后门免杀工具-Backdoor-factory

水一水最近玩的工具?弄dll注入的时候用到的

?

介绍这款老工具?免杀效果一般。。但是简单实用

?

?

?

?目录:

　　　　0x01?backdoor-factory简介

　　　　0x02?特点功能

　　　　0x03?具体参数使用

　　　　PS：后门添加私钥证书

?

?

https://tools.kali.org/exploitation-tools/backdoor-factory

https://github.com/secretsquirrel/the-backdoor-factory

?

?

?

0x01?backdoor-factory简介

?

后门工厂(BDF)

?

BDF的目标是用用户所需的shell代码对可执行二进制文件进行补丁，并继续正常执行预补丁状态。

在渗透测试中，后门程序帮助渗透测试人员在目标机器上执行各种预期的操作。例如，它可以建立从目标主机到攻击机的网络连接，方便渗透测试人员控制目标主机。Kali Linux提供一个后门构建工具Backdoor Factory。该工具支持Windows PE和Linux ELF两种运行机制的可执行文件。

利用该工具，用户可以在不破坏原有可执行文件的功能的前提下，在文件的代码裂隙中插入恶意代码Shellcode。当可执行文件被执行后，就可以触发恶意代码。Backdoor Factory不仅提供常用的脚本，还允许嵌入其他工具生成的Shellcode，如Metasploit。

?

[email?protected]:~# backdoor-factory
__________                __       .___                   
\______   \_____    ____ |  | __ __| _/____   ___________ 
 |    |  _/\__  \ _/ ___\|  |/ // __ |/  _ \ /  _ \_  __ \ 
 |    |   \ / __ \\  \___|    </ /_/ (  <_> |  <_> )  | \/
 |______  /(____  /\___  >__|_ \____ |\____/ \____/|__|   
        \/      \/     \/     \/    \/                    
___________              __                               
\_   _____/____    _____/  |_  ___________ ___.__.        
 |    __) \__  \ _/ ___\   __\/  _ \_  __ <   |  |        
 |     \   / __ \\  \___|  | (  <_> )  | \/\___  |        
 \___  /  (____  /\___  >__|  \____/|__|   / ____|        
     \/        \/     \/                   \/             

         Author:    Joshua Pitts
         Email:     the.midnite.runr[-at ]gmail<d o-t>com
         Twitter:   @midnite_runr
         IRC:       freenode.net #BDFactory
         
         Version:   3.4.2
         
Usage: backdoor-factory [options]

Options:
  -h,--help            show this help message and exit
  -f FILE,--file=FILE  File to backdoor
  -s SHELL,--shell=SHELL
                        Payloads that are available for use. Use ‘show‘ to see
                        payloads.
  -H HOST,--hostip=HOST
                        IP of the C2 for reverse connections.
  -P PORT,--port=PORT  The port to either connect back to for reverse shells
                        or to listen on for bind shells
  -J,--cave_jumping    Select this options if you want to use code cave
                        jumping to further hide your shellcode in the binary.
  -a,--add_new_section
                        Mandating that a new section be added to the exe
                        (better success) but less av avoidance
  -U SUPPLIED_SHELLCODE,--user_shellcode=SUPPLIED_SHELLCODE
                        User supplied shellcode,make sure that it matches the
                        architecture that you are targeting.
  -c,--cave            The cave flag will find code caves that can be used
                        for stashing shellcode. This will print to all the
                        code caves of a specific size.The -l flag can be use
                        with this setting.
  -l SHELL_LEN,--shell_length=SHELL_LEN
                        For use with -c to help find code caves of different
                        sizes
  -o OUTPUT,--output-file=OUTPUT
                        The backdoor output file
  -n NSECTION,--section=NSECTION
                        New section name must be less than seven characters
  -d DIR,--directory=DIR
                        This is the location of the files that you want to
                        backdoor. You can make a directory of file backdooring
                        faster by forcing the attaching of a codecave to the
                        exe by using the -a setting.
  -w,--change_access   This flag changes the section that houses the codecave
                        to RWE. Sometimes this is necessary. Enabled by
                        default. If disabled,the backdoor may fail.
  -i,--injector        This command turns the backdoor factory in a hunt and
                        shellcode inject type of mechanism. Edit the target
                        settings in the injector module.
  -u SUFFIX,--suffix=SUFFIX
                        For use with injector,places a suffix on the original
                        file for easy recovery
  -D,--delete_original
                        For use with injector module.  This command deletes
                        the original file.  Not for use in production systems.
                        *Author not responsible for stupid uses.*
  -O DISK_OFFSET,--disk_offset=DISK_OFFSET
                        Starting point on disk offset,in bytes. Some authors
                        want to obfuscate their on disk offset to avoid
                        reverse engineering,if you find one of those files
                        use this flag,after you find the offset.
  -S,--support_check   To determine if the file is supported by BDF prior to
                        backdooring the file. For use by itself or with
                        verbose. This check happens automatically if the
                        backdooring is attempted.
  -M,--cave-miner      Future use,to help determine smallest shellcode
                        possible in a PE file
  -q,--no_banner       Kills the banner.
  -v,--verbose         For debug information output.
  -T IMAGE_TYPE,--image-type=IMAGE_TYPE
                        ALL,x86,or x64 type binaries only. Default=ALL
  -Z,--zero_cert       Allows for the overwriting of the pointer to the PE
                        certificate table effectively removing the certificate
                        from the binary for all intents and purposes.
  -R,--runas_admin     EXPERIMENTAL Checks the PE binaries for
                        ‘requestedExecutionLevel level="highestAvailable"‘. If
                        this string is included in the binary,it must run as
                        system/admin. If not in Support Check mode it will
                        attmept to patch highestAvailable into the manifest if
                        requestedExecutionLevel entry exists.
  -L,--patch_dll       Use this setting if you DON‘T want to patch DLLs.
                        Patches by default.
  -F FAT_PRIORITY,--fat_priority=FAT_PRIORITY
                        For MACH-O format. If fat file,focus on which arch to
                        patch. Default is x64. To force x86 use -F x86,to
                        force both archs use -F ALL.
  -B BEACON,--beacon=BEACON
                        For payloads that have the ability to beacon out,set
                        the time in secs
  -m PATCH_METHOD,--patch-method=PATCH_METHOD
                        Patching methods for PE files,‘manual‘,‘automatic‘,replace and onionduke
  -b SUPPLIED_BINARY,--user_malware=SUPPLIED_BINARY
                        For onionduke. Provide your desired binary.
  -X,--xp_mode         Default: DO NOT support for XP legacy machines,use -X
                        to support XP. By default the binary will crash on XP
                        machines (e.g. sandboxes)
  -A,--idt_in_cave     EXPERIMENTAL By default a new Import Directory Table
                        is created in a new section,by calling this flag it
                        will be put in a code cave.  This can cause bianry
                        failure is some cases. Test on target binaries first.
  -C,--code_sign       For those with codesigning certs wishing to sign PE
                        binaries only. Name your signing key and private key
                        signingcert.cer and signingPrivateKey.pem repectively
                        in the certs directory it‘s up to you to obtain
                        signing certs.
  -p,--preprocess      To execute preprocessing scripts in the preprocess
                        directory

（编辑：ASP站长网）