diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..e6bf153 --- /dev/null +++ b/.github/CODE_OF_CONDUCT.md @@ -0,0 +1,3 @@ +This project adheres to **No Code of Conduct**. We are all adults. We accept anyone's contributions. Nothing else matters. + +For more information please visit the [No Code of Conduct](https://github.com/domgetter/NCoC) homepage. diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 42a22f7..ff42086 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -42,13 +42,20 @@ body: - type: dropdown attributes: - label: SO version + label: Platform + description: Where does the issue occur? options: - - Windows 11 - - Windows 10 - - Windows 8 - - Windows 7 - - Debian + - Web — Chrome (Blink) + - Web — Firefox (Gecko) + - Web — Safari (WebKit) + - Web — Other + - Desktop — macOS + - Desktop — Windows + - Desktop — Linux + - Desktop — Other + - Mobile — iOS + - Mobile — Android + - Mobile — Other - Other validations: required: true @@ -57,7 +64,7 @@ body: attributes: label: Confirmation options: - - label: I performed a [search of the issue tracker](https://github.com/segocode/Ramonware/issues) to avoid opening a duplicate issue + - label: I performed a [search of the issue tracker](https://github.com/{username}/{reponame}/issues) to avoid opening a duplicate issue required: true - label: I understand that not filling out this template correctly may lead to the issue being closed required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index aa0286a..7f83253 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,5 +1,5 @@ blank_issues_enabled: false contact_links: - name: Contact the developer - url: https://segocode.github.io/SegoCode/ + url: https://{username}.github.io/{username}/ about: To discuss any type of related topic diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml index 29da8e6..23c5ebc 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.yml +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -34,7 +34,7 @@ body: attributes: label: Confirmation options: - - label: I performed a [search of the feature requests](https://github.com/segocode/Ramonware/issues) to avoid suggesting a duplicate feature + - label: I performed a [search of the feature requests](https://github.com/{username}/{reponame}/issues) to avoid suggesting a duplicate feature required: true - label: I understand that not filling out this template correctly may lead to the request being closed - required: true \ No newline at end of file + required: true diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 0000000..df34996 --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1 @@ +If you discover a vulnerability in this application, that poses a significant threat to the security of the users, we recommend that you do not open a public issue. Instead, please send your report via [email](https://{username}.github.io/{username}/). Include as much detailed information as possible to help understand the nature of the vulnerability. diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml new file mode 100644 index 0000000..f16f194 --- /dev/null +++ b/.github/workflows/gitleaks.yml @@ -0,0 +1,64 @@ +name: Gitleaks +on: + push: + pull_request: + workflow_dispatch: + +jobs: + scan: + name: Gitleaks Scan + runs-on: ubuntu-latest + permissions: + contents: read + issues: write + steps: + - name: Checkout code + uses: actions/checkout@v7 + with: + fetch-depth: 0 + + - name: Run Gitleaks + id: gitleaks + uses: gitleaks/gitleaks-action@v3 + env: + GITHUB_TOKEN: ${{ github.token }} + continue-on-error: true + + - name: Create issue if leaks found + if: steps.gitleaks.outcome == 'failure' && (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') + env: + GH_TOKEN: ${{ github.token }} + run: | + echo "Creating detailed security issue report..." + + TIMESTAMP=$(date -u +"%Y-%m-%d %H:%M:%S UTC") + + ISSUE_BODY="## 🚨 Security Alert: Potential Secrets Detected + + **Detection Time:** ${TIMESTAMP} + **Branch:** ${GITHUB_REF#refs/heads/} + **Detected by:** Gitleaks Security Scanner + + ### Details + Gitleaks has detected one or more potential secrets or credentials in the codebase. + + ### Impact + Exposed secrets can lead to unauthorized access, data breaches, or account compromise. + + ### Next Steps + 1. Review the workflow logs for specific details about the detected secrets: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + 2. Revoke any exposed credentials immediately + 3. Remove the secrets from the codebase + 4. Consider using GitHub Secrets or environment variables instead + + --- + *This issue was automatically generated by the Gitleaks security scanning workflow.