[FREE][FUD] MegaBot IRC and Webpanel Bot w/ Sources

[FREE][FUD] MegaBot IRC and Webpanel Bot w/ Sources - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: [FREE][FUD] MegaBot IRC and Webpanel Bot w/ Sources (/showthread.php?tid=4784153)

Pages: Pages 1 2

[FREE][FUD] MegaBot IRC and Webpanel Bot w/ Sources - airstryke - Apr 18, 2015

Hi folks,

today i'm offering you my free IRC and Webpanel Bot.
Grep it while it's FUD!

Features:
-IRC Control
-Webpanel
-Run C# Script
-Execute Command
-DDoS
-Download&Execute
-Update Webpanel URLs
-PasteBin fallback - update Webpanel URLs by doing a PasteBin post.
-Crash Taskmanager

Screenshots:
Spoiler (Click to View)

Usage:
Spoiler (Click to View)

Virus Total:
Spoiler (Click to View)

Download Builder:
Spoiler (Click to View)

Download Sources:
Spoiler (Click to View)

+rep appreciated.
have fun!

* - Blacka Black - Apr 18, 2015

Going to give megabot a try , will let you know how it goes.

* - Kumara - Apr 18, 2015

Be careful while running this, 14 posts on a user isn't very safe, in my opinion. Please wait for a trusted member to make sure the file is safe.

* - Darknetwork - Apr 18, 2015

It was obvious, but don't try it.
https://malwr.com/analysis/ZGE3NGEyNDAwZTI0NDUxMWE2OTc0YWNiYmRlMzY4NjM/

* - Kumara - Apr 18, 2015

Please look before you use any scanner. Malwr distributes files. They scan with VirusTotal, too.

* - Darknetwork - Apr 18, 2015

(Apr 18, 2015 05:27 PM)Greenpoison Wrote: Please look before you use any scanner. Malwr distributes files. They scan with VirusTotal, too.

Dude. It's a fake. Who the fuck cares if I scan it on Malwr or Virustotal ? If it gets detected faster, that's a good thing for this moron, trying to infect people here.

* - Kumara - Apr 18, 2015

Not for the people that are using the same crypter he is using. That's just a dick move. I'm pretty sure he was using MSIL crypter, anyways. That crypter is widely used.

* - Darknetwork - Apr 18, 2015

(Apr 18, 2015 05:35 PM)Greenpoison Wrote: Not for the people that are using the same crypter he is using. That's just a dick move. I'm pretty sure he was using MSIL crypter, anyways. That crypter is widely used.

You're right. I'll maybe do it in a different way next time.

* - Kumara - Apr 18, 2015

No hard feelings, though. Just use http://www.refudme.com/ or http://scan.majyx.net/

They don't distribute any files for testing.

* - xx 0x0 xx - Apr 18, 2015

will i think it's backdoored so dont use before real analyzing

* - shitface - Apr 18, 2015

(Apr 18, 2015 05:44 PM)Greenpoison Wrote: No hard feelings, though. Just use hxxxxx/ or httpxxxxx/

They don't distribute any files for testing.

After reading all your posts on this thread, I'm diagnosing you with extreme autism.

* - airstryke - Apr 19, 2015

hi, the positives are due to the fact that the builder injects settings using reflection/mono.cecil and drops the exe from within a resource, and it contains the stub (which does
install itself to autorun - that's why malwr mocks up)

If in doubt, use dotnet reflector or compile by yourself. none of the files are crypted in any way.

(Apr 18, 2015 05:29 PM)Darknetwork Wrote: Dude. It's a fake. Who the fuck cares if I scan it on Malwr or Virustotal ? If it gets detected faster, that's a good thing for this moron, trying to infect people here.

before you call someone a moron, build the file by yourself, which isn't really much of a requriement.
as i told before, the files arent crypted, open them using dotnet reflector and you will see that they arent infected within a few minutes.

well, i could infect and FUD-crypt it, malwr wouldn't detect it any more, and you would feel safe oO

UPDATE

-removed LFI which allowed attacker to delete arbitrary files on the webserver
-Fixed Bot update Pass - bot wasn't being able to connect to server

Builder:
Spoiler (Click to View)

Virustotal:
Spoiler (Click to View)

Src:
Spoiler (Click to View)

edit:
ah fuck it, forgot updating update.php - please change by yourself after bot generation (file will be in sub-folder /webpanel):
Spoiler (Click to View)

(Apr 18, 2015 05:50 PM)Mats0o0o0 Wrote: will i think it's backdoored so dont use before real analyzing

there was an LFI which was not really a backdoor, but allowed an attacker to delete files on the server.
It has been fixed in the new version.
SQLIs are not possible because the webpanel is 100% file based.

* - d4rkcr0w - Apr 22, 2015

working as intendet - thanks for distributing!

* - airstryke - Apr 22, 2015

UPDATE

new features:
-process permanency: if someone trys killing your server.exe, system will produce a bluescreen. system shutdown/reboot/relog is still possible without bluescreen.
-Changed target framework to dotnet 2.0, for compatibility reasons with windows xp
-32/64 Bit UAC Bypass / User privilieg escallation (will inject into elevated process to use com to drop a dll which gets chainloaded by another process and makes server.exe run as admin.)
-fixed update.php

NOTE: you will have to chmod ./action.html and ./data to 666 or chown to webserver-user after uploading your webpanel.

Download:
(precompiled exe is in subdirectory .\Builder\bin\Debug\)
Spoiler (Click to View)

VirusTotal:
Spoiler (Click to View)

Detection Rate: 5 / 56
Reason: user privileg escallation
Solution: you will have to FUD crypt check32.exe and check64.exe, afterwards compile by yourself.
Only FUD-crypting the server.exe might possibly result in runtime detection!
next version will have the UAC bypass directly compiled in, so you won't have to crypt seperately. being honest, current version is just a sloppy workaround.
steps to compile:
-crypt checkX.exe files
-compile troy
-compile builder
-use builder to generate server.exe
-crypt server.exe (maybe not necessary because still FUD after crypting checkX.exe, but you never know.)

btw: feel free to use checkX.exe for your own reasons, simply add the command you want to run with elevated rights as a command line parameter.

(Apr 18, 2015 05:44 PM)Greenpoison Wrote: No hard feelings, though. Just use ...

They don't distribute any files for testing.

uhm - psssst offline scanning with multi engine scanners

(Apr 18, 2015 03:34 PM)Greenpoison Wrote: Be careful while running this, 14 posts on a user isn't very safe, in my opinion. Please wait for a trusted member to make sure the file is safe.

i would be really thankfull if a trusted member could analyze the files (it's a matter of about 5 minutes- open using some dotnet decompiler, search for networking functions, that's it.).

(Apr 18, 2015 05:35 PM)Greenpoison Wrote: Not for the people that are using the same crypter he is using. That's just a dick move. I'm pretty sure he was using MSIL crypter, anyways. That crypter is widely used.

did i understand you? you want me to crypt the stub? i'm sorry, but that's technically not possible, at least not with a standard crypter, because i have to inject the settings using reflection/cecil from within the builder. so crypting is something you will have to do by yourself. (crypting the stub before building the server.exe would have to leave the resources untouched, and inject them into the built assembly, which is what no crypter which is being resold or made availiable publically will do, because it would render the crypter userless for normal reasons.)

* - Darknetwork - Apr 22, 2015

Huh, I was drunk I guess. There's nothing wrong on the Malwr report ! No dropped files, no network connect, sorry !