Create wmi-msbuild-evasion-domain.json

2018-06-21 08:26:24 +07:00 · 2018-06-21 08:26:24 +07:00 · aa023bdf1b
parent bd1d585efe
commit aa023bdf1b
1 changed files with 13 additions and 0 deletions
--- a/configs/wmi-msbuild-evasion-domain.json
+++ b/configs/wmi-msbuild-evasion-domain.json
@ -0,0 +1,13 @@
+{
+	"description": "Command exec payload Certutil and MSBuild Whitelisting Bypass using WMI \nEvasion technique set to domain check",
+	"template": "templates/payloads/wmi-msbuild-evasion-domain-template.vba",
+	"varcount": 150,
+	"encodingoffset": 3,
+	"chunksize": 200,
+	"encodedvars": 	{
+				"DOMAIN":"TEST"
+			},
+	"vars": 	[],
+	"evasion": 	["encoder", "domain"],
+	"payload": "INSERT YOUR PAYLOAD BASE64 MSBUILD XML HERE"
+}