Grok-backdoor

Grok-backdoor is a simple python based backdoor, it uses Ngrok tunnel for the C&C communication. Ngrok-backdoor can generate Windows, Linux and Mac binaries using Pyinstaller.

How it works:

Ngrok exposes local servers behind NATs and firewalls to the public internet over a secure tunnel.

Ngrok establishes a tunnel between malware local listener port and ngrok server public IP over a unique port number. Attacker can connect Ngrok public IP and unique port to intract with internal malware listener.

Disclaimer:

All the code provided on this repository is for educational/research purposes only. Any actions and/or activities related to the material contained within this repository is solely your responsibility. The misuse of the code in this repository can result in criminal charges brought against the persons in question. Author will not be held responsible in the event any criminal charges be brought against any individuals misusing the code in this repository to break the law.

Dependencies:

Python 2.7

Pyinstaller 3.21

python-pip 9.0.1

Installation :

pip install -r requirements.txt

Usage:

You need a ngrok.com acccount to use this backdoor, you can provide Ngrok authcode while configuring the grok-backdoor. You will be able to see a new tcp tunnel created in Ngrok status panel after the grok-backdoor server execution on victim machine