covertutils - A framework for Backdoor development!

项目说明

co

A framework for Backdoor de!

![Documentation Status]() ![PyPI ]() ![GitHub ]() ![Build Status]()

Documentation Page

Blog Post in Securosophy describing some internals

Arranged Con Presentation about the Package
(DefCamp #8 | No 9-10)

- Defcamp #8 Presentation PDF a -

What is it?

This Python package is used to create Agent/Handler backdoors, like *metasploit's* meterpreter, *empire's* empire agent, *cobalt strike's* beacon and so on...

It automatically handles all communication channel options, like encryption, chunking, steganography, sessions, etc. With a recent package addition (httpimport), staging from pure Python2/3 is finally possible!

With all those set with a few lines of 代码, a programmer can spend time creating the *actual payloads*, *persistense mechanisms*, *shellcodes* and generally more creati!!

The security programmers can stop *re-in the wheel* by implementing encryption mechanisms both *Agent-side* and *Handler-side* to spend their time de more *Agents*, and generally feature-rich shells!

Python?

Yes, *Python*! De friendly, popular among security folks, consistent, preinstalled in vast majority of \*nix machines and easily packed into Windows PE files.
So it is Python, and more specifically Python2.7 only, for the time being...

But why Python2?

Several reasons. Mostly because Python2 is more popular among devices (*IoT devices*, *old Linux servers*, etc), and backdoor 代码 could run *as-is* on them, without Freezing, Packing, PyInstalling, etc. Backdoors are when they are as cross-platform as possible.
Macs, for example, do not ha installed by default. If you want `co in Python3, do not complain, read this reddit flame war dodging and start PRing...

#### So far the co.crypto subpackage has been ported to Python3. That means that all encryption and signing can work from Python3. Slow and steady...

Dependencies?


NO! Absolutely no dependencies, only pure python built-ins! The entropy package is required for the tests though.
This is a package's requirement, to ensure good flow when compiling in executable binaries.

Summary

The Entities

The Message

Messages are all things that mean something to the listener. Messages tra communication channels, and they have to be unaware of the channel they are tra in. In other words, messages have to be independent of the mean of their transportation.
* If the communication channel can handle low length byte-chunks per "burst", the message has to be chunked.
* If the communication channel filters certain byte arrays (IDS/IPS, NextGen Firewalls).

The Stream


The Stream is a tag that gi context to the message. Can be defined and used for arbitrary reasons. Streams, for example, can be used to separate Shell Commands from shellcode messages.

The Organizers

The Orchestrator


Orchestrators are the core of data manipulation in co. They handle all data transformation methods to translate raw chunks of data into Stream-Message pairs.

The Handler


Handlers tie together the raw byte input/output with the orchestrators to provide an interface of:
* onChunk()
* onMessage()
* onNotRecognized()

#### Example :

The Shell


A shell interface with prompt and stream control can be spawned from a Handler instance with:

Multiple Sessions? Meet co...

Any similarities with existing backdoors is purely coincidental...

Full documentation at co Session Shell aggregator

The Encryption Schemes


Custom _Stream Ciphers_ are used, designed and implemented from scratch in the co.crypto subpackage. Currently a custom _scrambling_ function (std) and the standard CRC32 (crc) functions are used to generate the _stream keys_.

The crypto and scrambling algorithms can be tried in the below CLI implementations:

#### Scrambling

#### Encryption/Decryption

The std algorithm is used by default in all communications.

#### A primitive signing implementation
*Scrambling* the examples/http_re.py file and later encrypting the scramble with a *key* creates something like a *signature*. The encrypted scramble can be used for integrity checking.
#### Signing

####

(Try changing the examples/http_re.py file or the signature to test the example)

*Signing is not an overly secure feature. It is little technique ensuring basic integrity checking without the hassle of importing official algorithms like HMAC* (which are definetely better, but *not built-in*).
It is meant for *staging payload* , yet there is no such mechanism implemented by default.

The Compression


All communications are passed through a layer of compression using the bz2 or zip algorithm. The compression is using a *best effort* approach, meaning that the returned data will be the least lengthy compressed of the input (even if that means that *no compression will take place*).

Networking

Networking is not handled by co, as python provides great built-in networking API (directly inherited from C). The only requirements for co Handler instances are 2 functions wrapping the raw data sending and receiving.

Just pass a send( raw ) and a recv() function to a Handler and you have a working *One-Time-Pad* encrypted, bandwidth aware, protocol independent, *password protected*, *multi-usable* channel.

Further Examples:


Sample TCP/UDP Reverse Shells and TCP Bind Shell scripts can be found in examples/ directory.

Tutorial and explanation of the architecture can be found in the Co Tutorial Restaurant!

Pull Requests?

Certainly! All pull requests that are tested and do not break the existing tests will be accepted!
Especially Pull Requests towards Python2/Python3 compatibility will be greatly appreciated!

Disclaimer

Usage of co` for attacking infrastructures without prior mutual consistency can be considered as an illegal activity. It is the final user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this package.

项目信息

开发语言：Python

Star 数：433

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A framework for Backdoor de!展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。