*" + + gh issue create \ + --repo "${{ github.repository }}" \ + --title "Security Alert: Potential secrets detected in main branch" \ + --body "${ISSUE_BODY}" + + - name: Fail if leaks were found + if: steps.gitleaks.outcome == 'failure' + run: exit 1 diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml index 0c71d41..2450362 100644 --- a/.github/workflows/greetings.yml +++ b/.github/workflows/greetings.yml @@ -1,6 +1,6 @@ name: Greetings -on: [pull_request_target] +on: [pull_request_target, issues] jobs: greeting: @@ -9,7 +9,8 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/first-interaction@v1 + - uses: actions/first-interaction@v3.1.0 with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - pr-message: "🎉 Thank you for your first pull request to the repository! We're grateful for your contribution and will review it ASAP." + repo_token: ${{ secrets.GITHUB_TOKEN }} + issue_message: "Thank you for your first issue. To better understand your request or the problem you've encountered, please provide as many details as possible. If the behavior changes or if you have new information about your request, don't hesitate to add it. It will be reviewed ASAP." + pr_message: "Thank you for your first pull request to the repository! We're grateful for your contribution and will review it ASAP." diff --git a/.github/workflows/initializer.yml b/.github/workflows/initializer.yml new file mode 100644 index 0000000..d22d4f7 --- /dev/null +++ b/.github/workflows/initializer.yml @@ -0,0 +1,100 @@ +name: Initialize repository + +on: + workflow_dispatch: + +concurrency: + group: initialize-repository + +jobs: + initialize_repo: + runs-on: ubuntu-latest + permissions: + contents: write + issues: write + pull-requests: write + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + ref: main + fetch-depth: 0 + + - name: Setup git + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + + - name: Extract repository and username + id: extract + run: | + echo "username=${{ github.repository_owner }}" >> "$GITHUB_OUTPUT" + echo "reponame=${{ github.event.repository.name }}" >> "$GITHUB_OUTPUT" + + - name: Create develop branch if it doesn't exist + run: | + if ! git ls-remote --exit-code --heads origin develop; then + git push origin HEAD:refs/heads/develop + fi + + - name: Replace {reponame} and {username} with actual values in non-workflow files + run: | + set -o pipefail + REPO_NAME_ONLY="${{ steps.extract.outputs.reponame }}" + USERNAME="${{ steps.extract.outputs.username }}" + git grep -Ilz '{reponame}' -- ':!.github/workflows/*' | xargs -0r sed -i "s/{reponame}/$REPO_NAME_ONLY/g" + git grep -Ilz '{username}' -- ':!.github/workflows/*' | xargs -0r sed -i "s/{username}/$USERNAME/g" + + - name: Remove initializer workflow + run: | + rm -f .github/workflows/initializer.yml + + - name: Commit changes + run: | + git checkout -B chore/initialize-repository + git add --all -- ':!.github/workflows' + git add .github/workflows/initializer.yml + git commit -m "chore: initialize repository" + git fetch origin chore/initialize-repository:refs/remotes/origin/chore/initialize-repository 2>/dev/null || true + git push --force-with-lease origin HEAD:chore/initialize-repository + + - name: Create pull request + env: + GH_TOKEN: ${{ github.token }} + run: | + PR_URL=$(gh pr list --repo "${{ github.repository }}" --base main --head chore/initialize-repository \ + --state open --json url --jq '.[0].url') + if [ -z "$PR_URL" ]; then + if ! PR_URL=$(gh pr create --repo "${{ github.repository }}" --base main --head chore/initialize-repository \ + --title "chore: initialize repository" \ + --body "Replace template placeholders, create the develop branch, and remove the one-time initializer." 