werkamsus / lilith

Lilith, C++ Cybersecurity Research Project

Lilith

Free & Native Open Source C++ Remote Administration Tool for Windows

Lilith is a console-based ultra light-weight RAT developed in C++. It features a straight-forward set of commands that allows for near complete control of a machine.

Disclaimer

The use of this software on any device that is not your own is highly discouraged. You need to obtain explicit permission from the owner if you intend to use Lilith in an alien environment, any illicit installation will likely be prosecuted by the jurisdiction the (ab)use occurs in.

Youtube

• Video about the new Features
• Comprehensive Feature Overview

Features

• Remote Command Execution via
  • CMD
  • Powershell
  • Any other console app
• Keylogger (new) [16.09.2017]
• Execute predefined Scripts (new) [16.09.2017]
• Extreme Modularity (see this)
• Broadcast Commands to all Clients (new) [15.09.2017]
• Multiple Connections
• Auto-Install
• Startup Persistence
• Self-Erases
• DNS Resolving
• Low Latency & Bandwith use
• Error-Handler with logs

Modularity

The modularity and expandability of this RAT are what it's been built on. That's how it manages to stay very compact, light-weight and fast. You can download other utilities like password recovery or keylogging tools via Powershell scripts (link to some useful scripts will follow soon) and then execute them as if they were running on your own machine. Afterwards you're able to upload the results (also with a ps script) or evaluate them on the spot (via the type command) in cmd.

Commands

Command	Syntax	Comment
connect	connect <clientID> (connect 0)	Connects to a Client
exitSession	exitSession	Exits current session
switchSession	switchSession <clientID> (switchSession 2)	Switches to another Client
broadcast	broadcast	Broadcasts your commands to all clients
keydump	keydump	Dumps Keylog File
script	script <scriptname> <scriptparameter> (script keydump keylog.txt)	Executes a predefined Script
listClients	listClients	Displays the number of clients connected
remoteControl	remoteControl <C:\program.exe> OR remoteControl cmd	More Info
remoteControl	remoteControl	Exits remoteControl if already in remoteControl
restart	restart	Restarts the Client
kill	kill	Quits the Client

General Description

At the core of this RAT lies it's unique ability to remotely execute commands via CMD, Powershell and almost all console-based applications. It has the capabilities to automatically install on startup and clean up behind itself. It also features an error-handler that logs any issues. As of now, it is not 100% stable. Under 'normal' conditions it runs smoothly and without any disturbances, but severe irregularities in input (i.e. messing around with it a lot) may cause crashes. This will be resolved in the near future.

Requirements

• None!
• Supported Operating Systems (32/64-bit)
  • Windows XP SP3
  • Windows Server 2003
  • Windows Vista
  • Windows Server 2008
  • Windows 7
  • Windows Server 2012
  • Windows 8/8.1
  • Windows 10

To-Do

More Info on Commands

remoteControl

Shortcuts are: cmd, pws, pws32 which stand for Command Prompt, Powershell and Powershell 32-Bit respectively. You can use these instead of a full path to the executable. Example: remoteControl pws will remote-control C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.

lilith's Issues

GUI support！

Lilith file doesnt open and Server file says Failed to bind the address to our listening socket.

How to Configure it for Internet

Hi there,

i am interested to test it on a network other than loop back (127.0.0.1) , is there a way to configure, any wiki or guideline are appreciated

thanks

Failed to locate: "CL.exe"

this project fails when i build it, gives 108 errors

some of the errors are :

File download and run

Hello! Please, help me! I don't now can I using Lilith execute(download file to client PC and run programm)? And how i can do it?

Delete client

Hello! Can I delete the client full?

Advice for command handler function

You can use std::map<> to create mapping between command string (such as 'connect', 'remoteControl') and its handler:

void handleConnect(std::vector<std::string> params);
void handleBroadcast(std::vector<std::string> params);
void handleListClients(std::vector<std::string> params);
// ...
using LPFN_CommandHandler = void(Server::*)(std::vector<std::string> params);
std::map<std::string, LPFN_CommandHandler> handlers;

Considering that some handler may have more than one param, so use std::vector<std::string>, not std::string.

Init map:

void Server::initHandler()
{
    handlers.insert({ "connect", &Server::handleConnect });
    handlers.insert({ "broadcast", &Server::handleBroadcast });
    handlers.insert({ "listClients", &Server::handleListClients });
    // ...
}

Parse input and get command and its params.

eg:

"connect 0" => cmd: "connect", params: { '0' }

std::string parseCmd(std::string input, std::vector<std::string> &params)
{
    std::string temp;
    std::stringstream ss(input);
    while (ss >> temp)
    {
        params.push_back(temp);
    }

    std::string cmd = params.front();
    params.erase(params.begin());
    return cmd;
}

So you can reduce complexity when handle user's input

std::getline(std::cin, userinput);
std::vector<std::string> params;
std::string cmd = General::parseCmd(userinput, params);
// Find handler function
std::map<std::string, LPFN_CommandHandler>::iterator it = handlers.find(cmd);
if (it != handlers.end())
{
    (this->*it->second)(params);
}
// else ...

Web interface support

i am available for the web interface development(PHP) and a good god view mode.

Can I run Lilith on ReactOS?

