Rooba
/
pupy
mirror of https://github.com/n1nj4sec/pupy.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update README.md 

Removed French accent (mostly: English does not have a space in front on exclamation mark, colon, question mark, etc, and does not generally have colon for headers)
Removed dots at the ends of list items for consistency
Consistently spell auto-completion with hyphen
This commit is contained in:
Anders Hovmöller 2016-01-02 14:22:34 +01:00
parent 29d50178d9
commit fac30fe4ef
1 changed files with 30 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
README.md
View File

@ -1,42 +1,42 @@
# Pupy
Pupy is an opensource, multi-platform Remote Administration Tool with an embedded Python interpreter, allowing its modules to load python packages from memory and transparently access remote python objects. Pupy can communicate using different transports and have a bunch of cool features & modules. On Windows, Pupy uses reflective dll injection and leaves no traces on disk.
## Features :
## Features
- On windows, the Pupy payload is compiled as a reflective DLL and the whole python interpreter is loaded from memory. Pupy does not touch the disk :)
- Pupy can reflectively migrate into other processes
- Pupy can remotely import, from memory, pure python packages (.py, .pyc) and compiled python C extensions (.pyd). The imported python modules do not touch the disk. (.pyd mem import currently work on Windows only, .so memory import is not implemented).
- Modules are quite simple to write and pupy is easily extensible.
- A lot of awesome modules are already implemented !
- Pupy can remotely import, from memory, pure python packages (.py, .pyc) and compiled python C extensions (.pyd). The imported python modules do not touch the disk. (.pyd mem import currently work on Windows only, .so memory import is not implemented)
- Modules are quite simple to write and pupy is easily extensible
- A lot of awesome modules are already implemented!
- Pupy uses [rpyc](https://github.com/tomerfiliba/rpyc) and a module can directly access python objects on the remote client
- We can also access remote objects interactively from the pupy shell and even auto completion of remote attributes works !
- We can also access remote objects interactively from the pupy shell and you even get auto-completion of remote attributes!
- Communication transports are modular and pupy can communicate using obfsproxy [pluggable transports](https://www.torproject.org/docs/pluggable-transports.html.en)
- All the non interactive modules can be dispatched on multiple hosts in one command
- All the non interactive modules can be dispatched to multiple hosts in one command
- Multi-platform (tested on windows 7, windows xp, kali linux, ubuntu, osx)
- Modules can be executed as background jobs and their output be retrieved later
- Commands and scripts running on remote hosts are interruptible
- Auto-completion for commands and arguments
- Nice colored output :-)
- Commands aliases can be defined in the config
- Command aliases can be defined in the config
## Implemented Transports :
## Implemented Transports
- tcp_cleartext
- A good example to look at, it's a protocol that does nothing
- tcp_base64
- it's more to have a simple example
- Another simple example
- tcp_ssl (the default one)
- obfs3
- [A protocol to keep a third party from telling what protocol is in use based on message contents](https://gitweb.torproject.org/pluggable-transports/obfsproxy.git/tree/doc/obfs3/obfs3-protocol-spec.txt)
- scramblesuit
- [A Polymorphic Network Protocol to Circumvent Censorship](http://www.cs.kau.se/philwint/scramblesuit/)
## Implemented Launchers :
## Implemented Launchers
Launchers allow pupy to run custom actions before starting the reverse connection
- simple
- Just connect back
- auto_proxy
- Retrieve a list of possible SOCKS/HTTP proxies and try each one of them. Proxy retriaval methods are : registry, WPAD requests, gnome settings, HTTP_PROXY env variable
- Retrieve a list of possible SOCKS/HTTP proxies and try each one of them. Proxy retriaval methods are: registry, WPAD requests, gnome settings, HTTP_PROXY env variable
## Implemented Modules :
## Implemented Modules
- migrate
- inter process architecture injection also works (x86->x64 and x64->x86)
- command execution
@ -49,27 +49,27 @@ Launchers allow pupy to run custom actions before starting the reverse connectio
- screenshot
- webcam snapshot
- ~~to spy on your crush~~
- in memory execution of PE exe both x86 and x64 !
- in memory execution of PE exe both x86 and x64!
