Hack Forums
[Public Release] CLF3 - Never Lose Access Ever Again - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: [Public Release] CLF3 - Never Lose Access Ever Again (/showthread.php?tid=5651645)

Pages: Pages 1 2

[Public Release] CLF3 - Never Lose Access Ever Again - JoshuaSmith - Jun 20, 2017

Today I'm releasing my spreader that i made and was selling but due to work and life i don't have a lot of time anymore so we are here.
This release may not be fud but when i have time ill go back and fud it.




Coming Soon!:
[Image: bf487832eb0b31e4fcd58494cd1ba0f7.png]
  • Upcomming Functions:

  • Running Sandboxed.

  • Running with Full UAC

  • Java Check

  • Install Name

  • HWID Check




Like i stated many times when i get free time ill be adding some more to this and ill be keeping the entire project free as i cba to sell it anymore.


Bugs:
Code
None that i know of but i only opened the project to remove the login system and haven't really checked other than that..
  • Software Notes:

  • Made In Delphi

  • Comes with UPX

  • Functions:

  • Upload/Execute

  • Reboot/Shutdown PC

  • Builder Functions:

  • Mutex

  • Start Name

  • Enable/Disable Startup(New Version)

  • Compress With UPX

  • Install Dialog Option





[Image: 15b23f5a25f7dccecf04f10f90fea7a2.png]

[Image: ae6bf56ac0afdc01cfa30c785c3c34bd.png]






Download(Startup Auto Enabled):
https://mega.nz/#!ERoSQJ5b!cZ3XfOS2A_yzvMEwSMwoOH4jc7Z2sZ66Gt3MR3FoZyc


Download(Choose To Enable/Disable Startup):
https://mega.nz/#!8VJmhSjR!ns5zD0b5nrATvdoZ-SkXxbGjVDoKtsyd_xMtG5gWeZE



Scan Of The Zip(Download Choose To Enable/Disable Startup):
https://www.virustotal.com/en/file/9f35a44221010edc20b31ffc2d5dcc24b0f4c7ec28ebd189793422a5aabc1cbb/analysis/1498167421/

Scan Of The Zip(Download Startup Auto Enabled):
https://www.virustotal.com/en/file/37888c747d986923ab889f34d23a5b8bc7983bdfe3ccb67c0a586ed5f01a4d11/analysis/1498003359/

Best Regards,
-Josh(akaMeltDown)

* - QU⚡CKSILVER - Jun 20, 2017

''Spreader''... Does it actually spread itself after execution? All I see is a small CnC that allows you to upload and execute.
You should make startup an optional thing upon building, though. Dropping to %temp% and using registry startup is not convenient and triggers certain antiviruses.

* - JoshuaSmith - Jun 20, 2017

(Jun 20, 2017 04:40 PM)QU⚡CKSILVER Wrote:  ''Spreader''... Does it actually spread itself after execution? All I see is a small CnC that allows you to upload and execute.
You should make startup an optional thing upon building, though. Dropping to %temp% and using registry startup is not convenient and triggers certain antiviruses.

i had that in play when it was in development if i get time ill do it.

* - QU⚡CKSILVER - Jun 20, 2017

Alright, thanks for the contribution.

* - Avira - Jun 20, 2017

"Never Loose Access Again!"

Lose*

Also, may you enlighten us on what "never lose access" actually means?

Once this shit hits an MSE detection everyone will lose access.

* - Armada - Jun 20, 2017

Gotta be totally honest here.

No idea what the fuck this is suppose to actually do????

So it connects to your Controller. But has zero functions. How exactly would using this software ensure I "never lose a client again" ?

This is nothing more than a Client/Server application that does nothing more than check in to the controller, and change themes....

* - JoshuaSmith - Jun 21, 2017

(Jun 20, 2017 05:24 PM)Armada Wrote:  Gotta be totally honest here.

No idea what the fuck this is suppose to actually do????

