the-backdoor-factory: initial ebuild, issue #115

This commit is contained in:
blshkv 2016-08-22 10:12:10 +08:00
parent 25fee6f016
commit e69f4934e4
No known key found for this signature in database
GPG key ID: 9CCF6FCB8D8A14BF
9 changed files with 247 additions and 0 deletions

View file

@ -0,0 +1 @@
DIST the-backdoor-factory-3.4.1.tar.gz 449857 SHA256 69da2f040586e637e7ed67aa7d4e5aabb799f467462f5299563bcbe7123fe21e SHA512 6e58a55089906daab4b1168652ac442a0ef6425c6e57967c97892bb5ed132b076238897df3868f8a3e4595b593562fc7ad235212d4af98afdc25cf5763305fc0 WHIRLPOOL 3e170f04fc33ae225e9fa7cdbb43696cce4f147e1afaf760a78e4dd2140ae199fa067dcff7958ef9c54a73b7d01a65616e1eab3fbf6987ac094a58a08835fa72

View file

@ -0,0 +1,3 @@
#!/bin/bash
/usr/share/backdoor-factory/backdoor.py "$@"

View file

@ -0,0 +1 @@
moomoo

View file

@ -0,0 +1,115 @@
Bag Attributes
localKeyID: 01 00 00 00
friendlyName: le-b8711b1c-556a-4127-abae-d6db3e3c7b25
Microsoft CSP Name: Microsoft Strong Cryptographic Provider
Key Attributes
X509v3 Key Usage: 80
-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOKqvq7VDsS4xS9q
L8zOnRVZAMpIxs81guZrwFbMPF/CCGpPad0hQoCcnlsKzU3JRPgqO0HMrcNK4pQP
cicfuiS0u2hUAwbpGjM74z2GMP9Q6095atakVxwVrCrRBkAQKKey2l6LQdxgnBoO
1szzKQbVAlIU0GXqqnFL/RhDLmSLAgMBAAECgYBSufyUNKCKPeGB16CQgEwmkXBP
Y9Zjo+UdkfAF/c5/KIMHweoiUdRCuma1VbDulem9JTSxZDF7GGavoR+JlfPKZ+p2
VgYbYtL8aS5Gz6BY+cA7sowdDBgAxc52JYwvTElhHkZdSqUk44htK898nvuZjivk
U3VfGasHnq/ES7nnQQJBAPVcs8jKDkWFkLVTmOqvlvvtSrJ0MtDKHHJRwUky6dge
zplrM2eJi0g2n5w5NQfntUHDzgP6NuQwkmcwl3NehusCQQDsfosY8bJt7yrQKuMU
pg7jQx8sMUNyDvxCD/QT/FdAhL5rxr5NgnybCADZzgpTpdVfK5wDzcwkTaeFQvj3
eXDhAkBh6OQ1M6wOQgZE1V8oB3mQflhYbdX5Sy2e0ND4jMCT5Xc78XNJ1bEm1+VJ
SerHhMbnv2LuY2KUHG3Pj6xf9VCRAkEAuGTWWcWiRNs1O4gk9GWhuAsO1Cs5Fkae
43eC7M5UzaZyvqAAo3i5ZTuxRiHDpYLowkLDa6fbova1Rk94xaR3oQJBAJCiZgOC
BTpOF739Dy1DCOhUFpuFiyNDUH+o65/XhbRNSL7G2XD41p9XOJZHyhUahMx+7WSc
sUiPBOtDEPBrg/A=
-----END PRIVATE KEY-----
Bag Attributes
localKeyID: 01 00 00 00
1.3.6.1.4.1.311.17.3.20: 58 42 39 91 8B 2F 4B E9 2C E0 86 42 21 A5 FE 3B 1B C5 90 7A
1.3.6.1.4.1.311.17.3.71: 57 00 49 00 4E 00 2D 00 30 00 38 00 4E 00 43 00 50 00 41 00 4D 00 41 00 44 00 4E 00 4F 00 00 00
1.3.6.1.4.1.311.17.3.75: 34 00 44 00 44 00 33 00 39 00 37 00 32 00 36 00 44 00 34 00 42 00 35 00 35 00 41 00 43 00 33 00 42 00 34 00 31 00 31 00 39 00 42 00 33 00 35 00 41 00 38 00 39 00 33 00 33 00 32 00 33 00 43 00 5F 00 00 00
subject=/C=US/ST=California/L=Sunnyvale/O=Atheros Communications Inc./OU=Digital ID Class 3 - Microsoft Software Validation v2/OU=SPE/CN=Atheros Communications Inc.
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)09/CN=VeriSign Class 3 Code Signing 2009-2 CA
-----BEGIN CERTIFICATE-----
MIIFEzCCA/ugAwIBAgIQcJdxwCo5UCmmjF+9sOhn/TANBgkqhkiG9w0BAQUFADCB
tjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug
YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEwMC4GA1UEAxMn
VmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAwOS0yIENBMB4XDTEwMDMz
MDAwMDAwMFoXDTEzMDMzMTIzNTk1OVowgdAxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
EwpDYWxpZm9ybmlhMRIwEAYDVQQHEwlTdW5ueXZhbGUxJDAiBgNVBAoUG0F0aGVy
b3MgQ29tbXVuaWNhdGlvbnMgSW5jLjE+MDwGA1UECxM1RGlnaXRhbCBJRCBDbGFz
cyAzIC0gTWljcm9zb2Z0IFNvZnR3YXJlIFZhbGlkYXRpb24gdjIxDDAKBgNVBAsU
A1NQRTEkMCIGA1UEAxQbQXRoZXJvcyBDb21tdW5pY2F0aW9ucyBJbmMuMIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDiqr6u1Q7EuMUvai/Mzp0VWQDKSMbPNYLm
a8BWzDxfwghqT2ndIUKAnJ5bCs1NyUT4KjtBzK3DSuKUD3InH7oktLtoVAMG6Roz
O+M9hjD/UOtPeWrWpFccFawq0QZAECinstpei0HcYJwaDtbM8ykG1QJSFNBl6qpx
S/0YQy5kiwIDAQABo4IBgzCCAX8wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCB4Aw
RAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL2NzYzMtMjAwOS0yLWNybC52ZXJpc2ln
bi5jb20vQ1NDMy0yMDA5LTIuY3JsMEQGA1UdIAQ9MDswOQYLYIZIAYb4RQEHFwMw
KjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYTATBgNV
HSUEDDAKBggrBgEFBQcDAzB1BggrBgEFBQcBAQRpMGcwJAYIKwYBBQUHMAGGGGh0
dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA/BggrBgEFBQcwAoYzaHR0cDovL2NzYzMt
MjAwOS0yLWFpYS52ZXJpc2lnbi5jb20vQ1NDMy0yMDA5LTIuY2VyMB8GA1UdIwQY
MBaAFJfQa6gmcMihP5QfCC3ENZukoR7yMBEGCWCGSAGG+EIBAQQEAwIEEDAWBgor
BgEEAYI3AgEbBAgwBgEBAAEB/zANBgkqhkiG9w0BAQUFAAOCAQEAGzt/askjM70/
2LuSRpNjMb1Q/yUcosu+LOgRsxBQfSku2S0+zERNAAOQAblFBzxdlYChvWsROKtT
2kNRbgvliOx1eCj8mgYX49oEOS+TWHXjwB7VgiYb1newgX/kTSFrckBZY16w92Uv
qu//q8ymntyxeBHzhcWrtVDrOBLV6UrlfiDnkKC3EbLbuC0VLsVi4o+4slqMHM1v
UeJQWwAg6FCmfehv/RKWQ0vosAANNP0cWZAK+8XhTNDtGEcDPLIUpDpFT/WJ8Uly
lP01ONSrALhcVvrHwxsFi/9FkSQqwj1c+d5HcGE4glduqQVm9PftGicgmMBgVC50
b2nePqsDOw==
-----END CERTIFICATE-----
Bag Attributes
1.3.6.1.4.1.311.17.3.29: 27 B3 51 76 67 33 1C E2 C1 E7 40 02 B5 FF 22 98
1.3.6.1.4.1.311.17.3.20: E2 7F 7B D8 77 D5 DF 9E 0A 3F 9E B4 CB 0E 2E A9 EF DB 69 77
1.3.6.1.4.1.311.17.3.9: 30 28 06 08 2B 06 01 05 05 07 03 04 06 08 2B 06 01 05 05 07 03 02 06 08 2B 06 01 05 05 07 03 03 06 08 2B 06 01 05 05 07 03 01
friendlyName: VeriSign Class 3 Public Primary CA
1.3.6.1.4.1.311.17.3.83: 30 46 30 21 06 0B 60 86 48 01 86 F8 45 01 07 17 06 30 12 30 10 06 0A 2B 06 01 04 01 82 37 3C 01 01 03 02 00 C0 30 21 06 0B 60 86 48 01 86 F8 45 01 07 30 01 30 12 30 10 06 0A 2B 06 01 04 01 82 37 3C 01 01 03 02 00 C0
subject=/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
issuer=/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
-----BEGIN CERTIFICATE-----
MIICPDCCAaUCEHC65B0Q2Sk0tjjKewPMur8wDQYJKoZIhvcNAQECBQAwXzELMAkG
A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz
cyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2
MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV
BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmlt
YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN
ADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhAwL0TPZ2RHP7gJYHyX3KqhE
BarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lwdd8KkMaOIG+YD/is
I19wKTakyYbnsZogy1Olhec9vn2a/iRFM9x2Fe0PonFkTGUugWhFpwIDAQABMA0G
CSqGSIb3DQEBAgUAA4GBALtMEivPLCYATxQT3ab7/AoRhIzzKBxnki98tsX63/Do
lbwdj2wsqFHMc9ikwFPwTtYmwHYBV4GSXiHx0bH/59AhWM1pF+NEHJwZRDmJXNyc
AA9WjQKZ7aKQRUzkuxCkPfAyAw7xzvjoyVGM5mKf5p/AfbdynMk2OmufTqj/ZA1k
-----END CERTIFICATE-----
Bag Attributes
1.3.6.1.4.1.311.17.3.20: 97 D0 6B A8 26 70 C8 A1 3F 94 1F 08 2D C4 35 9B A4 A1 1E F2
1.3.6.1.4.1.311.17.3.75: 44 00 34 00 37 00 44 00 42 00 44 00 32 00 46 00 39 00 45 00 33 00 33 00 36 00 35 00 46 00 42 00 42 00 45 00 30 00 30 00 38 00 44 00 37 00 31 00 46 00 42 00 30 00 36 00 37 00 31 00 36 00 46 00 5F 00 00 00
subject=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)09/CN=VeriSign Class 3 Code Signing 2009-2 CA
issuer=/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
-----BEGIN CERTIFICATE-----
MIIE/DCCBGWgAwIBAgIQZVIm4bIuGOFZDymFrCLnXDANBgkqhkiG9w0BAQUFADBf
MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT
LkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw
HhcNMDkwNTIxMDAwMDAwWhcNMTkwNTIwMjM1OTU5WjCBtjELMAkGA1UEBhMCVVMx
FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVz
dCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cu
dmVyaXNpZ24uY29tL3JwYSAoYykwOTEwMC4GA1UEAxMnVmVyaVNpZ24gQ2xhc3Mg
MyBDb2RlIFNpZ25pbmcgMjAwOS0yIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAvmcdtGCqEElvVhd8Zslehg3V8ayncYOOi4n4iASJFQa6LYQhleTR
nFBM+9IivdrysjU7Ho/DCfv8Ey5av4l8PTslHvbzWHuc9AG1xgq4gM6+J3RhZydN
auXsgWFYeaPgFxASFSew4U00fytHIES53mYkZorNT7ofxTjIVJDhcvYZZnVquUlo
zzh5DaowqNssYEie16oUAamD1ziRMDkTlgM6fEBUtq3gLxuD3KgRUj4Cs9cr/SG2
p1yjDwupphBQDjQuTafOyV4l1Iy88258KbwBXfwxh1rVjIVnWIgZoL818OoroyHn
kPaD5ajtYHhee2CD/VcLXUENY1Rg1kMh7wIDAQABo4IB2zCCAdcwEgYDVR0TAQH/
BAgwBgEB/wIBADBwBgNVHSAEaTBnMGUGC2CGSAGG+EUBBxcDMFYwKAYIKwYBBQUH
AgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9jcHMwKgYIKwYBBQUHAgIwHhoc
aHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYTAOBgNVHQ8BAf8EBAMCAQYwbQYI
KwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQU
j+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29t
L3ZzbG9nby5naWYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMDMDQGCCsG
AQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29t
MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMu
Y3JsMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFDbGFzczNDQTIwNDgtMS01NTAd
BgNVHQ4EFgQUl9BrqCZwyKE/lB8ILcQ1m6ShHvIwDQYJKoZIhvcNAQEFBQADgYEA
iwPA3ZTYQaJhabAVqHjHMMaQPH5C9yS25INzFwR/BBCcoeL6gS/rwMpE53LgULZV
ECCDbpaS5JpRarQ3MdylLeuMAMcdT+dNMrqF+E6++mdVZfBqvnrKZDgaEBB4RXYx
84Z6Aw9gwrNdnfaLZnaCG1nhg+W9SaU4VuXeQXcOWA8=
-----END CERTIFICATE-----

