#Salsatools #Install #Setup! #Hackplayers/#Salsa-tools Salsa Tools - #ShellReverse #TCP/#UDP/#ICMP/#DNS/#SSL/#BINDTCP and #AV bypass, #AMSI patched https://github.com/Hackplayers/Salsa-tools Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/BINDTCP and AV bypass, AMSI patched #Installing #Salsa-Tools #TCP #UDP #ICMP #DNS #BINDTCP #AVbypass #AV-bypass Salsa Tools - An AV-Safe Reverse Shell dipped on bellota sauce Salsa Tools is a collection of three different tools that combined, allows you to get a reverse shell on steroids in any Windows environment without even needing #PowerShell for it's execution. In order to avoid the latest detection techniques (AMSI), most of the components were initially written on C#. Salsa Tools was publicly released by Luis Vacas during his Talk “Inmersión en la explotación tiene rima” which took place during h-c0n in 9th February 2019. https://github.com/Hackplayers/Salsa-tools #EvilSalsa is the key ingredient of this recipe. It contains the #payload, which is executed on the system as it follows: as soon as the payloads starts, it runs System.Management.Automation.dll which creates a runspace . Within that runspace we have four types of shells (TCP / UDP / ICMP / DNS / BINDTCP). Once EvilSalsa is loaded, first thing first, the existence of c:\windows\system32\amsi.dll is checked. If it exists, it is patched using a home-cooked variant of #CyberArk and #Rastamouse bypasses. Mixing #EncrypterAssembly and #Evilsalsa #EncrypterAssembly can be used as a Python script or as a Exe binary. It encrypts the previously generated EvilSalsa. #Python usage: python encrypterassembly.py Bringing the Encrypted EvilSalsa to the table with SalseoLoader #SalseoLoader is in charge of loading the encrypted payload. Can be both compiled as a library or as an executable. If it is run as an executable, the chosen arguments must be provided when the executable is run. If it is compiled as a library, the descriptor "main" must be exported. Arguments are added using environmental variables. Visual Studio 2017 (or similar) Visual Studio 2017 Full-featured integrated development environment (IDE) for Android, iOS, Windows, web, and cloud Powerful IDE, free for students, open-source contributors, and individuals https://visualstudio.microsoft.com/downloads/ AV bypass Antivirus bypass Antivirus-bypass Bypass Antivirus Bypass-Antivirus #BypassAV #Bypass-AV Bypass AV Bypass AVS #AMSI patched patched #AMSIS AMSI is a generic interface standard that allows applications and services to integrate with any #antimalware product present on a machine. It provides enhanced #malware protection for users and their data, applications and workloads. AMSI is antimalware vendor agnostic, designed to allow for the most common malware scanning and pro ... https://www.youtube.com/watch?v=kLxWe1FrdLc

#OrCus #RAT #Windows ***PLEASE DON'T UPLOAD TO ANY ONLINE SCANNERS*** Best VPN IVACY? https://www.ivacy.com/special-offer-vpn/?aff=90669 ??Special shout out to Usama, thank you!!!!?? Discord: https://discord.gg/MABpJvc What is Orcus RAT? “Orcus RAT,” a product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. Its author maintains Orcus is a legitimate Remote Administration Tool that is merely being abused, but security experts say it includes multiple features more typically seen in malware known as a Remote Access Trojan. Yet the list of features and plugins advertised for this RAT includes functionality that goes significantly beyond what one might see in a traditional remote administration tool, such as DDoS-for-hire capabilities, and the ability to disable the light indicator on webcams so as not to alert the target that the RAT is active. ... https://www.youtube.com/watch?v=EilprJX0BoU