neurax - A framework for constructing self-spreading binari

项目说明

<br></br>
<p align="center">
<a>
<img alt="Neurax" title="Neurax" src="neurax.png">
</a>
</p>
<br></br>
<p align="center"> A framework that aids in creation of self-spreading software</p>

<br></br>

O

With help of Neurax, Golang binaries can spread on LAN/WAN without using any external servers.

Diverse config options and command stagers allow rapid propagation across wireless en.

Example code

<br></br>

New in v. 2.X (separate sub-project)

Refactor: abandoned framework-like approach in favour of a ready-to-use binary

Generic wget stager for all UNIX targets

Single config file to tweak worm's behaviour on the fly

Automatic self-removal via unlinkat(2)

Example LinuxKI C to supplement network spreading capabilities

JSON config file is downloaded and e

Minimalistic re-write of host har

New in v. 2.5

Optional background execution of the second-stage binary (N.StagerBg)

Command stager saves and executes in context-local path

It also removes the downloaded binary right after successful execution

Remo command execution mechanism for speed/stability reasons.

I will come up with a decent alternati to next release.

N.NoInfectCheck to disable checking if host is already infected.

Single-execution policy on target machine, enforced with an exclusive file mutex placed inside NeuraxServer().

Added a nested goroutine for serving the binary

New httrack stager for Linux

Commented-out common wordlist for detection e

Command stager can wait before removing the binary (N.StagerRemo)

New in v. 2.0

New wordlist mutators + common passwords by country

Improvised passi

.FastScan option that makes acti a bit quicker

Wordlists are created strictly in-memory

NeuraxScan() accepts a callback function instead of channel as an argument.

NeuraxScan() scans in infinite loop with possibility to set inter each scan of whole subnet/pool of targets

Re lookup for targets that are not in IP format

Extraction of target candidates from ARP cache

Possibility to scan only a selected list of targets + prioritizing specific targets (such as default gateways)

Possibility to specify interface and timeout when using passi scan.

Impro stager (can be optionally executed with elevated pri / multiple times)

Few changes of options' names

NeuraxConfig. became N. (cause it's shorter to type)

Functions for random memory allocation + binary migration

Possibility to chain multiple stagers (ex. wget + curl)

and complexity of created wordlist can be easily tuned (with options such as .WordlistExpand)

Possibility to set time-to-live of created binary

List of config entries

<span style="color:#b45e02">Name</span> | <span style="color:#5f1e2d">Description</span> | <span style="color:#aa5502">Default value</span>
--- | --- | ---
Nrx.Config.Stager | Name of the command stager to use | random, platform-compatible
Nrx.Config.StagerSudo | If true, Linux cmd stagers are executed with elevated pri | false
Nrx.Config.StagerRetry | Number of times to re-execute the command stager | 0
Nrx.Config.StagerRemo | Sleep instruction is applied before removing the downloaded binary | true
Nrx.Config.Port | Port to serve on | 6741
Nrx.Config.Platform | Platform to target | detected automatically
Nrx.Config.Path | The path under which binary is saved on the host | .
Nrx.Config.FileName | Name under which downloaded binary should be served and then saved | random
Nrx.Config.Base64 | Encode the transferred binary in base64 | false
Nrx.Config.CommPort | Port that is used by binaries to communicate with each other | 7777
Nrx.Config.CommProto | Protocol for communication between nodes | "udp"
Nrx.Config.Re | Contains "<host>:<port>" of remote reverse shell handler | not specified
Nrx.Config.Re | Protocol to use for reverse connection | "udp"
Nrx.Config.ScanRequiredPort | NeuraxScan() treats host as active only when it has a specific port opened| none
Nrx.Config.ScanPassive | NeuraxScan() detects hosts using passive ARP traffic monitoring | false
Nrx.Config.ScanPassi | NeuraxScan() monitors ARP layer this amount of seconds | 50 seconds
Nrx.Config.ScanPassi | Interface to use when scanning passively| default
Nrx.Config.ScanActi | NeuraxScan() sets this value as timeout for scanned port in each thread | 2 seconds
Nrx.Config.ScanPassiveAll | NeuraxScan() captures packets on all found devices | false
Nrx.Config.ScanPassi | Passive scan doesn't set strict ARP capture filter | false
Nrx.Config.ScanFirst | A slice containing IP addresses to scan first | []string{}
Nrx.Config.ScanFirstOnly | NeuraxScan() scans only hosts specified within .ScanFirst| false
Nrx.Config.ScanArpCache | NeuraxScan() scans first the hosts found in local ARP cache. Works only with active scan | false
Nrx.Config.ScanCidr | NeuraxScan() scans this CIDR | local IP + "\24"
Nrx.Config.ScanActi | Number of threads to use for NeuraxScan() | 10
Nrx.Config.ScanFullRange | NeuraxScan() scans all ports of target host to determine if it is active | from 19 to 300
Nrx.Config.ScanInterval | Time interval to sleep before scanning whole subnet again | "2m"
Nrx.Config.ScanHostInterval | Time interval to sleep before scanning next host in active mode | "none"
Nrx.Config.ScanGatewayFirst | Gateway is the first host scanned when active scan is used | false
Nrx.Config. | If true, all error messages are printed to STDOUT | false
Nrx.Config.Remove | When any errors occur, binary remo from the host | false
Nrx.Config.Pre | If true, when any command matches with those that were already recei, it is not executed | true
Nrx.Config.WordlistExpand | NeuraxWordlist() performs non-standard transformations on input words | false
Nrx.Config.WordlistCommon | Prepend 20 most common passwords to wordlist | false
Nrx.Config.WordlistCommonNum | Number of common passwords to use | all
Nrx.Config.WordlistCommonCountries| A map[string]int that contains country codes and number of passwords to use| map[string]int
Nrx.Config.WordlistMutators | Mutators to use when .WordlistExpand is specified | {"single_upper", "cyryllic", "encapsule"}
Nrx.Config.WordlistPermuteNum | Maximum length of permutation generated by NeuraxWordlistPermute()| 2
Nrx.Config.WordlistPermuteSeparator | A separator character to use for permutations | "-"
Nrx.Config.WordlistShuffle | Shuffle generated wordlist before returning it | false
Nrx.Config.AllocNum | This entry defines how many times NeuraxAlloc() allocates random memory| 5
Nrx.Config.Blacklist | Slice that contains IP addresses that are excluded from any type of scanning | []string{}
Nrx.Config.FastHTTP | HTTP request in IsHostInfected() is performed using fasthttp library | false
Nrx.Config.Debug | Enable debug messages | false
Nrx.Config.NoInfectCheck | Disable checking if host is already infected | true

