admin/JYenn-Misery
1
0
Fork 0
mirror of https://git.churchofmalware.org/JYenn/Misery synced 2026-09-22 05:27:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • e5169c7920 drop demo assets (Misery.png, MiseryVT.png, demo.gif) main JYenn 2026-09-15 00:16:55 +01:00
  • 2779081f52 syscall: skip the fake-return spoof under a CET shadow stack JYenn 2026-09-15 00:16:16 +01:00
  • 606850d3a5 worker shutdown, uncaught stealer exceptions, view window on demand JYenn 2026-09-15 00:09:57 +01:00
  • a2b9c69654 Polish README content and formatting JYenn 2026-09-04 01:08:33 +01:00
  • 96e6528cac fix dead emoji-width branch, drop unused src_len, close elevate_system handle leak JYenn 2026-09-02 22:54:01 +01:00
  • ce131b9173 drop the web panel; dual-key cookie decrypt + locked-browser handle-dup read JYenn 2026-08-30 21:17:16 +01:00
  • 041e426a7e string obfuscation at rest: per-string keys, arithmetic decrypt JYenn 2026-08-21 19:45:10 +01:00
  • 46c44a0fe2 2FA and wallet harvesters: Steam maFile, Electrum, Monero JYenn 2026-08-21 19:07:31 +01:00
  • b591f60056 crypto clipper and seed finder JYenn 2026-08-21 13:32:49 +01:00
  • 13e6ad7063 EtherHiding C2: resolve the TCP endpoint from a smart contract JYenn 2026-08-20 22:39:40 +01:00
  • 8ee9393ea4 restore the proven v20 flow; drop the fork+APC experiment JYenn 2026-08-20 22:06:24 +01:00
  • 813acd499f style: plain-language comments (no em dashes), brace style consistent with file JYenn 2026-08-18 23:40:21 +01:00
  • 9f883a64ef stealer: keep only lastpass/credman/protonpass with raw vault capture; drop bitwarden/1password/dashlane/nordpass/keeper/enpass/roboform (no at-rest break, unverified); pm_store_raw carries leveldb/sqlite blobs for offline crack (hashcat -m 6800, proton bcrypt user key); pretty-print loot json objects, terminal hides raw b64 JYenn 2026-08-18 23:37:30 +01:00
  • 99dfeec1df stealer: drop keepass + filezilla harvesters (KeePass never persists master passwords, FileZilla unverified); downgrade riot/roblox to raw-evidence mode; rockstar SSO cookies from CEF cookie DB (full 32-byte host-hash prefix), battlenet HKLM TLS identity; credman binary blobs base64'd, json_escape high-byte escapes JYenn 2026-08-18 22:43:19 +01:00
  • 500a8ad427 stealer: real-app verified keepass/winscp/mremoteng harvest fixes; walk_dirs BFS replaces MinGW recursive_directory_iterator (drops entries after deep recursion, missed Documents kdbx); keepass probes per-user/portable config bases + Documents kdbx scan; winscp 0x-prefix tolerance (real ini value has none); riot lockfile Config\ + ubisoft legacy tree probes JYenn 2026-08-18 20:55:43 +01:00
  • 52ae8479e6 stealer: loot json grouped as password_managers/games/network_clients/ai_assistants; mremoteng + mobaxterm v26 decryptors (dpapi entropy, aes cbc/cfb8/ecb, gcm-full, pbkdf2-sha1, master-pwd note); battle.net/rockstar harvesters fixed to real data locations (localappdata cache, programdata agent/settings, documents saves); ai-assistant harvest (claude desktop leveldb token, codex auth.json, gemini config/history, opencode auth.json); console app count + robot icons; readme harvest groups JYenn 2026-08-18 11:25:00 +01:00
  • 9642aa4d69 stealer: roblox .ROBLOSECURITY decrypted in-process from RobloxCookies.dat (json base64 Cookies/CookiesData + raw dpapi blob fallbacks, legacy leveldb string scan), minecraft launcher accounts carried whole (launcher_accounts/profiles json, multimc/prism accounts.json, prism default install path) JYenn 2026-08-18 00:28:57 +01:00
  • 8f650edf88 stealer: enpass+roboform extension stores, minecraft+roblox harvesters, 14-key pm json (console), readme harvest list; comment sweep across headers + modules (research facts kept, restatement removed), beacon.hpp wire-format fix rides here JYenn 2026-08-18 00:20:00 +01:00
  • 9fe60da236 cdn: tunnel ingress uses tunnel_host (was hardcoded, 404'd every deployment), recreate line carries tunnel_host + cf access tokens, worker.js header carries the deploy step JYenn 2026-08-18 00:19:58 +01:00