2>&1); then + if [[ "$PR_URL" != *"not permitted to create or approve pull requests"* ]]; then + echo "$PR_URL" >&2 + exit 1 + fi + + ISSUE_TITLE="Action required: allow workflows to create pull requests" + ISSUE_BODY=$(printf '%s\n' \ + "The repository initializer could not create its pull request because GitHub Actions does not have permission." \ + "" \ + "To fix it:" \ + "" \ + "1. Open [Settings > Actions > General](https://github.com/${{ github.repository }}/settings/actions)." \ + "2. Under **Workflow permissions**, select **Read and write permissions**." \ + "3. Enable **Allow GitHub Actions to create and approve pull requests**." \ + "4. Save the changes." \ + "5. Run the [Initialize repository workflow](https://github.com/${{ github.repository }}/actions/workflows/initializer.yml) again.") + + EXISTING_ISSUE=$(gh issue list --repo "${{ github.repository }}" --state open --limit 100 \ + --json title,url --jq '.[] | select(.title == "Action required: allow workflows to create pull requests") | .url') + if [ -n "$EXISTING_ISSUE" ]; then + echo "Permission issue already exists: $EXISTING_ISSUE" + else + gh issue create --repo "${{ github.repository }}" --title "$ISSUE_TITLE" --body "$ISSUE_BODY" + fi + echo "$PR_URL" >&2 + exit 1 + fi + fi + echo "$PR_URL" diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml new file mode 100644 index 0000000..b512dcf --- /dev/null +++ b/.github/workflows/verify.yml @@ -0,0 +1,64 @@ +name: Verify + +on: + push: + branches: + - '**' + +jobs: + roundtrip: + name: Encryption roundtrip + runs-on: windows-latest + timeout-minutes: 5 + steps: + - uses: actions/checkout@v7.0.1 + + - name: Run prototype and assert encrypt roundtrip + shell: pwsh + run: | + $ErrorActionPreference = 'Stop' + $sandbox = Join-Path $env:RUNNER_TEMP 'ramonware-ci' + $probe = Join-Path $sandbox 'probe.txt' + $aes = "$probe.aes" + $log = 'C:\Original.txt' + $plain = [Text.Encoding]::UTF8.GetBytes('ramonware-integrity') + $pass = [guid]::NewGuid().ToString('N') + + if (Test-Path $sandbox) { Remove-Item $sandbox -Recurse -Force } + New-Item -ItemType Directory -Path $sandbox -Force | Out-Null + [IO.File]::WriteAllBytes($probe, $plain) + if (Test-Path $log) { Remove-Item $log -Force } + + function Replace-Exact($text, $old, $new, $expected = 1) { + $actual = [regex]::Matches($text, [regex]::Escape($old)).Count + if ($actual -ne $expected) { + throw "Expected $expected occurrence(s) of '$old', found $actual" + } + $text.Replace($old, $new) + } + + $sourcePath = Join-Path $env:GITHUB_WORKSPACE 'code\Ramonware.bat' + $batPath = Join-Path $sandbox 'RamonWare-ci.bat' + $utf8 = New-Object Text.UTF8Encoding $false + $bat = [IO.File]::ReadAllText($sourcePath) + $bat = Replace-Exact $bat 'set ROOT_PATH=%homedrive%\' "set pass=$pass`r`nset ROOT_PATH=$sandbox" + $bat = Replace-Exact $bat '*.labasset' '*.txt' + $bat = Replace-Exact $bat 'REM powershell -NoProfile' 'powershell -NoProfile' 2 + $bat = Replace-Exact $bat 'REM del "%%X"' 'del "%%X"' + $bat = Replace-Exact $bat 'cls' 'exit /b' + [IO.File]::WriteAllText($batPath, $bat, $utf8) + + $process = Start-Process -FilePath $env:ComSpec -ArgumentList '/d', '/c', "`"$batPath`"" -Wait -PassThru + if ($process.ExitCode -ne 0) { throw "RamonWare-ci.bat exited with $($process.ExitCode)" } + + if (-not (Test-Path $log) -or -not (Select-String -Path $log -Pattern 'probe.txt' -SimpleMatch -Quiet)) { + if (Test-Path $log) { Get-Content $log } + throw "Original.txt does not contain probe.txt" + } + + if (-not (Test-Path $aes)) { throw "missing $aes" } + + $restored = [IO.File]::ReadAllBytes($probe) + if ([Convert]::ToBase64String($plain) -ne [Convert]::ToBase64String($restored)) { + throw 'encrypt roundtrip failed' + } diff --git a/.gitignore b/.gitignore index 8d6fa21..280d3be 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,12 @@ -# Created by https://www.toptal.com/developers/gitignore/api/intellij+all,visualstudiocode,git,windows,linux -# Edit at https://www.toptal.com/developers/gitignore?templates=intellij+all,visualstudiocode,git,windows,linux +### Custom ### + +code/.idea/* + +# Created by https://www.toptal.com/developers/gitignore/api/git,gpg,ssh,vim,linux,macos,windows,notepadpp,sublimetext,intellij+all,visualstudiocode,dotenv +# Edit at https://www.toptal.com/developers/gitignore?templates=git,gpg,ssh,vim,linux,macos,windows,notepadpp,sublimetext,intellij+all,visualstudiocode,dotenv + +### dotenv ### +.env ### Git ### # Created by git for backups. To disable backups in Git: @@ -16,6 +23,10 @@ *_LOCAL_*.txt *_REMOTE_*.txt +### GPG ### +secring.