- works very well with [mimitakz](https://github.com/gentilkiwi/mimikatz) :-)
- socks5 proxy
- local port forwarding
- shellcode exec (thanks to @byt3bl33d3r)
- keylogger
- monitor keys, the windows titles the text is typed in and the clipboard ! (thanks @golind for the updates)
- monitor keys and the titles of the windows the text is typed into, plus the clipboard! (thanks @golind for the updates)
- mouselogger:
- takes small screenshots around the mouse at each click and send them back to the server (thanks @golind)
##Quick start
###Installation :
###Installation
```bash
pip install rpyc
pip install pefile
```
####Troubleshooting:
####Troubleshooting
If you have some issues with rpyc while running the server on windows, take a look at issue #25, @deathfantasy made a fix
### Generate/run a payload
In these examples the server is running on a linux host (tested on kali linux) and it's IP address is 192.168.0.1
In these examples the server is running on a linux host (tested on kali linux) and its IP address is 192.168.0.1
The clients have been tested on (Windows 7, Windows XP, kali linux, ubuntu, Mac OS X 10.10.5)
#### for Windows
```bash
@ -86,9 +86,9 @@ OFFLINE_SCRIPT = None
```
you can also :
you can also:
- use another launcher (currently simple or auto_proxy)
- use -t dll_x86 or dll_x64 to generate a reflective DLL and inject/load it by your own means.
- use -t dll_x86 or dll_x64 to generate a reflective DLL and inject/load it by your own means
- customize the transport used by supplying it with --transport
#### for Linux & Mac OS X
@ -96,9 +96,9 @@ you can also :
pip install rpyc #(or manually copy it if you are not admin)
python pp.py simple --transport tcp_ssl --host 127.0.0.2:443
```
you can also :
you can also:
- modify the default arguments at the top of the file to call pp.py without arguments
- build a single binary with pyinstaller :
- build a single binary with pyinstaller:
```bash
pyinstaller --onefile /full_path/pupy/pupy/pp.py
```
@ -133,7 +133,7 @@ pyinstaller --onefile /full_path/pupy/pupy/pp.py
![screenshot10](https://github.com/n1nj4sec/pupy/raw/master/docs/screenshots/list_modules.png "screenshot10")
##Example: How to write a MsgBox module
first of all write the function/class you want to import on the remote client
First of all write the function/class you want to import on the remote client
in the example we create the file pupy/packages/windows/all/pupwinutils/msgbox.py
```python
import ctypes
@ -190,7 +190,7 @@ yaml (only needed if using scramblesuit transport)
Some ideas without any priority order
- [X] ~~make the PE memory execution works interactively~~
- [X] ~~handle tty in interactive shell~~
- [X] ~~exfiltration through obfsproxy obfuscated network stream ?~~
- [X] ~~exfiltration through obfsproxy obfuscated network stream?~~
- [X] ~~webcam snapshots~~
- [ ] bind payloads instead of reverse
- [ ] make the network transports stackable (for example to encapsulate SSL over scramblesuit)
@ -205,8 +205,8 @@ Some ideas without any priority order
- [ ] remote port forwarding
- [ ] add a wiki and write some documentation
- [ ] split the README into the wiki
- [ ] The backdoor factory ?
- [ ] Impacket ?
- [ ] The backdoor factory?
- [ ] Impacket?
- [X] support for https & socks proxy
- [ ] HTTP transport
- [ ] UDP transport
@ -215,14 +215,14 @@ Some ideas without any priority order
- [ ] bypass UAC module
- [ ] privilege elevation module
- ...
- any cool idea ?
- other cool ideas?
## FAQ
> Does the server works on windows ?
> Does the server work on windows?
Pupy server works best on linux. the server on windows has not been really tested and there is probably a lot of bugs. I try my best to code in a portable way but it don't always find the time to fix everything. If you find the courage to patch non portable code, I will gladly accept push requests ! :)
Pupy server works best on linux. The server on windows has not been really tested and there is probably a lot of bugs. I try my best to code in a portable way but I don't always find the time to fix everything. If you find the courage to patch non-portable code, I will gladly accept pull requests! :)
> I can't install it how does it work ?
> I can't install it, how does it work?
Use pip to install all the dependencies
@ -236,4 +236,4 @@ on Twitter: [Follow me on twitter](https://twitter.com/n1nj4sec)
[![Join the chat at https://gitter.im/n1nj4sec/pupy](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/n1nj4sec/pupy?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
If some of you want to participate or send me a feedback, don't hesitate :-)
This project is a personal development, please respect its philosophy and don't use it for evil purpose !
This project is a personal project, please respect its philosophy and don't use it for evil purposes!