+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: Developing a HTTP BOT (/showthread.php?tid=5851121)
Pages: Pages
1
2
Developing a HTTP BOT - Vonful - Jun 18, 2018
So thought I'd talk about what i've been up to recently. As you can guess form the title I've been making a HTTP Botnet.
The way mine works is a bit different (I think) from everyone elses in the terms of not using sockets and/or any reliability on tcp connections through external ports to a server.
My bot works 90% on php where payloads and Download and Execute urls are done in mysql database. The stub is C# and is very basic. When I release it people can use crypters or some shit. Or I might make a builder depending on how bored I get.
So why did I post this? Purely because I want feedback. Please tell me if you think what I've done is pure retardation or anything along them lines. I do ask tho that you don't be nasty about anything as in insults. I take HF as a place of learning not insulting.
P.S: If I got anything technically wrong in the way other botnets funcion please don't burn me at the stake because to be fair I just pulled an assumsion with no real research on how they funcion. But from what I saw of liteHTTP it uses sockets? Juding from the includes on the c# stub but again I didnt look at anything else just kinda gave in and looked how it worked, and then sockets are long then I was like fuck that lmao. Im rambling but you get me I guess.
RE: Developing a HTTP BOT - A Kitty - Jun 18, 2018
(Jun 18, 2018 11:57 AM)Vonful Wrote: So thought I'd talk about what i've been up to recently. As you can guess form the title I've been making a HTTP Botnet.
The way mine works is a bit different (I think) from everyone elses in the terms of not using sockets and/or any reliability on tcp connections through external ports to a server.
My bot works 90% on php where payloads and Download and Execute urls are done in mysql database. The stub is C# and is very basic. When I release it people can use crypters or some shit. Or I might make a builder depending on how bored I get.
So why did I post this? Purely because I want feedback. Please tell me if you think what I've done is pure retardation or anything along them lines. I do ask tho that you don't be nasty about anything as in insults. I take HF as a place of learning not insulting.
P.S: If I got anything technically wrong in the way other botnets funcion please don't burn me at the stake because to be fair I just pulled an assumsion with no real research on how they funcion. But from what I saw of liteHTTP it uses sockets? Juding from the includes on the c# stub but again I didnt look at anything else just kinda gave in and looked how it worked, and then sockets are long then I was like fuck that lmao. Im rambling but you get me I guess.
Yours is no different to other HTTP botnets. The use of TCP connections is mostly used in IRC botnets, where a constant link is made.
RE: Developing a HTTP BOT - Vonful - Jun 18, 2018
(Jun 18, 2018 12:45 PM)A Kitty Wrote: Yours is no different to other HTTP botnets. The use of TCP connections is mostly used in IRC botnets, where a constant link is made.
Thanks for the correction. :D
RE: Developing a HTTP BOT - int - Jun 19, 2018
(Jun 18, 2018 12:45 PM)A Kitty Wrote: Yours is no different to other HTTP botnets. The use of TCP connections is mostly used in IRC botnets, where a constant link is made.
literally this. What is the point of making a botnet if it has the same features as everything else public.
EDIT: also, most people say c# isnt good for malware due to its dependencies.
RE: Developing a HTTP BOT - Vonful - Jun 19, 2018
(Jun 19, 2018 07:26 AM)Jukeboxhook Wrote: literally this. What is the point of making a botnet if it has the same features as everything else public.
EDIT: also, most people say c# isnt good for malware due to its dependencies.
Well, for the first thing: pure fun. Why make anything? Just depressing thinking otherwise.
Two, thanks for the advice. Might make a c++ one but rn c# is fine for what i've been doing.
RE: Developing a HTTP BOT - int - Jun 19, 2018
(Jun 19, 2018 12:25 PM)Vonful Wrote: Well, for the first thing: pure fun. Why make anything? Just depressing thinking otherwise.
Two, thanks for the advice. Might make a c++ one but rn c# is fine for what i've been doing.
Yeah, that makes sense, but try to make something new. Atleast try to make new features
RE: Developing a HTTP BOT - Vonful - Jun 19, 2018
(Jun 19, 2018 12:36 PM)Jukeboxhook Wrote: Yeah, that makes sense, but try to make something new. Atleast try to make new features
Well, the whole premise of my idea is just to create something stable to load our other malware onto it. For example, if we wanna mine shitcoin we can mine shitcoin with a silent miner and load it onto the bot.
Forgot to thank you for the TIP about the c++ btw, thanks :+1:
RE: Developing a HTTP BOT - Vanilla - Jun 19, 2018
(Jun 19, 2018 07:26 AM)Jukeboxhook Wrote: literally this. What is the point of making a botnet if it has the same features as everything else public.
