ".txz", ".zip", ".rar")
+  foreach ($extension in $extensions) {
+    VM-Add-To-Right-Click-Menu $toolName 'unzip "infected"' "`"$7zExecutablePath`" e -pinfected `"%1`"" "$executablePath" -extension $extension
+  }
 } catch {
   VM-Write-Log-Exception $_
-}
\ No newline at end of file
+}
diff --git a/packages/7zip-15-05.vm/tools/chocolateyuninstall.ps1 b/packages/7zip-15-05.vm/tools/chocolateyuninstall.ps1
index 20451faeb..55903ee60 100644
--- a/packages/7zip-15-05.vm/tools/chocolateyuninstall.ps1
+++ b/packages/7zip-15-05.vm/tools/chocolateyuninstall.ps1
@@ -11,4 +11,9 @@ VM-Remove-Tool-Shortcut $toolName $category
 Uninstall-BinFile -Name $toolName
 
 # Manually silently uninstall
-VM-Uninstall-With-Uninstaller "7-Zip 15.05*" "EXE" "/S"
\ No newline at end of file
+VM-Uninstall-With-Uninstaller "7-Zip 15.05*" "EXE" "/S"
+
+$extensions = @(".7z", ".bzip2", ".gzip", ".tar", ".wim", ".xz", ".txz", ".zip", ".rar")
+foreach ($extension in $extensions) {
+  VM-Remove-From-Right-Click-Menu $toolName -extension $extension
+}
diff --git a/packages/common.vm/common.vm.nuspec b/packages/common.vm/common.vm.nuspec
index 2c9aade53..b47c7b0aa 100755
--- a/packages/common.vm/common.vm.nuspec
+++ b/packages/common.vm/common.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>common.vm</id>
-    <version>0.0.0.20230925</version>
+    <version>0.0.0.20230926</version>
     <description>Common libraries for VM-packages</description>
     <authors>Mandiant</authors>
   </metadata>
diff --git a/packages/common.vm/tools/vm.common/vm.common.psm1 b/packages/common.vm/tools/vm.common/vm.common.psm1
index 85a05c5b8..e64c9a329 100755
--- a/packages/common.vm/tools/vm.common/vm.common.psm1
+++ b/packages/common.vm/tools/vm.common/vm.common.psm1
@@ -698,14 +698,20 @@ function VM-Add-To-Right-Click-Menu {
         [string] $menuIcon,
         [Parameter(Mandatory=$false)]
         [ValidateSet("file", "directory")]
-        [string] $type="file"
+        [string] $type="file",
+        [Parameter(Mandatory=$false)]
+        [string] $extension
     )
     try {
-        # Determine if file or directory should show item in right-click menu
-        if ($type -eq "file") {
-            $key = "*"
+        if ($extension) {
+          $key = "SystemFileAssociations\$extension"
         } else {
-            $key = "directory"
+          # Determine if file or directory should show item in right-click menu
+          if ($type -eq "file") {
+              $key = "*"
+          } else {
+              $key = "directory"
+          }
         }
         $key_path = "HKCR:\$key\shell\$menuKey"
 
@@ -716,7 +722,7 @@ function VM-Add-To-Right-Click-Menu {
 
         # Add right-click menu display name
         if (-NOT (Test-Path -LiteralPath $key_path)) {
-            New-Item -Path $key_path | Out-Null
+            New-Item -Path $key_path -Force | Out-Null
         }
         Set-ItemProperty -LiteralPath $key_path -Name '(Default)' -Value "$menuLabel" -Type String
         if ($menuIcon) {
@@ -740,14 +746,20 @@ function VM-Remove-From-Right-Click-Menu {
         [String] $menuKey, # name of registry key
         [Parameter(Mandatory=$true, Position=1)]
         [ValidateSet("file", "directory")]
-        [string] $type="file"
+        [string] $type="file",
+        [Parameter(Mandatory=$false)]
+        [string] $extension
     )
     try {
-        # Determine if file or directory should show item in right-click menu
-        if ($type -eq "file") {
-            $key = "*"
+        if ($extension) {
+          $key = "SystemFileAssociations\$extension"
         } else {
-            $key = "directory"
+          # Determine if file or directory should show item in right-click menu
+          if ($type -eq "file") {
+              $key = "*"
+          } else {
+              $key = "directory"
+          }
         }
         $key_path = "HKCR:\$key\shell\$menuKey"