SafeBreach-Labs/pyekaboo

Stars
148
Rank 244,896 (Top 5 %)
Language
Python
License
BSD 3-Clause "New...
Created about 7 years ago
Updated over 1 year ago

SafeBreach-Labs/pyekaboo

SafeBreach-Labs

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Proof-of-concept program that is able to to hijack/hook/proxy Python module(s) thanks to $PYTHONPATH variable

Pyekaboo

Pyekaboo is a proof-of-concept program that is able to to hijack/hook/proxy Python module(s) thanks to $PYTHONPATH variable. It's like "DLL Search Order Hijacking" for Python.

It was released as part of the Backdooring Your Python Programs talk given at THOTCON 0x8 conference by Itzik Kotler from SafeBreach Labs.

Slides are availble here

Version

0.1.0

Installation

Pyekaboo requires Python and was tested with Python 2.7.10.

$ git clone https://github.com/SafeBreach-Labs/pyekaboo.git
$ cd pyekaboo
$ cd pyekaboo
$ python mkpyekaboo.py -h

Example: Debugging Python's sockets Module

# assume pyekaboo root directory
$ cd scripts
$ python ../pyekaboo/mkpyekaboo.py -l 6 socket
$ ./enable_pyekaboo.sh -i
$ python ../test_apps/django_test/blog/manage.py runserver

License

BSD 3-Clause

pinjectra

Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)

SirepRAT

Remote Command Execution as SYSTEM on Windows IoT Core (releases available for Python2.7 & Python3)

EDRaser

EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual.

pwndsh

Post-exploitation framework (and an interactive shell) developed in Bash shell scripting

pacdoor

Proof-of-concept JavaScript malware implemented as a Proxy Auto-Configuration (PAC) File

Back2TheFuture

Find patterns of vulnerabilities on Windows in order to find 0-day and write exploits of 1-days. We use Microsoft security updates in order to find the patterns.

hAFL2

A kAFL based hypervisor fuzzer which fully supports nested VMs

CloudMiner

Execute code using Azure Automation service without getting charged

wd-pretender

SimpleBITSServer

A simple python implementation of a BITS server.

BITSInject

A one-click tool to inject jobs into the BITS queue (Background Intelligent Transfer Service), allowing arbitrary program execution as the NT AUTHORITY/SYSTEM account

mkmalwarefrom

Proof-of-concept two-stage dropper generator that uses bits from external sources

spacebin

Spacebin is a proof-of-concept malware that exfiltrates data (from No Direct Internet Access environments) via triggering AV on the endpoint and then communicating back from the AV's cloud component.

CortexVortex

backdoros

backdorOS is an in-memory OS written in Python 2.7 with a built-in in-memory filesystem, hooks for open() calls and imports, Python REPL etc.

aikido_wiper

Spooler

DoubleDrive

A fully-undetectable ransomware that utilizes OneDrive to encrypt target files

AltFS

The Alternative Fileless File System

RSFW

Request Smuggling Firewall

HRS

cachetalk

Proof-of-concept program that is able to read and write arbitrary bits using HTTP server-side caching

BACE

Mapping of Binaries that allows Arbitrary Code Execution

CoWTools

Tools for analyzing Windows containers and break container's isolation

blog-snippets

Repository of Code Snippets from various SafeBreach Blog posts