SafeBreach-Labs/pacdoor

Stars
152
Rank 244,685 (Top 5 %)
Language
Python
License
BSD 3-Clause "New...
Created over 8 years ago
Updated over 8 years ago

SafeBreach-Labs/pacdoor

SafeBreach-Labs

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Proof-of-concept JavaScript malware implemented as a Proxy Auto-Configuration (PAC) File

Pacdoor

Pacdoor is a proof-of-concept JavaScript malware implemented as a Proxy Auto-Configuration (PAC) File. Pacdoor includes a 2-way communication channel, ability to exfiltrate HTTPS URLs, disable access to cherry-picked URLs etc.

It was released as part of the Crippling HTTPS with Unholy PAC talk given at BlackHat USA 2016 conference by Itzik Kotler and Amit Klein from SafeBreach Labs.

Slides are availble here

Version

0.1.0

Installation

Pacdoor requires Python 2.7.x to run.

$ git clone https://github.com/SafeBreach-Labs/pacdoor.git
$ cd pacdoor
$ cd server
$ pip install -r requirements.txt

License

BSD 3-Clause

pinjectra

Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)

SirepRAT

Remote Command Execution as SYSTEM on Windows IoT Core (releases available for Python2.7 & Python3)

EDRaser

EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual.

pwndsh

Post-exploitation framework (and an interactive shell) developed in Bash shell scripting

pyekaboo

Proof-of-concept program that is able to to hijack/hook/proxy Python module(s) thanks to $PYTHONPATH variable

Back2TheFuture

Find patterns of vulnerabilities on Windows in order to find 0-day and write exploits of 1-days. We use Microsoft security updates in order to find the patterns.

hAFL2

A kAFL based hypervisor fuzzer which fully supports nested VMs

CloudMiner

Execute code using Azure Automation service without getting charged

DoubleDrive

A fully-undetectable ransomware that utilizes OneDrive & Google Drive to encrypt target local files

wd-pretender

SimpleBITSServer

A simple python implementation of a BITS server.

BITSInject

A one-click tool to inject jobs into the BITS queue (Background Intelligent Transfer Service), allowing arbitrary program execution as the NT AUTHORITY/SYSTEM account

mkmalwarefrom

Proof-of-concept two-stage dropper generator that uses bits from external sources

spacebin

Spacebin is a proof-of-concept malware that exfiltrates data (from No Direct Internet Access environments) via triggering AV on the endpoint and then communicating back from the AV's cloud component.

CortexVortex

backdoros

backdorOS is an in-memory OS written in Python 2.7 with a built-in in-memory filesystem, hooks for open() calls and imports, Python REPL etc.

aikido_wiper

Spooler

AltFS

The Alternative Fileless File System

HRS

RSFW

Request Smuggling Firewall

cachetalk

Proof-of-concept program that is able to read and write arbitrary bits using HTTP server-side caching

QuickShell

A library and a set of tools for exploiting and communicating with Google's Quick Share devices.

BACE

Mapping of Binaries that allows Arbitrary Code Execution

CoWTools

Tools for analyzing Windows containers and break container's isolation

blog-snippets

Repository of Code Snippets from various SafeBreach Blog posts