infosecn1nja
/
MaliciousMacroGenerator
mirror of https://github.com/infosecn1nja/MaliciousMacroGenerator.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update recon-rename-wmi-cmd-evasion.json

patch-1
Mr.Un1k0d3r 2017-08-11 15:33:36 -04:00 committed by GitHub
parent 5fcd722dc8
commit ca72350b58
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
configs/recon-rename-wmi-cmd-evasion.json
View File

@ -1,15 +1,15 @@
{
"description": "Recon payload with powershell renaming, and PS command execution via WMI, including evasion",
"description": "Recon payload with powershell renaming, and PS command execution via WMI, including process check evasion",
"template": "templates/payloads/recon-rename-wmi-cmd-evasion.vba",
"varcount": 150,
"encodingoffset": 4,
"chunksize": 200,
"encodedvars":{
"URL":"FULL URL THAT LOGS POST REQUESTS",
"PROCESS_NAME":"outlook.exe",
"SRC": "C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe",
"DST": "FILENAME.EXE",
"TEMP": "TEMP"
"PROCESS_NAME":"outlook.exe",
"SRC": "C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe",
"DST": "FILENAME.EXE",
"TEMP": "TEMP"
},
"vars": [],
"evasion": ["encoder", "process"],