+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.ly/Forum-Visual-Basic-NET-Framework)
+--- Thread: {Preview} SmurfClip (/Thread-Preview-SmurfClip)
Pages:
1
2
{Preview} SmurfClip - S3xySmurf - 08-19-2017
Here's a preview of my upcoming tool SmurfClip.
This tool is being developed for educational purposes only, this is not a finished project (Neither is the video) as of yet I'm still working on cleaning the code.
Give me feedback below and what you think.
RE: {Preview} SmurfClip - Nil - 08-19-2017
Interesting. I don't agree with this from a morality standpoint but since you specified for educational purposes only, I'll ask some questions.
How exactly does this work? Does the program only change what's in the clipboard when it finds a string at the particular length, or is it more involved?
RE: {Preview} SmurfClip - S3xySmurf - 08-19-2017
@GOD
After you run the .exe it waits until you reboot the system and activates the program, it will sit in the background waiting for a string between 26 - 34 characters and then when it detects a clipboard change with said BTC address and it replaces that address with one of my many addresses, it tries to pick an address closest to the copied address to remain hidden so to speak.
Also I understand your point from this morality standpoint well there is no moral high ground on this one, it's a dirty trick but it's effective to say the least.
RE: {Preview} SmurfClip - Nil - 08-19-2017
(08-19-2017, 07:14 AM)S3xySmurf Wrote: @GOD
After you run the .exe it waits until you reboot the system and activates the program, it will sit in the background waiting for a string between 26 - 34 characters and then when it detects a clipboard change with said BTC address and it replaces that address with one of my many addresses, it tries to pick an address closest to the copied address to remain hidden so to speak.
Also I understand your point from this morality standpoint well there is no moral high ground on this one, it's a dirty trick but it's effective to say the least.
That's what I figured. It would be interesting if it could be more involved as obviously if someone just copied something within that range, they'd know for certain they were infected after trying to paste.
Edit: I know there are some bitcoin validators out there, such as in python, but wouldn't know where to begin to code one myself. I believe valid ones start with either 1 or 3, so there's a start in making it more reliable.
RE: {Preview} SmurfClip - S3xySmurf - 08-19-2017
@GOD
I will definitely take a look at some of the validators to get a more refined method of replacing the address, thank you for your input.
Using the beginning and the end of an address to find a suitable replacement does work however I believe only a fool would actually fall for it, albeit saying that the internet is full of fools
I shall be back after my slumber, it has been a long night, my bed is calling for me.
RE: {Preview} SmurfClip - MesaGFX - 08-19-2017
Looks neat bro keep up the good work
RE: {Preview} SmurfClip - mothered - 08-19-2017
Looks promising.
What startup directories (example HKLM\Software\Microsoft\Windows\CurrentVersion\Run) does It Install In?
RE: {Preview} SmurfClip - S3xySmurf - 08-19-2017
@mothered
At the moment it uses the standard HKCU\Software\Microsoft\Windows\CurrentVersion\run
I'll be looking into other methods soon and I'm hoping for a UAC bypass using something along the lines of this https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
RE: {Preview} SmurfClip - S3xySmurf - 08-19-2017
@MesaGFX
I'm hoping it won't take me too long as I'm doing this in my spare time, but thanks man
RE: {Preview} SmurfClip - mothered - 08-20-2017
(08-19-2017, 06:26 PM)S3xySmurf Wrote: At the moment it uses the standard HKCU\Software\Microsoft\Windows\CurrentVersion\run
I'll be looking into other methods soon and I'm hoping for a UAC bypass using something along the lines of this https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
Just as I thought.
The mentioned startup registry entry Is a commonality. I look forward to your forthcoming Implementations.