Cib2WzGt

1
2   BYOB is an open-source project that provides a framework for security researchers and developers to build and operate a basic botnet to deepen their understanding of the sophisticated malware that infects millions of devices every year and spawns modern botnets, in order to improve their ability to develop counter-measures against these threats.
3
4 
5
6Server
7usage: server.py [-h] [-v] [--host HOST] [--port PORT] [--database DATABASE]
8Command & control server with persistent database and console
9
10Console-Based User-Interface: streamlined console interface for controlling client host machines remotely via reverse TCP shells which provide direct terminal access to the client host machines
11Persistent SQLite Database: lightweight database that stores identifying information about client host machines, allowing reverse TCP shell sessions to persist through disconnections of arbitrary duration and enabling long-term reconnaissance
12Client-Server Architecture: all python packages/modules installed locally are automatically made available for clients to remotely import without writing them to the disk of the target machines, allowing clients to use modules which require packages not installed on the target machines
13 
14
15Client
16usage: client.py [-h] [-v] [--name NAME] [--icon ICON] [--pastebin API] [--encrypt] [--obfuscate] [--compress] [--compile] host port [module [module ...]]
17Generate fully-undetectable clients with staged payloads, remote imports, and unlimited modules
18
19Remote Imports: remotely import third-party packages from the server without writing them to the disk or downloading/installing them
20Nothing Written To The Disk: clients never write anything to the disk – not even temporary files (zero IO system calls are made) because remote imports allow arbitrary code to be dynamically loaded into memory and directly imported into the currently running process
21Zero Dependencies (Not Even Python Itself): client runs with just the python standard library, remotely imports any non-standard packages/modules from the server, and can be compiled with a standalone python interpreter into a portable binary executable formatted for any platform/architecture, allowing it to run on anything, even when Python itself is missing on the target host
22Add New Features With Just 1 Click: any python script, module, or package you to copy to the ./byob/modules/directory automatically becomes remotely importable & directly usable by every client while your command & control server is running
23Write Your Own Modules: a basic module template is provided in ./byob/modules/ directory to make writing your own modules a straight-forward, hassle-free process
24Run Unlimited Modules Without Bloating File Size: use remote imports to add unlimited features without adding a single byte to the client’s file size
25Fully Updatable: each client will periodically check the server for new content available for remote import, and will dynamically update its in-memory resources if anything has been added/removed
26Platform Independent: everything is written in Python (a platform-agnostic language) and the clients generated can optionally be compiled into portable executable (Windows) or bundled into an standalone application (macOS)
27Bypass Firewalls: clients connect to the command & control server via reverse TCP connections, which will bypass most firewalls because the default filter configurations primarily block incoming connections
28Counter-Measure Against Antivirus: avoids being analyzed by antivirus by blocking processes with names of known antivirus products from spawning
29Encrypt Payloads To Prevent Analysis: the main client payload is encrypted with a random 256-bit key which exists solely in the payload stager which is generated along with it
30Prevent Reverse-Engineering: by default, clients will abort execution if a virtual machine or sandbox is detected
31 
32
33Modules
3411 post-exploitation modules that are remotely importable by clients
35
36Keylogger (byob.modules.keylogger): logs the user’s keystrokes & the window name entered
37Screenshot (byob.modules.screenshot): take a screenshot of current user’s desktop
38Webcam (byob.modules.webcam): view a live stream or capture image/video from the webcam
39Ransom (byob.modules.ransom): encrypt files & generate random BTC wallet for ransom payment
40Outlook (byob.modules.outlook): read/search/upload emails from the local Outlook client
41Packet Sniffer (byob.modules.packetsniffer): run a packet sniffer on the host network & upload .pcap file
42Persistence (byob.modules.persistence): establish persistence on the host machine using 5 different methods
43Phone (byob.modules.phone): read/search/upload text messages from the client smartphone
44Escalate Privileges (byob.modules.escalate): attempt UAC bypass to gain unauthorized administrator privileges
45Port Scanner (byob.modules.portscanner): scan the local network for other online devices & open ports
46Process Control (byob.modules.process): list/search/kill/monitor currently running processes on the host
47 
48
49Core
506 core framework modules used by the generator and the server
51
52Utilities (byob.core.util): miscellaneous utility functions that are used by many modules
53Handlers (byob.core.handlers): request handlers for receiving results of completed tasks from clients
54Security (byob.core.security): Diffie-Hellman IKE & 3 encryption modes (AES-256-OCB, AES-256-CBC, XOR-128)
55Loaders (byob.core.loaders): remotely import any package/module/scripts from the server
56Payloads (byob.core.payloads): reverse TCP shell designed to remotely import dependencies, packages & modules
57Stagers (byob.core.stagers): generate unique payload stagers to prevent analysis & detection
58Generators (byob.core.generators): functions which all dynamically generate code for the client generator
59Database (byob.core.database): handles interaction between command & control server and the SQLite database
60
61https://github.com/malwaredllc/byob