View file

@ -0,0 +1,23 @@
Bag Attributes
localKeyID: 01 00 00 00
friendlyName: le-b8711b1c-556a-4127-abae-d6db3e3c7b25
Microsoft CSP Name: Microsoft Strong Cryptographic Provider
Key Attributes
X509v3 Key Usage: 80
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIvWI98Bl88WwCAggA
MBQGCCqGSIb3DQMHBAg1E28T7GaV6wSCAoCUNuc+AcAjzsdIpJsKHKSjbP2COAHj
YpV+KobcRxNDTQEXfdMfZTF5mAzYg4aXGlCQbgo3rVpLiVJh3RrXiQtsezVZGXW1
mU59U8bHtzh+XUX6hdsvFL9bBzx0oULQEQMubhdRMEhxfGtRaeSqPymrvDsIqqw5
0K6AO8NEZPISQrYRKxtC3h2fTQaHxVURK+F4Nc84FL1/XuLeGMEfNqRTwFuwbQMG
q01UtjPajpwHR86apRzE3SEKZMANmjXHOQuVSPzFkfY5tHbELt/H8eO/8HxfaQOK
xgrwnYujE+mgerA1nXOLlriEPUTcwZEB/dNRKQQq8GYsYAXf/Kq7Qnwjoypo1iCC
VPRSieeXJ4+PYYaoxxaUpsTBcYGxOD62KKwLnvDZGO8pazJAd5XBt6EC5UtmeZkM
ire9yjTNejj03fDbs0UJTjiI5Zxk9EubDWAOY7m9m4qOylkjxbNfW+rMzQHMSqLV
CMBkDZknrx0sbnOvqKJgYvEUkZIkr7XFoqwtZQM8M++/SgG2pWH/jibmoBam4peP
D7gkvarwTbfa0tHmwEmIg4Rq/kuH1zXNc1uFiy5t/21ozLZdlGZGTswXae6HAjHf
7mz44en2+tYrF2J5CsPO7ZOEExV2Y3YOLzNI//dKtB53CxkpD8+i6DX98RHcoKgn
XzCmMx3g+VplykJDph1Ubh94DzxZxaDJ7JBvhEJcicbLiYgPsu1YOpNTPkZE9eH8
JpV3m4v+CTx9c+AKJcAkx0ynL+n2QJqMMIAKp2CWbNm/DuCC0okImZBU1q1pRHfF
xRclmNqy5GS/nmxrvjsQiOrF5UEfvcFUw2kq1j2RpOBpse3UR7hjV1DR
-----END ENCRYPTED PRIVATE KEY-----

View file

@ -0,0 +1,23 @@
Description: add-pe-code-signing-to-backdoor-factory
Origin: upstream, http://secureallthethings.blogspot.fr/2015/12/add-pe-code-signing-to-backdoor-factory.html
Forwarded: not-needed
Last-Update: 2015-12-16
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- a/pebin.py
+++ b/pebin.py
@@ -1758,6 +1758,14 @@ class pebin():
self.binary.close()
+ if self.ZERO_CERT is True:
+ # cert was removed earlier
+ p = subprocess.Popen(['osslsigncode', '-certs', '/usr/share/backdoor-factory/certs/signingCert.cer', '-key', \
+ '/usr/share/backdoor-factory/certs/signingPrivateKey.pem', '-n', 'Security','-in', \
+ self.flItms["backdoorfile"], '-out', self.flItms["backdoorfile"], '-pass', 'moomoo'])
+
+ p.wait()
+
if self.VERBOSE is True:
self.print_flItms(self.flItms)

View file

@ -0,0 +1,50 @@
# Copyright 1999-2016 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Id$
EAPI=5
PYTHON_COMPAT=( python2_7 )
inherit eutils python-single-r1
DESCRIPTION="BDF allows to patch executable binaries with user desired shellcode"
HOMEPAGE="https://github.com/secretsquirrel/the-backdoor-factory"
SRC_URI="https://github.com/secretsquirrel/the-backdoor-factory/archive/${PV}.tar.gz -> ${P}.tar.gz"
LICENSE="BSD-4"
SLOT="0"
KEYWORDS="~x86 ~amd64"
IUSE=""
DEPEND=""
RDEPEND="${DEPEND}
>=dev-python/capstone-python-3.0
app-exploits/osslsigncode
dev-python/pefile"
src_prepare(){
epatch "${FILESDIR}"/pebin.patch
rm -r osslsigncode
rm {update.sh,install.sh}
cp "${FILESDIR}"/certs/* ./certs/
}
src_compile() {
cd ./aPLib/example/
gcc -c -I../lib/elf -m32 -Wall -O2 -s -o appack.o appack.c -v
gcc -m32 -Wall -O2 -s -o appack appack.o ../lib/elf/aplib.a -v
cd ../..
}
src_install() {
insinto /usr/share/${PN}
doins -r "${S}"/*
dobin ./aPLib/example/appack
python_fix_shebang "${ED}"/usr/share/${PN}
fperms +x /usr/share/${PN}/backdoor.py
dosym /usr/share/${PN}/backdoor.py /usr/bin/${PN}
}

28
licenses/BSD-3 Normal file
View file

@ -0,0 +1,28 @@
Copyright (c) 2013-2016, Joshua Pitts
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

View file

@ -1,2 +1,5 @@
=app-exploits/shellstorm-9999 **
=app-exploits/exploitdb-9999 **
~app-exploits/the-backdoor-factory-3.4.1
=app-exploits/osslsigncode-1.7.1_p*