EDIT: also, most people say c# isnt good for malware due to its dependencies.
Haha, not only its dependencies but the fact that it leaves metadata, allowing anyone and their mom to open the stub up in something like ilSpy and go to town.
(Jun 19, 2018 12:42 PM)Vonful Wrote: Well, the whole premise of my idea is just to create something stable to load our other malware onto it. For example, if we wanna mine shitcoin we can mine shitcoin with a silent miner and load it onto the bot.
Forgot to thank you for the TIP about the c++ btw, thanks :+1:
Yeah, then you want to create a stable loader, relatively easy. Create the panel front end with something like HTML/CSS, the back end in PHP or Go (my personal favorite) Then, I would recommend you code the stub in a language that compiles to machine code. Don't just go and choose C++ as coding in it can be difficult and take much longer than using a language like Rust which is native.
RE: Developing a HTTP BOT - Vonful - Jun 19, 2018
(Jun 19, 2018 12:45 PM)Airy Wrote: Haha, not only its dependencies but the fact that it leaves metadata, allowing anyone and their mom to open the stub up in something like ilSpy and go to town.
Yeah, then you want to create a stable loader, relatively easy. Create the panel front end with something like HTML/CSS, the back end in PHP or Go (my personal favorite) Then, I would recommend you code the stub in a language that compiles to machine code. Don't just go and choose C++ as coding in it can be difficult and take much longer than using a language like Rust which is native.
Thanks for the advice. I have already wrote everything basiclly. Got a front end (i[dot]imgur[dot]com/xEGN5OU.png) which I wrote in HTML, CSS, and PHP as backend. The bots are stored in a mysql database and everything functions correctly. Well, mostly. Can run commands and what not. But yeah I will take your advice and look into rust. Thanks for the input mate :)
RE: Developing a HTTP BOT - Vanilla - Jun 19, 2018
(Jun 19, 2018 12:58 PM)Vonful Wrote: Thanks for the advice. I have already wrote everything basiclly. Got a front end (i[dot]imgur[dot]com/xEGN5OU.png) which I wrote in HTML, CSS, and PHP as backend. The bots are stored in a mysql database and everything functions correctly. Well, mostly. Can run commands and what not. But yeah I will take your advice and look into rust. Thanks for the input mate :)
Glad to be of help 👍
RE: Developing a HTTP BOT - inyourmemory - Jun 19, 2018
C# botnet is very bad idea. Dependencies, big stub, easy reversal and anti debug etc other tricks like memory stuff become lot harder
RE: Developing a HTTP BOT - Vonful - Jun 19, 2018
(Jun 19, 2018 01:00 PM)Airy Wrote: Glad to be of help 👍
dont suppose you have discord?
(Jun 19, 2018 01:13 PM)Win64Worm Wrote: C# botnet is very bad idea. Dependencies, big stub, easy reversal and anti debug etc other tricks like memory stuff become lot harder
Ye I realize that one now mate LMAO was just for fun but now I wanna see how far i can take it. Thanks for the advice my man <3
RE: Developing a HTTP BOT - Theslayer - Jun 23, 2018
Get rid of that c# crap
Build a loader and store the client dll as a encrypted resource, decrypt it at runtime and inject it on several processes (chrome,firefox etc if you have formgrabber functionality, default process is explorer.exe but I have no idea if it works straight out on newer windows 10 builds)
Injection method should be NtQueueApcThread or RtlCreateUserThread , dont use CreateRemoteThread , its flagged by av
RE: Developing a HTTP BOT - Vonful - Jun 23, 2018
(Jun 23, 2018 12:05 PM)Theslayer Wrote: Get rid of that c# crap
Build a loader and store the client dll as a encrypted resource, decrypt it at runtime and inject it on several processes (chrome,firefox etc if you have formgrabber functionality, default process is explorer.exe but I have no idea if it works straight out on newer windows 10 builds)
Injection method should be NtQueueApcThread or RtlCreateUserThread , dont use CreateRemoteThread , its flagged by av
Thanks man, does help. But chances are I won't be making a c++ stub anytime soon as they're annoying to faf around with.
RE: Developing a HTTP BOT - Toxcique - Jun 23, 2018
(Jun 23, 2018 12:05 PM)Theslayer Wrote: Get rid of that c# crap
Build a loader and store the client dll as a encrypted resource, decrypt it at runtime and inject it on several processes (chrome,firefox etc if you have formgrabber functionality, default process is explorer.exe but I have no idea if it works straight out on newer windows 10 builds)
Injection method should be NtQueueApcThread or RtlCreateUserThread , dont use CreateRemoteThread , its flagged by av
Great post. thank you!