So thought I'd talk about what i've been up to recently. As you can guess form the title I've been making a HTTP Botnet.
The way mine works is a bit different (I think) from everyone elses in the terms of not using sockets and/or any reliability on tcp connections through external ports to a server.
My bot works 90% on php where payloads and Download and Execute urls are done in mysql database. The stub is C# and is very basic. When I release it people can use crypters or some shit. Or I might make a builder depending on how bored I get.
So why did I post this? Purely because I want feedback. Please tell me if you think what I've done is pure retardation or anything along them lines. I do ask tho that you don't be nasty about anything as in insults. I take HF as a place of learning not insulting.
P.S: If I got anything technically wrong in the way other botnets funcion please don't burn me at the stake because to be fair I just pulled an assumsion with no real research on how they funcion. But from what I saw of liteHTTP it uses sockets? Juding from the includes on the c# stub but again I didnt look at anything else just kinda gave in and looked how it worked, and then sockets are long then I was like fuck that lmao. Im rambling but you get me I guess.
(Jun 18, 2018 11:57 AM)Vonful Wrote: So thought I'd talk about what i've been up to recently. As you can guess form the title I've been making a HTTP Botnet.
The way mine works is a bit different (I think) from everyone elses in the terms of not using sockets and/or any reliability on tcp connections through external ports to a server.
My bot works 90% on php where payloads and Download and Execute urls are done in mysql database. The stub is C# and is very basic. When I release it people can use crypters or some shit. Or I might make a builder depending on how bored I get.
So why did I post this? Purely because I want feedback. Please tell me if you think what I've done is pure retardation or anything along them lines. I do ask tho that you don't be nasty about anything as in insults. I take HF as a place of learning not insulting.
P.S: If I got anything technically wrong in the way other botnets funcion please don't burn me at the stake because to be fair I just pulled an assumsion with no real research on how they funcion. But from what I saw of liteHTTP it uses sockets? Juding from the includes on the c# stub but again I didnt look at anything else just kinda gave in and looked how it worked, and then sockets are long then I was like fuck that lmao. Im rambling but you get me I guess.
Yours is no different to other HTTP botnets. The use of TCP connections is mostly used in IRC botnets, where a constant link is made.
(Jun 18, 2018 12:45 PM)A Kitty Wrote: Yours is no different to other HTTP botnets. The use of TCP connections is mostly used in IRC botnets, where a constant link is made.
Thanks for the correction. :D
DO NOT DEAL WITH THIS MEMBER
Jun 19, 2018 07:26 AM
(This post was last modified: Jun 19, 2018 07:26 AM by int.)
(Jun 18, 2018 12:45 PM)A Kitty Wrote: Yours is no different to other HTTP botnets. The use of TCP connections is mostly used in IRC botnets, where a constant link is made.
literally this. What is the point of making a botnet if it has the same features as everything else public.
EDIT: also, most people say c# isnt good for malware due to its dependencies.
(Jun 19, 2018 07:26 AM)int Wrote: literally this. What is the point of making a botnet if it has the same features as everything else public.
EDIT: also, most people say c# isnt good for malware due to its dependencies.
Well, for the first thing: pure fun. Why make anything? Just depressing thinking otherwise.
Two, thanks for the advice. Might make a c++ one but rn c# is fine for what i've been doing.
DO NOT DEAL WITH THIS MEMBER
(Jun 19, 2018 12:25 PM)Vonful Wrote: Well, for the first thing: pure fun. Why make anything? Just depressing thinking otherwise.
Two, thanks for the advice. Might make a c++ one but rn c# is fine for what i've been doing.
Yeah, that makes sense, but try to make something new. Atleast try to make new features
(Jun 19, 2018 12:36 PM)int Wrote: Yeah, that makes sense, but try to make something new. Atleast try to make new features
Well, the whole premise of my idea is just to create something stable to load our other malware onto it. For example, if we wanna mine shitcoin we can mine shitcoin with a silent miner and load it onto the bot.
Forgot to thank you for the TIP about the c++ btw, thanks :+1:
Jun 19, 2018 12:45 PM
(This post was last modified: Jun 19, 2018 12:47 PM by Vanilla.)
(Jun 19, 2018 07:26 AM)int Wrote: literally this. What is the point of making a botnet if it has the same features as everything else public.
EDIT: also, most people say c# isnt good for malware due to its dependencies.
