t3l3machus/hoaxshell

Don't use IE

moyvting opened this issue · 4 comments

moyvting commented

if you never used IE ,You can avoid this attack.
image

r4lix commented

good to know

corsch commented

Especially as IE is no longer visible on modern Windows systems.

I had the same issue on a testing machine. "Workaround" is to finish the IE Wizard.

effektsvk commented

That is due to Invoke-WebRequest, I think it's possible to replace it with Invoke-RestMethod. That is what I used in my script for downloading Google Chrome (https://github.com/effektsvk/getchrome-function). If I have the time, I will test it and submit a PR. :)

  • 👍1
t3l3machus commented

Thank you for your input @moyvting @corsch @effektsvk
This was really useful. I just added the -i option that generates the PS payload adjusted to use "Invoke-RestMethod' instead of 'Invoke-WebRequest', so now the user can choose.

  • 👍2