* + + ### Intellij+all ### # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 @@ -119,6 +130,101 @@ fabric.properties # .nfs files are created when an open file is removed but is still being accessed .nfs* +### macOS ### +# General +.DS_Store +.AppleDouble +.LSOverride + +# Icon must end with two \r +Icon + + +# Thumbnails +._* + +# Files that might appear in the root of a volume +.DocumentRevisions-V100 +.fseventsd +.Spotlight-V100 +.TemporaryItems +.Trashes +.VolumeIcon.icns +.com.apple.timemachine.donotpresent + +# Directories potentially created on remote AFP share +.AppleDB +.AppleDesktop +Network Trash Folder +Temporary Items +.apdisk + +### macOS Patch ### +# iCloud generated files +*.icloud + +### NotepadPP ### +# Notepad++ backups # +*.bak + +### SSH ### +**/.ssh/id_* +**/.ssh/*_id_* +**/.ssh/known_hosts + +### SublimeText ### +# Cache files for Sublime Text +*.tmlanguage.cache +*.tmPreferences.cache +*.stTheme.cache + +# Workspace files are user-specific +*.sublime-workspace + +# Project files should be checked into the repository, unless a significant +# proportion of contributors will probably not be using Sublime Text +# *.sublime-project + +# SFTP configuration file +sftp-config.json +sftp-config-alt*.json + +# Package control specific files +Package Control.last-run +Package Control.ca-list +Package Control.ca-bundle +Package Control.system-ca-bundle +Package Control.cache/ +Package Control.ca-certs/ +Package Control.merged-ca-bundle +Package Control.user-ca-bundle +oscrypto-ca-bundle.crt +bh_unicode_properties.cache + +# Sublime-github package stores a github token in this file +# https://packagecontrol.io/packages/sublime-github +GitHub.sublime-settings + +### Vim ### +# Swap +[._]*.s[a-v][a-z] +!*.svg # comment out if you don't need vector files +[._]*.sw[a-p] +[._]s[a-rt-v][a-z] +[._]ss[a-gi-z] +[._]sw[a-p] + +# Session +Session.vim +Sessionx.vim + +# Temporary +.netrwhist +# Auto-generated tag files +tags +# Persistent undo +[._]*.un~ + ### VisualStudioCode ### .vscode/* !.vscode/settings.json @@ -164,4 +270,4 @@ $RECYCLE.BIN/ # Windows shortcuts *.lnk -# End of https://www.toptal.com/developers/gitignore/api/intellij+all,visualstudiocode,git,windows,linux +# End of https://www.toptal.com/developers/gitignore/api/git,gpg,ssh,vim,linux,macos,windows,notepadpp,sublimetext,intellij+all,visualstudiocode,dotenv diff --git a/LICENSE b/LICENSE index fdddb29..89c5218 100644 --- a/LICENSE +++ b/LICENSE @@ -1,24 +1,21 @@ -This is free and unencumbered software released into the public domain. +MIT License -Anyone is free to copy, modify, publish, use, compile, sell, or -distribute this software, either in source code form or as a compiled -binary, for any purpose, commercial or non-commercial, and by any -means. +Copyright (c) 2026 SegoCode -In jurisdictions that recognize copyright laws, the author or authors -of this software dedicate any and all copyright interest in the -software to the public domain. We make this dedication for the benefit -of the public at large and to the detriment of our heirs and -successors. We intend this dedication to be an overt act of -relinquishment in perpetuity of all present and future rights to this -software under copyright law. +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. -IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR -OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, -ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -OTHER DEALINGS IN THE SOFTWARE. +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. -For more information, please refer to +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index f39ce43..62f657d 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,6 @@ -