Haha, not only its dependencies but the fact that it leaves metadata, allowing anyone and their mom to open the stub up in something like ilSpy and go to town.
(Jun 19, 2018 12:42 PM)Vonful Wrote: Well, the whole premise of my idea is just to create something stable to load our other malware onto it. For example, if we wanna mine shitcoin we can mine shitcoin with a silent miner and load it onto the bot.
Forgot to thank you for the TIP about the c++ btw, thanks :+1:
Yeah, then you want to create a stable loader, relatively easy. Create the panel front end with something like HTML/CSS, the back end in PHP or Go (my personal favorite) Then, I would recommend you code the stub in a language that compiles to machine code. Don't just go and choose C++ as coding in it can be difficult and take much longer than using a language like Rust which is native.
(Jun 19, 2018 12:45 PM)Vanilla Wrote: Haha, not only its dependencies but the fact that it leaves metadata, allowing anyone and their mom to open the stub up in something like ilSpy and go to town.
Yeah, then you want to create a stable loader, relatively easy. Create the panel front end with something like HTML/CSS, the back end in PHP or Go (my personal favorite) Then, I would recommend you code the stub in a language that compiles to machine code. Don't just go and choose C++ as coding in it can be difficult and take much longer than using a language like Rust which is native.
Thanks for the advice. I have already wrote everything basiclly. Got a front end (i[dot]imgur[dot]com/xEGN5OU.png) which I wrote in HTML, CSS, and PHP as backend. The bots are stored in a mysql database and everything functions correctly. Well, mostly. Can run commands and what not. But yeah I will take your advice and look into rust. Thanks for the input mate :)
(Jun 19, 2018 12:58 PM)Vonful Wrote: Thanks for the advice. I have already wrote everything basiclly. Got a front end (i[dot]imgur[dot]com/xEGN5OU.png) which I wrote in HTML, CSS, and PHP as backend. The bots are stored in a mysql database and everything functions correctly. Well, mostly. Can run commands and what not. But yeah I will take your advice and look into rust. Thanks for the input mate :)
Glad to be of help 👍
Jun 19, 2018 01:13 PM
(This post was last modified: Jun 19, 2018 01:14 PM by inyourmemory.)
C# botnet is very bad idea. Dependencies, big stub, easy reversal and anti debug etc other tricks like memory stuff become lot harder
Jun 19, 2018 01:14 PM
(This post was last modified: Jun 19, 2018 01:15 PM by Vonful.)
(Jun 19, 2018 01:00 PM)Vanilla Wrote: Glad to be of help 👍
dont suppose you have discord?
(Jun 19, 2018 01:13 PM)inyourmemory Wrote: C# botnet is very bad idea. Dependencies, big stub, easy reversal and anti debug etc other tricks like memory stuff become lot harder
Ye I realize that one now mate LMAO was just for fun but now I wanna see how far i can take it. Thanks for the advice my man <3
Get rid of that c# crap
Build a loader and store the client dll as a encrypted resource, decrypt it at runtime and inject it on several processes (chrome,firefox etc if you have formgrabber functionality, default process is explorer.exe but I have no idea if it works straight out on newer windows 10 builds)
Injection method should be NtQueueApcThread or RtlCreateUserThread , dont use CreateRemoteThread , its flagged by av
(Jun 23, 2018 12:05 PM)Theslayer Wrote: Get rid of that c# crap
Build a loader and store the client dll as a encrypted resource, decrypt it at runtime and inject it on several processes (chrome,firefox etc if you have formgrabber functionality, default process is explorer.exe but I have no idea if it works straight out on newer windows 10 builds)
Injection method should be NtQueueApcThread or RtlCreateUserThread , dont use CreateRemoteThread , its flagged by av
Thanks man, does help. But chances are I won't be making a c++ stub anytime soon as they're annoying to faf around with.
(Jun 23, 2018 12:05 PM)Theslayer Wrote: Get rid of that c# crap
Build a loader and store the client dll as a encrypted resource, decrypt it at runtime and inject it on several processes (chrome,firefox etc if you have formgrabber functionality, default process is explorer.exe but I have no idea if it works straight out on newer windows 10 builds)
Injection method should be NtQueueApcThread or RtlCreateUserThread , dont use CreateRemoteThread , its flagged by av
Great post. thank you!
|
