+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: [FREE]Gaudox HTTP Bot (1.1.0.1) | C++/ASM | Ring3 Rootkit | Watchdog | Antis | Stable (/showthread.php?tid=5022902)
[FREE]Gaudox HTTP Bot (1.1.0.1) | C++/ASM | Ring3 Rootkit | Watchdog | Antis | Stable - excr4sh - Oct 15, 2015
Project is closed, download link is not available anymore, don't ask for it.
Gaudox HTTP
Gaudox is an HTTP loader completely coded from scratch in C/C++ language with a few lines of Assembly, which means that it does not require of any dependencies ( C-Runtime, NET Framework, Java VM ). The bot has been fully tested and working on all Windows versions from Windows XP SP2 to Windows 10 (32/64-bit). It is also worth mentioning that I coded this bot with very efficient and stable designed code to handle thousands of connections at once.
Features:
Usermode Rootkit
Bot has Rootkit functionality which hides all bot resources and prevents from being accessed from explorer process. This feature does not drop any to disk, the code is internally embedded in the bot file and injected in the target process from memory. It is also has self-protection that prevents the hooks from being removed by third-party programs or any security tool. This feature is currently working on 32-bit systems.
Persistence/Watchdog
Bot prevents it from being removed from the system by bot killers, security tools or user actions. This feature is currently supporting process protection and working on both 32/64-bit systems but its maximum compatibility is in 32-bit.
Traffic Encrypted
The communication between the bot and the control panel is obfuscated. This prevents middle attacks.
Anti-Analysis/Research
Bot contains several methods for preventing from being analyzed by researchers or unauthorized users. some methods are from preventing static analysis by obfuscating code, data up to detect the presence of debuggers, avoid running the bot in virtualized environments, etc. some methods may not be mentioned.
Commands:
[+] Download and execute (Drop&Exec)
[+] Visit Website (Visible)
[+] Update Client
[+] Uninstall Client
Panel
[img]http://i.imgsafe.org/627e2d4.jpg[/img]
[img]http://i.imgsafe.org/e1736c8.jpg[/img]
( got this screenshot on jabber )
[img]http://i.imgsafe.org/acb1430.jpg[/img]
[img]http://i.imgsafe.org/bb2c161.png[/img]
[img]http://i.imgsafe.org/3194cfd.png[/img]
Builder
[img]http://i.imgsafe.org/251b9fb.jpg[/img]
[img]http://i.imgsafe.org/27a48f1.jpg[/img]
[img]http://i.imgsafe.org/29caf7e.jpg[/img]
[img]http://i.imgsafe.org/2c55ddc.jpg[/img]
[img]http://i.imgsafe.org/a91d043.jpg[/img]
Gaudox v1.1.0.1.exe
MD5: 1AF2E1B11B1D7543A19662F7291856F4
SHA-1: DE5BD976FB5A4B50D8C8739E6B9F286F5B1A4798
1.1.0.1.rar
MD5: F99A3FBDEB1B0CD12BB1E6ED700ADE90
SHA-1: A00A2B6D6C5806C75C5551073283D1218AC017C8
How to install:
1) Open the Builder and create a new profile, you will use these values KEY #1 and KEY #2 in the panel.
2) Create a new database (recommended)
3) Open setup.php with browser and complete the form.
4) Delete setup.php and open login.php with browser.
5) When creating the bot clients do not forget to use the same profile you used to install the panel, otherwise the bots will not connect to the panel.
Notes:
1) I highly recommend disabling strict mode in MySQL.
2) I f you test the bot from a local server, the panel may be showing "US" in location, it's not an error, the panel expects to always get an external IP.
Tut by Jar1: https://hackforums.net/showthread.php?tid=5084324
How to update:
1.1.0.0 to 1.1.0.1+
You will need to install the panel again, sorry for the inconvenience. The database is now the final version and it would be compatible with all future versions ( I hope, unless I have forgotten something or want to add a new feature, in any case I will code a script to update the database ).
Changelog:
Spoiler (Click to View)
* - Windows 10 - Oct 15, 2015
Oooo a new botnet, nice, The images are broken though.
* - Jаson - Oct 15, 2015
Looks nice. The images are not broken though.
* - D-o-x-i-n-g - Oct 15, 2015
Looks nice ima try it out rn.
* - ThePacketBaron - Oct 15, 2015
Thanks for posting this man :D
* - Rory Guidry - Oct 15, 2015
Any chance of open sourcing this or sharing the code? I have no interest in monetizing it, just want to learn and study your code as I find it to be the most effective method and this seems fairly well made.
* - Venom0 - Oct 15, 2015
(Oct 15, 2015 08:06 AM)Rory Guidry Wrote: Any chance of open sourcing this or sharing the code? I have no interest in monetizing it, just want to learn and study your code as I find it to be the most effective method and this seems fairly well made.
kms back from jail already? jk
But yeah what he said you're probably not too keen on releasing the source but if you could that would be really cool for the rest of us to learn
* - Rory Guidry - Oct 15, 2015
(Oct 15, 2015 08:56 AM)Venom0 Wrote: kms back from jail already? jk
But yeah what he said you're probably not too keen on releasing the source but if you could that would be really cool for the rest of us to learn
Well KMS is actually free now, snitched but that's off topic.
I checked out this bot just now and it works really well, would be nice to be able to improve it myself though or if it was up on github it could be a group project.
* - Klaus123 - Oct 15, 2015
(Oct 15, 2015 08:06 AM)Rory Guidry Wrote: Any chance of open sourcing this or sharing the code? I have no interest in monetizing it, just want to learn and study your code as I find it to be the most effective method and this seems fairly well made.
i agree.🤝
* - excr4sh - Oct 15, 2015
Thanks and about whether this would be open source or not, I doubt it but never would say no or impossible. at the moment this would not be open source.
Wait for updates.
* - Hoodie+ - Oct 15, 2015
Nice basic botnet.
I like basic botnets.
Good job!
* - Proxseas - Oct 15, 2015
Nice to see you contributing to this section.
* - Uiqueblhats - Oct 16, 2015
It will be best freeware bot i guess
* - excr4sh - Oct 16, 2015
Thanks and for those wondering if I will improve the panel, yes I will do but for now I want to focus the time adding more features and other things.
* - PurpleGalaxy - Oct 17, 2015
Webpanel 500 error, I guess SSI includes are used and not supported on my host.