Some Tricks

Published on August 4, 2017, classified as "strange and obscene"

Another posture of remote SCT

detail：https://posts.specterops.io/wsh-injection-a-case-study-fd35f79d29dd

Command line download pose 1

Command line download pose 2

Clear cache certutil - urlcache - split - F http://192.168.254.102:80/a.txt delete

Command line execution of remote JS

Command line remote vbs

Command line remote HTA