0xDezzy / InsurgentFramework

A framework for creating modular bots to be used in training environments

Insurgent Framework

A framework for creating modular malware/bots to be used in training environments

Priorites

1. Modularity
2. Capability
3. Compatability
4. Portability
5. Forensically Sound

Todo

Bot

• Beahviors modules. i.e: What to do when no nodes can be contacted; chunking up response data; chunking responses to occur per command or per beacon;
• Add active day and active hour calculation to calculate_sleep()
• Ability to alter content of packaged XML content for PERSISTENT changes from C2 node. (don't know if this is possible)
• Create a tracking mechanism for threads started by commands from previous orders
• Wrap each node into a Node class upon initial import.
• Enable the sending and executing of .pyc files (serialization as well as downloading file)
• make the results sending have an option of be dependant upon the command (i.e each command results can be sent somewhere different, or not at all, etc)
• Consider making CommandObject results data into a Results object.

LP

• Add a server generating framework. Should be able to intelligently task bots, track respones, etc.
• Prevent replays

C2 Node

• Create a web GUI for building commands. Should intelligently knowh that command modules' requirements.
• Consider adding an option for all communications to follow a serialization of the CommandObjects rather than custom string parsing, etc.

Bot Builder

• Create a web GUI for creating XML settings files
• Add a GUID for the bot type; defined in the settings xml
• Add a transform method which allows the settings XML document to define the 'key' for commands and their KVP parameters. This will need to be a transform of the command handler that occurs AFTER the imports.

Milestones:

1/15/2015 - Dynamic Importer and beaconing handler verified
2/9/2015 - The controller works; albeit needs some documenting (DOCSTRINGS) and testing.
2/11/2015 - All configurations are now parsed from XML settings file.
2/12/2015 - Packing script (build.py) completed.
2/14/2015 - Created a translator for encoding C2 messages and decoding responses.

Dependencies

• Python 2.7
• Pyinstaller
• Bottle

Other dependencies will be required by specific modules

Notes:

I had to modify pyinstaller to get it to recursively analyze dynamically imported modules' dependencies.

If not building pyinstaller from their Git repo, make sure you make the change manually:
https://github.com/pyinstaller/pyinstaller/commit/e9575e1145718ecc49625b782cee7cbb41d8522b

Installation

Usage

Build.py

python build.py -h

Translator.py

python translator.py -h

Base.py

It is not recommended to use base.py for testing purposes because most errors are likely to occur within the importing. However, if you are trying to test the module and don't want to worry about resolving pyinstaller import errors, you can run 'base.py'. Just make sure you settings.xml file is present in the root directory of the framework and has the same name as config.DEFAULT_CONFIG_FILE.