  • c5a859ba82 readme: tagline, emoji bullets, de-dup features vs how-it-works, vt section, personal note, tightened wrappers prose, unslopped JYenn 2026-08-16 22:25:40 +01:00
  • c458ffd065 docs: demo gif, readme rewrite, loopback examples, gitignore console history JYenn 2026-08-16 22:07:01 +01:00
  • a095619ba4 wrappers bases: launch agent by absolute %PUBLIC% path (office shells from system32; relative misery.exe never resolves - chains were download-only) JYenn 2026-08-16 22:07:00 +01:00
  • 510cc30fe6 wrappers: docm/xlsm macros from office-authored compiled bases (pyopenvba rebuilds write source-only streams whose auto-events never hook - root-caused and verified live), inject runtime url+filename into word docvars / excel cfg-sheet cells instead of rewriting vba; drop pptm (auto_open never fires, thispresentation unauthorable via automation); bases ship in wrappers_bases/; readme updated JYenn 2026-08-16 20:33:34 +01:00
  • 666fa30e69 wrappers: move lnk chain to companion .cmd (av fastpath flags any lnk-launched curl cmdline), chr-encode vba cradles for amsi/content scans, fluid clickfix layout, decoy pdf body text; docs: comment cleanup across sources (stale/duplicate/verbose), readme corrections (polyglot_exe_zip stage_url, full command table) JYenn 2026-08-16 17:38:41 +01:00
  • 921006eaae cradles: drop powershell -enc for cmd/curl chains (av flags the ps forms); readme: trim av research bloat JYenn 2026-08-16 15:25:21 +01:00
  • 765e609902 setup.py: drop unused os import (pyflakes clean across wrappers.py + setup.py) JYenn 2026-08-16 14:59:16 +01:00
  • d0b9b7da5a clickfix lure: rebuild to the real Cloudflare Turnstile challenge clone (per 0x204/ClickFix-Turnstile kit + MS Threat Intel binancepizza sample + inde.nz teardown): 'Just a moment...' title, light theme, 2.2s 'Checking if you are human' preloader before the widget appears, site-domain line, reCAPTCHA-style checkbox that turns #4285f4 with a checkmark, Ray ID footer, exact kit step wording, Verify button; dropped the dark overlay + observe code box (the '# comment' trick breaks -EncodedCommand, verified locally: 'Cannot process command because a command is already specified'); headless gate proven live - puppeteer navigator.webdriver + HeadlessChrome UA both blocked, trusted CDP click in real Edge lands the full 427-char command on the OS clipboard JYenn 2026-08-16 14:53:17 +01:00
  • b9038cf239 payload wrappers: clickfix_html format - fake Cloudflare 'Verify you are human' page that poisons the clipboard with a hidden PowerShell cradle on the checkbox click and shows Win+R / Ctrl+V / Enter steps; command rides XOR 0x83 + hex like the in-the-wild kits, headless and non-Windows visitors get a benign spinner (per 2026 ClickFix lures: Rapid7 DoubleDonut, MS Threat Intel, PhishEye BW kit); verified 61/61 in the end-to-end harness plus real-JS DOM run (both copy APIs fire, gate works) JYenn 2026-08-16 14:29:13 +01:00
  • 1776789ed7 payload wrappers: lnk opens an embedded decoy PDF before the cradle (decoy-first, per 2026 DPRK/Patchwork/MoonPeak LNK chains), lnk/polyglot_exe_zip now need pikepdf; docm/xlsm/pptm decoys upgraded (docx core props, xlsm currency format/bold header/widths, pptm fills template slide 0), decoy pool normalized to title/body pairs, html/polyglot_html pages show the decoy text; README: MOTW delivery notes + refreshed operator view screenshot (renamed MiseryOperatorView.png) JYenn 2026-08-16 04:53:04 +01:00
  • a88718429e payload wrappers: 9 filetype delivery formats via setup.py -p (docm/xlsm/pptm macros with real decoy content, lnk cradle, pdf attachment+OpenAction, OneDrive-style html smuggle, iso, exe+zip and exe+html polyglots), STAGE_URL option, --list-formats, per-format manifest entries, README section JYenn 2026-08-16 04:37:01 +01:00
  • e09954fcd9 loot command + dist artifacts: 'loot' dumps last STEAL_RESULT JSON raw (16384 cap, lock-guarded), setup.py emits dist/<OUT>.exe + <OUT>.manifest.json (config snapshot + sha256, no auth secret), --list-artifacts JYenn 2026-08-16 04:08:12 +01:00
