i'm sorry dave

tmogged.cmd

<# :

:: I wonder who made Task Manager...

@setlocal DisableDelayedExpansion
@echo off

echo "%*" | find /i "-el" >nul && set _elev=1

set _PSarg="""%~f0""" -el

setlocal EnableDelayedExpansion

>nul fltmc || (
if not defined _elev powershell "start cmd.exe -arg '/c \"!_PSarg:'=''!\"' -verb runas" && exit /b
echo.
echo This script require administrator privileges.
echo To do so, right click on this script and select 'Run as administrator'.
pause
exit /b
)

set "psScript=%~f0" & powershell -nop -c "Get-Content """$env:psScript""" -Raw | iex" & exit /b
: #>

$license = '{"payload": "eyJrZXkiOiAiRUVFRUVFRUUtRUVFRS1FRUVFLUVFRUUtRUVFRUVFRUVFRUVFIiwgImVtYWlsSGFzaCI6ICJjODVlYTA2Y2YyOGJhNzhiMzEzZjgyYzIyYTE5YmIxMDNlZjlmODhlYzU5ZWEyN2ZiMzMxYmI2MTIzOGJiOGExIiwgIm1hY2hpbmVJZCI6ICI3ZjBiMWE5YWRhYjZmZTI2NDNkM2JlYzMyMDdhMjhiODdhNTc0ZWU4MTYzZmY2YTIyOWJjMzAzODc2NDZmMjY1IiwgImlzc3VlZEF0IjogNjcsICJ2IjogMSwgIm1heE1ham9yIjogOTksICJhY3RpdmF0aW9uTGltaXQiOiA5OTksICJpbnN0YW5jZUlkIjogIndoeSBkaWQgeW91IHB1dCBkcm0gaW4geW91ciB0YXNrIG1hbmFnZXIgZGF2ZSJ9", "signature": "UxkJR0szWKlG5qp+duwP2V7exn6sYNEyfgcwrKIk6FEeBw3suoFAKYg803n+ZQbhc6ouKWaBL23kZegA/UjeDg=="}'

function Patch-Exp($DLL) {
    $UserDLL = "$Env:LocalAppData\Programs\$DLL"
    $SystemDLL64 = "$Env:ProgramFiles\$DLL"
    $SystemDLL32 = "${Env:ProgramFiles(x86)}\$DLL"

    $Paths = @()

    if(Test-Path -Path $UserDLL) { $Paths += ,$UserDLL }
    if(Test-Path -Path $SystemDLL64) { $Paths += ,$SystemDLL64 }
    if(Test-Path -Path $SystemDLL32) { $Paths += ,$SystemDLL32 }

    foreach($Path in $Paths) {
        $Backup = "$Path.bak"
        if(Test-Path -Path $Backup) {
            Write-Host "$Path has already been patched! If you wish to restore the unpatched copy, delete $Path and rename $Path.bak to $Path"
        } else {
            Write-Host "Patching $Path"
            Copy-Item -Path $Path -Destination $Backup
            $Bytes = Get-Content $Path -Raw -Encoding Byte
            $String = $Bytes.ForEach('ToString', 'X2') -join ' '
            
            # Replace Ed25519 public key
            $String = $String -replace '\b49 5B AF 30 E6 68 BB F5 97 AC B8 40 89 32 D2 84 A4 39 C8 69 F1 51 59 3F D3 B4 BA 59 CC 51 9E 8E\b(.*)', '4F 77 EE 17 BE 32 31 7E 1F 57 7B 16 DC 21 CF 44 57 69 38 1D 76 22 B3 22 DC 8A 91 8C 6D 2A 3E 85$1'
            
            # Replace MachineGuid with MachoneGuid so license can be static
            $String = $String -replace '\b4D 00 61 00 63 00 68 00 69 00 6E 00 65 00 47 00 75 00 69 00 64 00\b(.*)', '4D 00 61 00 63 00 68 00 6F 00 6E 00 65 00 47 00 75 00 69 00 64 00$1'
            
            [byte[]]$ModifiedBytes = -split $String -replace '^', '0x'
            Set-Content -Path $Path -Value $ModifiedBytes -Encoding Byte
            Write-Host "Patched $Path"
        }
    }
}

function Install-License {
    New-Item "HKLM:\Software\Microsoft\Cryptography" -ErrorAction SilentlyContinue | Out-Null
    Set-ItemProperty -Path "HKLM:\Software\Microsoft\Cryptography" -Name "MachoneGuid" -Value "19f0670d-7bbc-4e8f-9d3d-98638304edb4" -ErrorAction SilentlyContinue
    $license | Out-File "$Env:LocalAppData\TMOG\license.json" -Encoding ascii
    Write-Host "Installed license"
}

Write-Host "Killing process"
Stop-Process -Name "Task Manager" -ErrorAction SilentlyContinue
Sleep 1

Write-Host "Patching EXE"
Patch-Exp "Task Manager TMOG\Task Manager.exe"

Write-Host "Installing license"
Install-License

Write-Host "Done"
pause

tmogzzz.py

from json import dumps
from base64 import b64encode
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

privkey = Ed25519PrivateKey.from_private_bytes(bytes.fromhex("ccf956b65cb1724f8d7ade4556cf432dbcc97ae8d36f5af9e01605f2a1fa3209"))

payload = {
    "key": "EEEEEEEE-EEEE-EEEE-EEEE-EEEEEEEEEEEE",
    "emailHash": "c85ea06cf28ba78b313f82c22a19bb103ef9f88ec59ea27fb331bb61238bb8a1",
    "machineId": "7f0b1a9adab6fe2643d3bec3207a28b87a574ee8163ff6a229bc30387646f265",
    "issuedAt": 67,
    "v": 1,
    "maxMajor": 99,
    "activationLimit": 999,
    "instanceId": "why did you put drm in your task manager dave"
}
data = dumps(payload).encode()

sig = privkey.sign(data)

license = {
    "payload": b64encode(data).decode(),
    "signature": b64encode(sig).decode()
}

with open("license.json", "w") as f:
    f.write(dumps(license))

print(privkey.public_key().public_bytes_raw().hex())

what the hell are these comments 😭

gem alert

That intro

58300.mp4

i can see there is a lot of elite illgeal hackers in this thread. just dont mess with me please and i dont have a problem.. thanks...

i have 1 quadrilion opsex level i know you all have the same ip:
127.0.0.1 and i'm currently hacking your mainframes

hell nah wth

lmaooooo

damn

tiago.-.@koptevo_.2095805918034235393.mp4

Whats happening?

it seems like you are trying to kill a process. would you like to try windows task manager?

the.man.behind.mp4

least obvious info stealer payload

-Name "MachoneGuid"

hell yeah my machone as a guid and I didn't know it!

amazing

same guy btw

omg

I cant seem to get it to work.

I cant seem to get it to work.

you need to sudo opsec first