Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers (30 page)

1. Beautiful Soup (2012). Crummy.com. Retrieved from <
http://www.crummy.com/software/BeautifulSoup/
>, February 16.

2. Cha, A., & Nakashima, E. (2010). Google China cyberattack part of vast espionage campaign, experts say.
Washington Post
. Retrieved from <
http://www.washingtonpost.com/wp-dyn/content/article/2010/01/13/AR2010011300359.html
>, January 13.

3. Constantin, L. (2012). Expect more cyber-espionage, sophisticated malware in ’12, experts say. G.E. Investigations, LLC. Retrieved from <
http://geinvestigations.com/blog/tag/social-engineering-operation-aurora/
>, January 2.

4. Google (2010). Google web search API (depreciated). Retrieved from <
https://developers.google.com/web-search/
>, November 1.

5. List of user-agent strings (2012). User Agent String.com. Retrieved from <
http://www.useragentstring.com/pages/useragentstring.php
>, February 17.

6. Matrosov, A., Rodionov, E., Harlely, D., & Malcho, J. (2010).
Stuxnet under the microscope
. Eset.com. Retrieved from <
go.eset.com/us/resources/white-papers/Stuxnet_Under_the_Microscope.pdf
>.

7. Mechanize (2010). Mechanize home page. Retrieved from <
http://wwwsearch.sourceforge.net/mechanize/
>, April.

8. Twitter (2012). Twitter API. Retrieved from <
https://dev.twitter.com/docs
>, February 17.

9. Wilson, B. (2005). URL encoding. Blooberry.com. Retrieved from <
http://www.blooberry.com/indexdot/html/topics/urlencoding.htm
>.

10. Zetter, K. (2010). Google hack attack was ultra-sophisticated, new details show. Wired.com. Retrieved from <
http://www.wired.com/threatlevel/2010/01/operation-aurora/
>, January 14.

 
Working with Python Ctypes.

 
Anti-Virus Evasion using Python.

 
Building a Win32 Executable using Pyinstaller.

 
Utilizing HTTPLib to GET/POST HTTP Requests.

 
Interacting with an Online Virus Scanner.

On May 28, 2012, the Maher Center in Iran detected a complex and sophisticated cyber-attack against its network (
CERTCC, 2011
). This attack proved so sophisticated that 43 out of 43 tested antivirus engines could not identify the code used in the attack as malicious. Dubbed “Flame” after some ASCII strings included in the code, the malware appeared to infect systems in Iran as a state-run cyber-esponiage strategy (
Zetter, 2012
). With compiled Lua scripts named Beetlejuice, Microbe, Frog, Snack, and Gator, the malware beaconed via Bluetooth, covertly recorded audio, infected nearby machines, and uploaded screenshots and data to remote command and control servers (
Analysis Team, 2012
).

Estimates gauge the malware as at least two years old. Kapersky Lab was quick to explain that Flame is “one of the most complex threats ever discovered.
It’s big and incredibly sophisticated” (
Gostev, 2012
). Yet how did antivirus engines fail to detect it for at least 2 years? They failed to detect it because most antivirus engines still primarily use signature-based detection as their main method of detection. While some vendors have begun incorporating more complex methods such as heuristics or reputation scoring, these are still novel in concept.

In the final chapter, we will create a piece of malware intended to evade antivirus engines. The concept used is largely the work of Mark Baggett, who shared his method with followers of the SANS Penetration Testing Blog almost a year ago (
Baggett, 2011
). Yet the method for bypassing antivirus programs is still functional at the time of writing this chapter. Taking a nod from Flame, which used compiled Lua scripts, we will implement Mark’s method and compile Python code into a Windows executable in order to evade antivirus programs.

In order to create the malware, we need some malicious code. The Metasploit framework contains a repository of malicious payloads (250 at the time of this writing). We can use Metasploit to generate some C-style shellcode for a malicious payload. We will use a simple Windows bindshell that will bind the cmd.exe process to a TCP port of our choosing: this allows an attacker to remotely connect to a machine and issue commands that interact with the cmd.exe process:

Next, we will write a script that will execute the C-style shellcode. Python allows for importing foreign function libraries. We can import the library ctypes, which will allow us to interact with data types for the C programming language. After defining a variable to store our shellcode, we simply cast it as a C-function and execute it. For future reference, we will save this file as bindshell.py:

While the script at this point will execute on a Windows machine with a Python interpreter installed, let’s improve it by compiling the software with Pyinstaller (available from
http://www.pyinstaller.org/
). Pyinstaller will convert our Python script into a stand-alone executable that can be distributed to systems that do not have a Python interpreter. Before compiling our script, it is necessary to run the Configure.py script bundled with Pyinstaller:

Next, we will instruct Pyinstaller to build an executable spec file for a Windows portable executable. We will instruct Pyinstaller not to display a console with the --noconsole option and to build the final executable into one single flat file with the --onefile option:

With the spec file built, we can instruct Pyinstaller to build an executable for redistribution to our victims. Pyinstaller creates an executable named bindshell.exe in the bindshell\dist\ directory. We can now redistribute this executable to any Windows 32-bit victim:

After running the executable on a victim, we see that TCP port 1337 is listening:

Connecting to the victim’s IP address and TCP port 1337, we see our malware is working successfully, as expected. But can it successfully evade anti-virus programs? We will write a Python script to verify this in the next section: