Dr0p1t-Framework - A framework that create an advanced stealthy dropp

项目说明

Not maintained currently (Wait for the next )

-----

Dr0p1t-框架 ![n0where best cybersecurity tools]() ![Python 3.5]() ![Python 2.7]() !Build Status

Have you e about trojan droppers ?
In short dropper is type of malware that downloads other malwares and Dr0p1t gives you the chance to create a stealthy dropper that bypass most AVs and have a lot of tricks ( Trust me :D ) ;)

Features

+ Generated executable properties:

The executable size is smaller compared to other droppers generated the same way.

Download executable on target system and execute it silently..

Self destruct function so that the dropper will kill and delete itself after finishing it work

Escape disk forensics by making all the files dropper create and dropper also cleans its content before deletion

Clear event log after finishing.

+ Framework properties:

Works with Windows, Linux and now have OSX support ( Thanks to )

Dr0p1t-Ser (beta) so now you can work from browser See how to work with Dr0p1t-服务端

Dr0p1t-服务端 have a scam option (beta) See how to work with Dr0p1t-服务端

+ Modules:

Find and kill antivirus before running the malware.

The ability to disable UAC.

The ability to run your malware as admin.

Full spoof by spoofing the file icon and extension to any thing you want.

ZIP files support so now you can compress your executable to zip file before uploading.

Running a custom ( batch|powershell|vbs ) file you ha before running the executable

In running powershell scripts it can bypass execution policy

Using UPX to compress the dropper after creating it

+Persistence modules:

Adding executable after downloading it to startup.

Adding executable after downloading it to task scheduler ( UAC not matters ).

Adding your file to powershell user profile so your file will be downloaded and ran every time powershell.exe run if it doesn't exist.

Screenshots

On Windows

<img src=" width="100%"></img>

See more

On Linux (Kali linux)

<img src=" width="100%"></img>

See more

On OSX

Still not fully tested! Need some contributors and testers :smile:

Help menu

Examples

Prerequisites

Python 2 or Python 3.

>The recommended for Python 2 is 2.7.x , the recommended for Python 3 is 3.5.x and don't use 3.6 because it's not supported yet by PyInstaller

Needed dependencies for Linux

apt

Others will be installed from install.sh file

>Note : You must have root access

Needed dependencies for windows

pip

Modules in windows_requirements.txt

Installation

>There's a list here for all official for installing and using Dr0p1t Playlist

On Linux

On Windows (After downloading ZIP and upzip it)

>Note : in python 2.7 you don't have pip so install it first from get-pip.py script [Google it]

Tested on:

Kali Linux Rolling

Ubuntu 14.04-16.04 LTS

Windows 10/8.1/8

Work with Dr0p1t-Server

>Note : 服务端 is still in beta and it have a lot of features to add and also a better design [ Need a designer to contribute :D ]

Prerequisites

Stable internet connection.

Port 5000 not used and firewall configured to not block connection from it

Installation & run server

On Linux and Windows it's the same after installing Dr0p1t by doing the steps mentioned abo modules in ser.txt by using pip like :

Now let's run our ser :

After running the ser, it will start to listen to all the connection coming to port 5000 using flask.

Now to use the 服务端 from your device open in browser either 127.0.0.1:5000 or [Your IP]:5000.

To open it from other devices in LAN open [Your Local IP]:5000 and for other devices in WAN open [Your Global IP]:5000 but make sure first that you configured you router to forward port 5000 connection to you.

After opening the serve page you will see a simple website with a simple design asking you for data needed See ser

Then submit the data then it will be through some processes then the exe file will be generated and you will be redirected to page telling you the scam link.

After entering the link you will see a scam to download the dropper which it by default Adobe flash download page.
To replace the scam with yours replace the file "Scam.html" content with yours but remember the ( Don't remove it ).

Ser

<img src=" width="100%"></img>
<img src=" width="100%"></img>
<img src=" width="100%"></img>
<img src=" width="100%"></img>

See more for Windows
See more for Linux

No distribute scan ( Please don't scan with virus total:3 )

<img src=" width="100%"></img>

Todo Check out this link

Contact

Twitter

Donation

If this 工具 has been useful for you, feel free to thank me by buying me a coffee :)

![Coffee]()

Disclaimer

Dr0p1t 框架 not responsible for misuse and for illegal purposes. Use it only for Pentest or educational purpose !!!

Copying a 代码 from this 框架 or using it in another 工具 is accepted as you mention where you get it from :smile:

> Pull requests are always welcomed :D

项目信息

开发语言：Python

Star 数：1475

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A 框架 that create an ad stealthy dropper that bypass most AVs and have a lot of tricks展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。