[Demoralise]

This is a reflected file download (RFD) vulnerability.

http://www.google.com/finance/info;googl...gpedit.msc

How to use:

- Only browser this works in that I know of is Firefox (most recent version) and IE < 11.

- Change googlefinancepasswords.bat to the desired batch file name.

- Change gpedit.msc to the desired cmd command.

You're welcome :)

[Fleckens]

How can this be profitted? Let me know.

[Zenfex]

Thank you very much, good sir :)

[rezzex]

This actually works, tried with some Programs like notepad and all worked, the actually Program after it got opened gets a Error cause of wrong Arguments but it works :)

[Evolved ®]

What can you do with this...?

[Nuclear3mbargo]

Here is a talk about RFD
https://www.youtube.com/watch?v=dl1BJUNk8V4
How to monetize? Using social engineering.

[granz]

Yeah looks nice but hard to understand xD

[ronald51]

thanks a lot for this sharing, very handy.

[ThaVinci]

with bitsadmin command on Windows this works like a charm, google may fix this soon or I don't know, could be viral for ie and firefox users lol ;)

http://pastebin.com/tYngjb7P

[Demoralise]

with bitsadmin command on Windows this works like a charm, google may fix this soon or I don't know, could be viral for ie and firefox users lol ;)

http://pastebin.com/tYngjb7P

Very good implementation!

[gizmodo]

thanks, for the info..will try this tonight.

[๖ۣۜSyria]

I have a question what will this do?

[SIM-2212192]

Tried it on google chrome and microsoft edge, didn't seem to work on either, but maybe I'm just retarded.

Maybe it's only IE and FireFox like you said. ):

[DurkQ]

So, can I use this link to get my victim to download my RAT? Could somone please show me how...

[LaiLaiZhen]

where is your payload hosted for this exploit?