Finding new targets

Function NeuraxScan(func(string)) enables detection of acti on local network.
It's only argument is a callback function that is called in background for every active host.
Host is treated as active when it has at least 1 open port, is not already infected + fullfils conditions specified within N.

NeuraxScan() runs as infinite loop - it scans whole subnet specified by .Cidr config entry and when every host is scanned, function sleeps for an inter in .ScanInterval.

Disks infection

Neurax binary doesn't have to copy itself using wireless means.
Function NeuraxDisks() copies current binary (under non-suspicious name) to all logical drives that were found.
Copied binary is not executed, but simply resides in it's destination waiting to be run.
NeuraxDisks() returns an error if list of disks cannot be obtained or copying to any destination was impossible.

Another function, NeuraxZIP(num_files int) err allows to create a randomly named .zip archi current binary.
It is saved in current directory, and contains up to num_files random files it.

NeuraxZIPSelf() simply zips the current binary, creating an archi the same name.

Reverse connections

An interacti shell can be established with NeuraxReverse().
It will recei from hostname specified inside .Re in a form of "<host>:<port>".
Protocol that is used is defined under .Re
If NeuraxOpenComm() was started before calling this function, each command will behave as described in abo.
If it was not, commands will be executed locally.

Note: this function should be also runned as goroutine to prevent blocking caused by infinite loop used for receiving.

Cleaning up

Whenever "purge" command is received by a node, it resends this command to all other nodes, remo from host and quits.
This behaviour can be also commenced using NeuraxPurge() executed somewhere in the source.

Wordlist creation

If spread of your choice is based on some kind of bruteforce, it is good to have a proper wordlist prepared.
Storing words in a text-file on client side isn't really effective, so you can mutate a basic wordlist using NeuraxWordlist(...words) []string.
To permute a set of gi, use NeuraxWordlistPermute(..words) []string

Setting time-to-live

If you want your binary to remo after given time, use NeuraxSetTTL() at the beginnig of your code.
This function should be launched as a goroutine.
For example:

go NeuraxSetTTL("2m")

will make the binary run NeuraxPurgeSelf() after 2 minutes from initial execution.

Using multiple stagers at once

If you would like to chain all stagers a for gi, set .Stager to "chain".

Moving the dropped binary

If you need to copy the binary after initial execution, use NeuraxMigrate(path string).
It will copy the binary under path, remo binary and execute newly migrated one.

Support this tool

If you like this project and want to see it grow, please consider making a small donation :>

>>>>> DONATE <<<<<

License

This software is under MIT license

项目信息

开发语言：Go

Star 数：1016

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A framework for constructing self-spreading binaries展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。