[[PAYLOAD] Windows Persistent Reverse Shell]

On 7/24/2021 at 2:19 AM, EKwOrld said:

Any ideas on how to stop the automatic connection once it has started? 

Go to : AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Delete the vbs script.

Delete c:\temp\ncat.exe 

Kill the ncat process if it is still running. 

[[PAYLOAD] Windows Persistent Reverse Shell]

On 1/3/2020 at 7:32 PM, InfoSecFresh said:

Every time I try to run this on Win10 the ps script runs and once cmd.exe pops up there is an error message stating that Windows can not find the persistence.vbs file. I checked in the AppData directory referenced by the ps script and it is indeed not there. Even when I attempt to manually place it there it still doesn't work.

 

Any idea why?

Most likely Windows Defender. When I ran the bashbunny with this payload, it worked the first time, and then after that Windows defender did not like it.

But that is trivial to get around, just rename some fields and file names and it works fine.