Here's a prime example of some of the crap that I keep seeing in the Vault:
Run Out The Clock (PSP Avoidance)
Overview
PSP sandboxes typically have a set time limit they analyze a program for before making a decision. PSPs do not want
[to] impose unnecessarily long wait times on the user, which may cause the user to disable PSP components or try other products out of frustration. A common technique of exploiting this mechanism is using a Sleep-like call at the start of a program to 'run out the clock'. PSPs caught on and many will skip the sleep calls in their sandbox environment. To counteract this, Malware authors will call a meaningless function which performs some kind of task or calculation that takes a while to complete, before performing any malicious action. This makes it harder/impossible for PSPs to know what to skip, and the Malware can effectively 'run out the clock' while in a PSP sandbox.
Source Code
Code:
//Pseudocode, no promises that the following syntax/API function names are 100% correct
void WasteTime()
{
DWORD dwDeletes = 0;
WCHAR pszFileName[MAX_PATH] = {0};
srand(SystemTime);
dwDeletes = rand() + 100;
for (int i = 0; i < dwDeletes; i++)
{
Ge
}
}
Wowie Zowie... That's just riveting. So, this is worthy of passing around?
But wait, there's more...
Webcam Capture
Overview
There are two common ways to implement webcam capture on Windows systems that is documented in the public sector: DirectShow and VFW. Codeproject and other websites have simple examples that can be expanded as needed.
Source Code
- DarkComet RAT: Uses a DirectShow implementation to achieve webcam capture
Component Reuse
None
Gee...thanks Wikileaks. That's some pretty hefty knowledge, and it's great how there are 4 versions of the same page! I wonder what google has to say when one types "webcam hack"? It's probably not as informative. This is some serious deep State super top-secret shit here.
The more I read these, the more I question who is actually coming up with these "leaks". That is, how many people get together, get loaded, and dream up these dubious "secrets"? I also question if Assange is an agent or merely a dupe.
This last example shows the degree of professionalism the "CIA" employs in their work. You tell me if this shit looks legit to you.
Projects
OSB Projects
Ah yeah, OSB Projects y'all! You know we got the all the dankest trojans and collection tools for all your windows asset assist and QRC needs.
Aye Billy...me thinks Wikileaks 'as bin trollo-loled. Please feel free to share some of the "good stuff" when you find it.