+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: PowerShell Network Worm | Demo | Patched | (/showthread.php?tid=6268951)
PowerShell Network Worm | Demo | Patched | - Py_Dev - Apr 19, 2024
This is for learning purposes only! This script's UAC Bypass has been patched and will be flagged. This is strictly for education purposes and posses no REAL THREATS!!
UAC Bypass Attempt
This block attempts to bypass User Account Control (UAC) to run commands with elevated privileges without prompting the user:
Check if running as Administrator; Checks if the script is running with administrative privileges. If not, it tries to bypass UAC.
Registry Manipulation; Modifies the registry to hijack the file association for system settings, setting a new command that launches a PowerShell command with elevated privileges when fodhelper.exe is executed.
Execute and Clean; Runs fodhelper.exe to trigger the UAC bypass and then cleans up the registry changes to avoid detection.
Disable Firewall and Windows Defender
This section of the script disables critical security components:
Firewall; Disables the firewall for all profiles reducing the system's defenses against network attacks.
Windows Defender; Turns off real-time monitoring and other protective features in Windows Defender, making the system more vulnerable to malware.
Avoid Execution in Virtual Machines
Checks if the script is running inside a common virtual machine (VMware or VirtualBox). If it detects a VM, it exits immediately. This is typically done to avoid analysis in a virtualized environment.
Malicious Download and Execution
Download and Execute Malware; Downloads an executable from a specified URL and attempts to execute it. This is a common tactic used to deploy additional malware onto a compromised system.
Network Shares; Searches for network shares on the local machine or on the network, and if found, it places the malicious executable there, possibly to spread the malware across the network.
Persistence; Adds an entry to the registry to ensure the malware runs every time the system starts, achieving persistence.
Batch File Creation for Malware Execution
Batch Files; For every executable found in any network share, it creates a corresponding batch file designed to execute both the original executable and the newly downloaded malware. This ensures the malware executes in multiple locations, increasing its spread and impact.
WARNING: Potential SPAM or INFECTED LINK code
Spoiler (Click to View)
RE: PowerShell Network Worm | Demo | Patched | - DramaKing - Apr 19, 2024
This will be blocked by Defender.
RE: PowerShell Network Worm | Demo | Patched | - Py_Dev - Apr 20, 2024
(Apr 19, 2024 07:46 PM)DramaKing Wrote: This will be blocked by Defender.
I know it does, that why I said it in the title and description. This is just a proof of conceptt
RE: PowerShell Network Worm | Demo | Patched | - DramaKing - Apr 21, 2024
(Apr 20, 2024 01:28 AM)GTAF Wrote: I know it does, that why I said it in the title and description. This is just a proof of conceptt
I use dark mode. Glossed right over the red text.