-

Hi, I'm a ransomware code in batch my name is Ramon

+# {reponame} -

- - - -

- -

+

About • @@ -17,31 +10,38 @@

## About +[![Top language](https://img.shields.io/github/languages/top/{username}/{reponame}?style=flat-square)](https://github.com/{username}/{reponame}) +[![Repository size](https://img.shields.io/github/repo-size/{username}/{reponame}?style=flat-square&label=repo%20size)](https://github.com/{username}/{reponame}) +[![Commit activity per year](https://img.shields.io/github/commit-activity/y/{username}/{reponame}?style=flat-square&label=commits)](https://github.com/{username}/{reponame}/graphs/commit-activity) +[![License: MIT License](https://img.shields.io/badge/license-MIT-blue?style=flat-square)](https://github.com/{username}/{reponame}/blob/main/LICENSE) +[![Bitcoin BTC](https://img.shields.io/badge/buy_me_a_coffee-BTC-F7931A?style=flat-square&logo=bitcoin&logoColor=white)](https://github.com/SegoCode/SegoCode/discussions/2) -RamonWare is a batch tool that uses AES encryption to simulate the process of file encryption typically used in ransomware attacks. + +RamonWare is a Windows batch prototype of a ransomware incident. Shows a fullscreen lock screen (HTA). Encryption stays commented. The script does not encrypt or delete files unless you uncomment the PowerShell AES block. https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.bat.ramonware.thjoebc ## Features -- Safe Mode for testing: Includes a 'Safe Mode' feature for development and testing environments that prevents actual data loss -- Self-contained batch: Designed to run from the command line with minimal setup +- Lock screen: opens a fullscreen HTA with a WannaCry-style note after the scan. + +- Single file: `code/Ramonware.bat` holds the scan and the HTML. No extra install. ## Quick Start & Information ```shell -git clone https://github.com/SegoCode/NetfixHistoryViewer -cd Ramonware/code +git clone https://github.com/{username}/{reponame} +cd {reponame}/code Ramonware.bat ``` -> [!IMPORTANT] -> To create a real functionality the script must download aescript cli (https://www.aescrypt.com/download/), or otherwise have it available in the system path. - +> [!CAUTION] +> The scan starts at `%homedrive%\` and walks every folder. +> Uncommenting the PowerShell AES lines and `del` encrypts the file and removes the original. ## Download -Provide a direct link to where users can download the application +https://raw.githubusercontent.com/SegoCode/Ramonware/refs/heads/master/code/Ramonware.bat --- -

- +

+

diff --git a/assets/demo2.png b/assets/demo2.png new file mode 100644 index 0000000..deeb8b2 Binary files /dev/null and b/assets/demo2.png differ diff --git a/code/Ramonware.bat b/code/Ramonware.bat index c1de0f3..221a3ca 100644 --- a/code/Ramonware.bat +++ b/code/Ramonware.bat @@ -1,31 +1,22 @@ - - CryptMSG - + + RamonWare + + - - -

- RamonWare Crypt -

-
- Oops, Your Files Have Been Encrypted!
-

- Now you need run RamonDecryptor, be careful next time
-

- Github.com/SegoCode
-


- Candado -
+ +

- RamonWare -

+
+ Ooops, your files have been encrypted!


+ Github.com/SegoCode
+
diff --git a/docs/.gitkeep b/docs/.gitkeep new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/docs/.gitkeep @@ -0,0 +1 @@ +