GoBot2 - Second Version of The GoBot Botnet, But more advan

项目说明

New project:

GoBot2

After seeing another users Go based botnet i wanted to do more work on my GoBot, But i ended up building something a bit more. There is issues with this but it more of a ad PoC.... I am not a good coder but i was able to make this buy doing some basic reading online. There was more i wanted to do with this project but i stopped, I am getting out of making Malware and virus's... I am going to move on to more legitimet things. Though i will be posting some of my old projects on my Github, and most of witch are male i am putting them here to make it simpler for the 'good guys' to fight them and there kin.

C&C Features:

* Written in Go
* Cross-Platform
* SQL Database for Information
* Secure Login System
* Hard-Coded Login System
* Simple to use HTML & CSS C&C
* Console Based C&C
* Tight Security (No PHP!)
* Encoded and Obfuscated Data
* HTTPS or HTTP
* Single, Selected, All Command Issuing
* User-Agent Detection
* More

Bot Features

* Safe Error Handling
* Ha Panels
* Encoding and Obfuscation
* Use HTTPS or HTTP
* Old (>24Hr) Command Handling (Dont run commands that are old!)
* Run PowerShell Scripts (Via URL, Parameters Accepted)
* Ad Torrent Seeder (uTorrent, BitTorrent Auto Download the client and runs hidden if needed)
* Dri (with Name list)
* Dropbox Spreader (with Name list)
* Google Dri (with Name list)
* OneDri (with Name list)
* Ad Keylogger (Handles all keys, Window Titles, Clipboard, AutoStart, +more)
* System Information (IP, WiFi, User, A, CPU, GPU, SysInfo, Installed Software, .NET Framework, Refresher)
* Screen Capture (Compression, Timed Capture, +more)
* Download and Run (MD5 Hash Check, URL or Base64, Parameters, UAC Bypass, Zone Remover)
* DDoS Methods (Threaded /w Interval, HTTPGet, TCPFlood, UDPFlood, Slowloris, HULK, TLSFlood, Bandwidth Drain, GoldenEye, Ace)
* Bot Update (MD5 Hash Check, Admin, Zone Remover)
* UPnP (Open TCP/UDP Ports)
* Web-Server (Auto-UPnP port 80, Add/Edit Unlimited Pages)
* Add Programs to Windows Firewall
* HOST File Editor (Backup and Restore, Replace on Run, DNS Flusher)
* Remote CMD
* Detect Admin Rights
* Bot ID Generation (Never the same)
* Ad Anti-Virus Bypass (Random Memory Allocation, Func HOP, Delays, Runtime Load DLLS /w Obf, Random Connection Times, + more)
* Ad Anti-Debug (isDebuggerPresent, Proc Detection, IP Organization Detection, File Name Detection, Reaction System)
* Single Instance System
* Reverse HTTP Proxy (Conf. Port, backend Servers)
* Acti (Acti Defense, Active File Defense, Acti + more) Doesn't want to be killed.
* UAC Bypass (Work all and current of Windows 10 Pro 64Bit)
* Ad Install System (Dynamic Registry Keys, Dynamic File Names, Retain Admin Rights, Campaign Targeting (Only install in allowed Country's), Zone Remover, Adds self to Firewall)
* Uninstall System (Removes all Traces)
* Scripter (Batch, HTML, VBS, PS)
* Run Shellcode (ThreadExecute)
* Power Options (Shutdown, Restart, Logoff)
* Startup Error Message
* MessageBox (Returns Reply)
* Open Website (/Hidden)
* Change Homepage
* Change Background (URL or Base64)
* Run .exe (UAC Bypass optimal)
* Kill Self
* Check if Proc is Running
* Hide Process /w Active Mode
* Disable/Enable (TaskManger, RedEdit, Command Prompt)
* File Dropper (Place e on pc with no traces where it came from /w dir selection)

Some Info about the C&C

The C&C is a program, You can compile it for Windows, Linux, Mac systems. Its a self-running web-server that handles all connections on the selected port in the settings. it will serve the HTLM C&C to a connector if you allow it and it saves data about account, bots and commands as a SQL database and bots files (screenshots, keylogs, ect) as file under the bots own "Profile"
You can control the botnet from the program(more secure) or control it from the HTML C&C. The C&C's program is extremely stable, Go based servers are know for handling millions or requests at once without fail, just make sure you have a good connection.
The C&C has a build in hard-coded login (kinda like a Backdoor) you can use if you 'forgot' the account login. the C&C can have any number of accounts.
With it being a self-contained program this removes the issue of SQLi attacks on the C&C so its more SECURE.
The C&C can also run inside a Tor Hidden service if configured right and the client (bot) can connect to it using a onion.to or onion.cab forwarder if needed. Tor can also be used by the bot via a SOCKS proxy... Simple to do, Google it.

How to Build and Use

Bot Settings are located in ".go" Ser are located in "Server.go"

Compile GoBot.go with correct settings, Make a MySQL Database and import db file, Compile Server.go with correct settings

* go build -o GoBot.exe -ldflags "-H windowsgui" "C:\\GoBot2\\GoBot.go"
* go build -0 Server.exe "C:\\GoBot2\\Console Server\\Server.go"

Always compile with '-w -s' ldflags to strip any debug information from the binary.

Included Tools

* Tool for the project (Obfuscator (Char+1) and other crap. w/ source in VB.net)
* Downloader.go (GoLANG Download and Run Example)
* DownloaderWithUAC.go (GoLANG Download and Run Example with UAC Bypass)

Obfuscator

It not really a Obfuscator all it does it move the Char +1 to and A = B, C = D, ect. Simple but it will slow down people wanting to mess with the program and also programs that search for keywords...

Packages Used

* github.com/NebulousLabs/go-upnp
* golang.org/x/sys/windows/registry
* github.com/AllenDang/w32
* github.com/atotto/clipboard
* github.com/StackExchange/wmi

Images

*
*
*
*

Credits and Stuff

*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*

Other

Go is a amazing and powerful programming language. If you already haven't, check it out;

Donations

![]()

Please Donate To Bitcoin Address: 1AEbR1utjaYu3SGtBKZCLJMRR5RS7Bp7eE

News

I just read a article on Bleeping Computer, Seems someone has found a use for this project... I have no in with this group or person. I ha more to say on this matter.

\-Crab Crab
\----------Update Log---------------------

03/15/2017: Intial Upload...

项目信息

开发语言：Go

Star 数：756

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Second Version of The GoBot Botnet, But more advanced.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。