Download and Execution Methods

Tools

https://github.com/danielbohannon/Invoke-CradleCrafter

In Memory

Net.WebClient DownloadString Method
Net.WebClient DownloadData Method
Net.WebClient OpenRead Method
.NET [Net.HttpWebReqest].class
Word.Application COM Object
Excel.Application COM Object
InternetExplorer.Application COM Object
MSXML2.ServerXmlHTTP Com Object
Certutil.exe w/ -ping argument

If possible use SSL on attacking machine and use HTTPS to further evade detection

Further evade detection by renaming scripts from .ps1 to something else such as .gif. Powershell can still execute .gif files as Powershell files.

Multi command scripts below can be converted to one line with ';' between commands.

On Disk

Net.WebClient DownloadFile Method
BITSAdmin.exe
Cerutil.exe w/ -urlcahche argument

Net.WebClient Download String Method

Net.WebClient Single Quotes Download and store

Net.WebClient User Agent Download

XML Download and execute.

One Line

Script Example

Last updated