I mean, if it works on Windows Server 2003, it can work on ReactOS. But I'm not sure if there are dependencies that would break the process.

i can't build the RAT

I am trying to build the RAT on the debugger option but this stays as bugged, it does not get to build the code simply stays in ready

any could help me? it's my first open source too

here the pic
https://i.imgur.com/AVcxSqi.jpg

Screenshot function

you could make a Screen monitoring fuction. it is better.

not working

im trying to compile it but it gives me alot of errors, i used "g++ * -o server" in the server folder but server.exe disapears when its done??

remoteControl cmd

When executing a command. E.G. whoami i get this error.

cmdRedirect.cpp - CMD::writeCMD()

There is a bug in function Server::recvall

In the function Server::recvall line 5, the code is

int RetnCheck = recv(connections[ID]->socket, data, totalbytes - bytesreceived, NULL); //Try to recv remaining bytes

,There is pass the buffer as the argv to the recv function directly, If only call the recv funciont one time, it's no problem, but when called the recv funcion twice or more, the buffer pass to the recv function will be overwrite and lost data, there should pass the buffer add the bytesreceived to the recv function, like this:

int RetnCheck = recv(connections[ID]->socket, data + bytesreceived, totalbytes - bytesreceived, NULL); //Try to recv remaining bytes

[Info] CreateThread Function Handling Issues

Hello.

In the area where the CreateThread function is used, there appears to be no appropriate exception if the Return value occurs Null.

What do you think?

client.cpp:165
general.cpp:303
Server/server.cpp:37
Server/server.cpp:42
Server/server.cpp:334

Lilith/Server/server.cpp

Line 37 in 1cd9afe

CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)PacketSenderThread, NULL, NULL, NULL); //Create thread that will manage all outgoing packets

Thanks.

External Ip Not Working

Cant seem to connect to external ip address. Is there anyway i can do this?

Marked as "Trojan:Win32/Fuery.B!cl"

on my Windows 10 Pro X64 , Lilith Client is marked as "Trojan:Win32/Fuery.B!cl"

Help

how do you add another ip? (for learning purpose and to mess with friends)
You can add me on discord or answer here

Discord name: BaeMeth#1651

/BaeMeth

Keylogger CPU usage

If you want to drastically lower the CPU usage of the keylogger module then I suggest using a Low Level keyboard hook. This acts like an event handler and uses exceptionally low CPU and memory consumption.

#include "stdafx.h"
#include <Windows.h>

LRESULT CALLBACK LowLevelKeyboardProc(int nCode, WPARAM wParam, LPARAM lParam)
{
    if (nCode == HC_ACTION)
    {
        switch (wParam)
        {
        case WM_SYSKEYUP:
            PKBDLLHOOKSTRUCT p = (PKBDLLHOOKSTRUCT)lParam;
            int key = (int)p->vkCode;               // Here you would need to map the virtual key to a char, this is easy to do and I have  a sample somewhere.

            // Take that char and do with it as you will. Also this allows you to modify keystrokes on the fly if you were to be interested in that. 
            // I also have sample code for that.
            break;
        }
    }
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

int main()
{
    // Install the low-level keyboard & mouse hooks
    HHOOK hhkLowLevelKybd = SetWindowsHookEx(WH_KEYBOARD_LL, LowLevelKeyboardProc, 0, 0);

    // Keep this app running until we're told to stop
    MSG msg;
    while (!GetMessage(&msg, NULL, NULL, NULL)) {    //this while loop keeps the hook
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    UnhookWindowsHookEx(hhkLowLevelKybd);

    return(0);
}

Marked as "Trojan:Win32/Azden.A!cl"

hi, i am actually very much impressed by and in Lilith that's why i have been working on it from many days

i am getting unwanted behavior and warning , i am now not even able to build it,

NOTE:

i haven't added any code to it yet i was just inspecting and trying it. i just want to make sure to work on some RAT or similar application that isn't going to end up in some antivirus detection list.

can you suggest something that can help in minimizing the suspeciuos behavior

thanks alot

Hello (Help me) Win64/Agent.IE trojan

do you help it is causing bi virus

https://kleenscan.com/scan_result/ca5e610f76506a97b52d58d60c4ddd66

how do you clean eset virus

:(

NO-IP / Dynamic DNS doesnt work

Hello,

connection with "127.0.0.1" and my PUBLIC IP works good. But with NO-IP / DynamicDNS "example.ddns.net" it doesnt work. No connection to the server. Please look at that issue so i can use DynamicDNS because my IP changes every 24h and DynamicDNS is very important. :-)

Also the server and client are not stable at all. I cant work or do other tasks while i am running the server or client. You already mentioned that .. and i am wondering how could i solve the problem for myself

Thanks in advance

Kinds regards

What is winlive.exe ? what is it used for in Lilith

hi

i was looking at the files generated when we build Liltith , and i came across a file named "winlive.exe" , i am curious what is this file used for , what class is generating it , etc etc, i tried to google "winlive.exe" but it smells like a malicious file.

thanks.

Not working on DDNS

hi i have been trying to get it working for Remote Access i configure my ddns hostname in setting.cpp , i forward the port in the router still it's not working, (btw i have watched your video but no luck so far) .

thanks and waiting for your kind reply

Any chance of revival?

This project has been dead for awhile, and im wondering do you now have time on ur hands to work on it again? would really look forward for it