backdoorLnkMacroStagerCellEmbed. Powershell Empire 2.x stager that allows for creation of a macro which uses VBA to backdoor .lnk files on the system. This is done to obtain a shell via follow-up user interaction natively through powershell, in order to evade tools that monitor process execution. Data is embedded in .xls cells and called in the macro to evade detection. Backdoors are self-cleaning on execution.

github.com/G0ldenGunSec/backdoorLnkMacroStagerCellEmbed

Vaya's read on this project

Problem, audience, market, and the verdict — sign in to see it.

Updates

No recent activity.