So it connects to your Controller. But has zero functions. How exactly would using this software ensure I "never lose a client again" ?

This is nothing more than a Client/Server application that does nothing more than check in to the controller, and change themes....

You use it as a middle man, spreading this allows your to keep your main file hidden until your ready to attack. tbh i was going to have more functions that would help spread its self but as i stated i just don't have time.

(Jun 20, 2017 05:16 PM)Avira Wrote:  "Never Loose Access Again!"

Lose*

Also, may you enlighten us on what "never lose access" actually means?

Once this shit hits an MSE detection everyone will lose access.

first thanks for pointing out the miss spelling buddy but next time please try to be a bit nicer about it. MSE is simple to bypass and the project had much more in store when i was in development. Plus i would refud the stub if needed and the paid clients would of got an update + alert.

ill keep adding when i get time to work on it and release free updates.

Edit: If your spell checking the video dude i did that to represent an infinity sign but after i notice it looked like shit i remove it. the video is a bit out dated.

* - Armada - Jun 21, 2017

(Jun 21, 2017 12:44 AM)xmods1337 Wrote:  You use it as a middle man, spreading this allows your to keep your main file hidden until your ready to attack. tbh i was going to have more functions that would help spread its self but as i stated i just don't have time.

So this does have DL & EXE?

* - Avira - Jun 21, 2017

(Jun 21, 2017 12:44 AM)xmods1337 Wrote:  You use it as a middle man, spreading this allows your to keep your main file hidden until your ready to attack. tbh i was going to have more functions that would help spread its self but as i stated i just don't have time.


first thanks for pointing out the miss spelling buddy but next time please try to be a bit nicer about it. MSE is simple to bypass and the project had much more in store when i was in development. Plus i would refud the stub if needed and the paid clients would of got an update + alert.

ill keep adding when i get time to work on it and release free updates.

Edit: If your spell checking the video dude i did that to represent an infinity sign but after i notice it looked like shit i remove it. the video is a bit out dated.

MSE will always detect after max 2 weeks depending on distribution.

* - JoshuaSmith - Jun 21, 2017

(Jun 21, 2017 09:00 AM)Armada Wrote:  So this does have DL & EXE?

No it has Upload and Execute.

(Jun 21, 2017 11:47 AM)Avira Wrote:  MSE will always detect after max 2 weeks depending on distribution.
I'm sorry to say this but your wrong.

* - Avira - Jun 21, 2017

(Jun 21, 2017 12:14 PM)xmods1337 Wrote:  No it has Upload and Execute.

I'm sorry to say this but your wrong.

How so?

Get someone to heavily distribute one of your stubs to win 10 builds and you'll see.

* - z3ro-cool - Jun 21, 2017

(Jun 21, 2017 12:27 PM)Avira Wrote:  How so?

Get someone to heavily distribute one of your stubs to win 10 builds and you'll see.
If someone heavily distribute it gets detected because people scan it in virustotal.

* - Armada - Jun 21, 2017

(Jun 21, 2017 12:14 PM)xmods1337 Wrote:  No it has Upload and Execute.

I'm sorry to say this but your wrong.

Holy shit I can not believe I missed that. LOL, My bad.

* - Avira - Jun 21, 2017

(Jun 21, 2017 12:29 PM)z3ro-cool Wrote:  If someone heavily distribute it gets detected because people scan it in virustotal.

Check the hash in vt, aslong as you use a properly developed downloader you will only have VT via third part software (Such as multiple endpoints and Process Hacker)

* - JoshuaSmith - Jun 22, 2017

(Jun 20, 2017 04:40 PM)QU⚡CKSILVER Wrote:  ''Spreader''... Does it actually spread itself after execution? All I see is a small CnC that allows you to upload and execute.
You should make startup an optional thing upon building, though. Dropping to %temp% and using registry startup is not convenient and triggers certain antiviruses.

I added a updated version to the post with now allows you to enable/disable startup.