  • 38990e708d console UX: msfconsole-style bot registry (per-bot key+outbox keyed by eph pubkey over the stateless beacon relay, so concurrent agents no longer trample one global key), bot select/list/all targeting, dynamic prompt, command history with up/down recall persisted to console_history.txt, TAB completion with double-tab listing; no-bot guard on target commands; shell/elevate system commands, agent crash logging, JPEG quality 90 JYenn 2026-08-16 03:50:04 +01:00
  • d534533c72 headless browser sessions: --headless=new for interactive+ghost, CDP recovery ladder (reattach on detach, Page.reload revive, bounded relaunch), stale DevToolsActivePort/Singleton cleanup on launch, last-frame replay so the view never blacks out, unsafe-swiftshader; boxed console banner JYenn 2026-08-16 03:18:09 +01:00
  • 198f1fcdab elevation: silent UAC bypass (PEB masquerade + CMSTPLUA/ICMLuaUtil) and SYSTEM token theft; wire elevate command JYenn 2026-08-16 01:12:29 +01:00
  • 8e64b360d7 ghost: seed sign-in cookies via CDP; Edge ABE vtable fix, 24H2 syscall sizes, relay chunked bodies JYenn 2026-08-16 00:29:40 +01:00
  • 11ce3c0def ghost: call SetBackupState before PrepareForBackup (VSS_E_BAD_STATE otherwise) JYenn 2026-08-15 22:02:00 +01:00
  • b02758ed1e ghost: copy profiles from VSS snapshots with plain-copy fallback JYenn 2026-08-15 21:59:04 +01:00
  • 0f48e974fc comments: fix stale claims, dedupe rationales, trim essays across src JYenn 2026-08-15 21:40:03 +01:00
  • 4073f259f3 docs: rewrite README (features, quick start, build, layout); correct hidden-desktop claims JYenn 2026-08-15 15:28:11 +01:00
  • 480c89ce6e cdp: occluded-renderer freeze fix; reattach/relaunch recovery; ghost nav, hvnc quality JYenn 2026-08-15 15:14:31 +01:00
  • c9ce88e507 hvnc: serialize session under one lock; direct-to-canvas capture; kill-on-close job JYenn 2026-08-15 05:41:11 +01:00
  • c559212825 build result text once; drop crash.log from repo JYenn 2026-08-15 05:33:30 +01:00
  • e05dee39dd ghost: stop() cleanup guard; log stopped only once JYenn 2026-08-15 05:30:49 +01:00
  • 61b5cd0caf docs: correct session table for CDP-rendered interactive browser; tidy hvnc code JYenn 2026-08-15 05:18:14 +01:00
  • c17155dc7f hvnc: CDP-rendered interactive browser view (DirectComposition is ungdi-capturable on hidden desktops) JYenn 2026-08-15 04:01:05 +01:00
  • 8d25dc2b15 hvnc: real-profile browser (quoted user-data-dir, copy once per session), double-buffered view paint JYenn 2026-08-15 03:51:59 +01:00
  • 2fa69c5e75 style: trim comment bloat in hvnc input/capture paths JYenn 2026-08-15 03:42:47 +01:00
  • 5633e841ef hvnc: split keyboard into CHAR (text) vs KEYDOWN whitelist to kill double chars, conditional activation/MOUSEACTIVATE to kill double clicks, persistent capture canvas to kill black flicker, forward DBLCLK JYenn 2026-08-15 03:41:14 +01:00
  • eb11e8ae79 hvnc: correct input synthesis (client coords, key lparam, real focus), stable diff resync; ghost profile-copy, beacon jitter/batching, console view rework JYenn 2026-08-15 03:38:13 +01:00
  • e549daeb4d docs: list harvested browsers and apps in stealer bullet JYenn 2026-08-15 00:32:16 +01:00
  • 4a3e3f1307 docs: restore README image sections JYenn 2026-08-15 00:31:08 +01:00
  • f3587510c7 docs: rewrite README with a feature bullet list JYenn 2026-08-15 00:30:26 +01:00
  • 314905126a transport: dirty-tile frame encoding, only send changed pixels JYenn 2026-08-15 00:30:22 +01:00
  • a7f0b17fef transport: ECDH P-256 key agreement, drop baked-in master key JYenn 2026-08-14 23:14:06 +01:00
  • 68b88f52c7 docs: tighten README wording JYenn 2026-08-14 22:25:04 +01:00
  • 009d7a2b1f agent: anti-analysis fingerprinting and self-healing WMI persistence JYenn 2026-08-14 22:21:45 +01:00
  • 06cb9147c2 builder/ghost hardening: persist master key, sweep stale ghost profiles JYenn 2026-08-14 22:21:41 +01:00
  • 0003817596 Console beacon transport: HTTP relay front-end, outbox queue, REGISTER on beacon poll JYenn 2026-08-14 20:44:04 +01:00
  • ff4dbf3f2b HVNC + Misery: hidden-desktop and ghosted browser sessions with encrypted C2 JYenn 2026-08-12 00:51:35 +01:00